Add xlight 3.9.4.6 configuration files and update bundle release version

[N6REJ]

PR Type

Enhancement

---

Description

• Add xlight 3.9.4.6 configuration files

• Update bundle release version to 2025.7.31

• Add new release entry for version 3.9.4.6

---

Diagram Walkthrough

flowchart LR
  A["New xlight 3.9.4.6"] --> B["Configuration Files"]
  A --> C["Bundle Update"]
  B --> D["FTP Server Config"]
  B --> E["User Settings"]
  C --> F["Release Properties"]

Loading

File Walkthrough

Relevant files

Configuration changes

9 files bearsampp.conf Add xlight version configuration                                                  +4/-0      extras.properties Add external resource URLs                                                              +3/-0      ftpd.hosts Configure virtual server settings                                                +5/-0      ftpd.option Set FTP daemon options                                                                      +4/-0      ftpd.password Configure anonymous user password                                                +4/-0      ftpd.rules Create empty rules file                                                                    +1/-0      ftpd.users Configure anonymous user permissions                                          +9/-0      build.properties Update bundle release date                                                              +1/-1      releases.properties Add new version release entry                                                        +1/-0

---

[qodo-code-review]

PR Reviewer Guide 🔍

(Review updated until commit 0e00199)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Anonymous FTP access: The configuration enables anonymous FTP access with a hardcoded path that could expose sensitive files. The anonymous user is configured with read, list, and subdirectory permissions on what appears to be a development directory path. This could lead to unauthorized access to files if the path contains sensitive data.

⚡ Recommended focus areas for review Hardcoded Path The VirtualPath contains a hardcoded absolute path that appears to be development-specific and may not work in production environments or different installations. VirtualPath: "/|e:\Bearsampp-development\sandbox\www\|R--L---S" </username> Security Risk Anonymous user has a password hash configured which may create security implications. Consider if anonymous access should have any password protection. anonymous:00000000000000000000000000000000 </virtualserver>

[qodo-code-review]

PR Code Suggestions ✨

Latest suggestions up to 0e00199

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Remove hardcoded development path The hardcoded absolute path contains a development-specific directory that may not exist on other systems. Use a relative path or environment variable to ensure portability across different installations. bin/xlight3.9.4.6/ftpd.users [5] -VirtualPath: "/|e:\Bearsampp-development\sandbox\www\|R--L---S" +VirtualPath: "/|www\|R--L---S" Apply / Chat Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a hardcoded absolute path which includes a user-specific development directory, making the default configuration non-portable and likely to fail on other systems.	High
Security	Restrict admin interface binding Binding to all interfaces (0.0.0.0) with port 0 creates a security risk by potentially exposing admin functionality. Consider restricting to localhost or using a specific port for better security. bin/xlight3.9.4.6/ftpd.option [2] -RemoteAdminIPPort:"0.0.0.0:0" +RemoteAdminIPPort:"127.0.0.1:0" Apply / Chat Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a security risk by binding the remote admin interface to all network interfaces (0.0.0.0), and proposing to restrict it to localhost (127.0.0.1) significantly improves the default security.	Medium
More

---

Previous suggestions

✅ Suggestions up to commit cc9d49e

Category	Suggestion	Impact
Possible issue	✅ Fix inconsistent version dates in URL Suggestion Impact: The commit directly implements the suggested fix by changing the filename date from "2025.2.13" to "2025.7.31" to match the download path date code diff: -3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.2.13.7z +3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.7.31.7z The URL contains inconsistent version dates. The download path uses "2025.7.31" but the filename contains "2025.2.13". This mismatch will likely cause download failures or incorrect file retrieval. releases.properties [5] -3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.2.13.7z +3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.7.31.7z Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies a date mismatch in the URL which would cause a 404 error, breaking the download functionality for the new version.	High
General	Replace hardcoded development path with variable The hardcoded absolute path "e:\Bearsampp-development" appears to be a development-specific path that should not be in production configuration. This will cause path resolution issues on different systems or installations. bin/xlight3.9.4.6/ftpd.users [5] -VirtualPath: "/|e:\Bearsampp-development\sandbox\www\|R--L---S" +VirtualPath: "/|{BEARSAMPP_ROOT}\www\|R--L---S" Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a hardcoded, developer-specific absolute path that would break the application on any other machine, making it a critical portability issue.	High

✅ Suggestions up to commit 1fde2fe

Category	Suggestion	Impact
Possible issue	✅ Correct mismatched release date Suggestion Impact: The suggestion was directly implemented - the filename date was corrected from "2025.2.13" to "2025.7.31" to match the release tag in the URL code diff: -3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.2.13.7z +3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.7.31.7z The filename contains an incorrect date "2025.2.13" that doesn't match the release tag "2025.7.31". This inconsistency could cause confusion and download issues. releases.properties [5] -3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.2.13.7z +3.9.4.6 = https://github.com/Bearsampp/module-xlight/releases/download/2025.7.31/bearsampp-xlight-3.9.4.6-2025.7.31.7z Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies a date mismatch in the download URL, which would likely result in a broken link and prevent users from downloading the release.	High
	Fix hardcoded development path The hardcoded absolute path contains a development-specific directory that won't exist in production environments. Use a relative path or environment variable to ensure portability across different installations. bin/xlight3.9.4.6/ftpd.users [5] -VirtualPath: "/|e:\Bearsampp-development\sandbox\www\|R--L---S" +VirtualPath: "/|{BEARSAMPP_ROOT}\sandbox\www\|R--L---S" Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a hardcoded absolute path specific to a development environment, which would cause the application to fail in a production setting.	High

[jwaisner]

@N6REJ , looks like mailpit fails to work when changing version of Xlight to this version.

[N6REJ]

I can't confirm that issue