- create_trial_account wrote a 6-field record, so the marker landed in
field 6 while firewallfalcon-trial-cleanup.sh reads field 7. Trials were
never actually removed. Write the daily-bandwidth field so the layout
matches, and drop a <user>.trial_expiry stamp so the limiter's sweep --
previously dead code, nothing ever created those files -- can act as a
fallback when atd is unavailable.
- create_user tagged every normal account as "trial"; use "normal" so the
now-working cleanup cannot delete a regular user. Also remove the
trial_expiry stamp when an account is deleted.
- ensure_firewallfalcon_dirs now chmods users.db to 0600; it stores
cleartext passwords and was created world-readable by touch.
- Replace the `sed -i "s/^user:.*/..."` record updaters with an awk-based
db_set_user_field. Values containing / or & are now stored literally and
the trailing marker field is preserved (renew_user also truncated the
record to five fields).
- Validate operator-supplied passwords: ':' breaks the record layout, a
backslash is eaten by awk -v, quotes and whitespace break the consumers.
- Use mktemp instead of the fixed /tmp/ff_banners_new.conf and
/tmp/badvpn_build paths, which root wrote in a world-writable directory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Panel, udp-custom, udpgw and falconproxy are now installed exclusively from
/opt/firewallfalcon-bundle. The raw.githubusercontent and GitHub releases
fallbacks are gone; a missing bundle file is a hard error via the new
ff_require_bundle_file helper.
- menu.sh: drop PANEL_REPO_BASE and every remote download branch
- menu.sh: falconproxy no longer queries api.github.com for releases
- menu.sh: ARM udpgw can use an optional bundled udpgw-linux-arm64
(the bundled udpgw is an x86-64 build), otherwise it builds from source
- install.sh: verify the staged bundle and mark binaries executable
- README: document the change and the remaining third-party dependencies
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
