create-nextjs-cms 0.9.32 → 0.9.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextjs-cms",
-  "version": "0.9.32",
+  "version": "0.9.33",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,8 +28,8 @@
     "prettier": "^3.3.3",
     "tsx": "^4.20.6",
     "typescript": "^5.9.2",
-    "@lzcms/prettier-config": "0.1.0",
     "@lzcms/eslint-config": "0.3.0",
+    "@lzcms/prettier-config": "0.1.0",
     "@lzcms/tsconfig": "0.1.0"
   },
   "prettier": "@lzcms/prettier-config",

package/templates/default/app/api/document/route.ts

@@ -19,6 +19,17 @@ import { getCMSConfig } from 'nextjs-cms/core/config'
 
 export async function GET(request: NextRequest) {
     const session = await auth()
+
+    // Check if the session is valid
+    if (!session || !session.user) {
+        return NextResponse.json(
+            {
+                error: 'Invalid token',
+            },
+            { status: 401 },
+        )
+    }
+
     const searchParams = request.nextUrl.searchParams
 
     const name = searchParams.get('name')
@@ -34,16 +45,6 @@ export async function GET(request: NextRequest) {
         )
     }
 
-    // Check if the session is valid
-    if (!session || !session.user) {
-        return NextResponse.json(
-            {
-                error: 'Invalid token',
-            },
-            { status: 401 },
-        )
-    }
-
     const uploadsFolder: string = (await getCMSConfig()).media.upload.path
 
     // Sanitize the inputs
@@ -152,13 +153,21 @@ export async function GET(request: NextRequest) {
     const fileSize = fileStats.size
     const fileMimeType = fileType.mime
 
-    const data: ReadableStream<Uint8Array> = await streamFile(pathToFile)
+    let data: ReadableStream<Uint8Array>
+    try {
+        data = await streamFile(pathToFile)
+    } catch {
+        return NextResponse.json({ error: 'File not found' }, { status: 404 })
+    }
 
     return new NextResponse(data, {
         headers: {
             'Content-Length': fileSize.toString(),
             'Content-Type': fileMimeType,
             'Content-Disposition': 'inline',
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Security-Policy': "default-src 'none'",
+            'Referrer-Policy': 'no-referrer',
         },
         status: 200,
     })

package/templates/default/app/api/photo/route.ts

@@ -1,7 +1,20 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { getPhoto } from 'nextjs-cms/api/server/actions'
+import auth from 'nextjs-cms/auth'
 
 export async function GET(request: NextRequest) {
+    const session = await auth()
+
+    // Check if the session is valid
+    if (!session || !session.user) {
+        return NextResponse.json(
+            {
+                error: 'Invalid token',
+            },
+            { status: 401 },
+        )
+    }
+
     const searchParams = request.nextUrl.searchParams
 
     const name = searchParams.get('name')
@@ -17,7 +30,7 @@ export async function GET(request: NextRequest) {
         )
     }
 
-    const base64String =  await getPhoto({
+    const base64String = await getPhoto({
         name,
         folder,
         isThumb: isThumb === 'true',

package/templates/default/app/api/video/route.ts

@@ -20,6 +20,17 @@ import { getCMSConfig } from 'nextjs-cms/core/config'
 
 export async function GET(request: NextRequest) {
     const session = await auth()
+
+    // Check if the session is valid
+    if (!session || !session.user) {
+        return NextResponse.json(
+            {
+                error: 'Invalid token',
+            },
+            { status: 401 },
+        )
+    }
+
     const searchParams = request.nextUrl.searchParams
 
     const name = searchParams.get('name')
@@ -35,16 +46,6 @@ export async function GET(request: NextRequest) {
         )
     }
 
-    // Check if the session is valid
-    if (!session || !session.user) {
-        return NextResponse.json(
-            {
-                error: 'Invalid token',
-            },
-            { status: 401 },
-        )
-    }
-
     const uploadsFolder: string = (await getCMSConfig()).media.upload.path
 
     // Sanitize the inputs
@@ -142,32 +143,42 @@ export async function GET(request: NextRequest) {
     const videoMimeType = fileType.mime
 
     let res = null
-    if (range) {
-        const parts = range.replace(/bytes=/, '').split('-')
-        const start = parseInt(parts[0] ?? '0', 10)
-        const end = parts[1] ? parseInt(parts[1], 10) : videoSize - 1
-        const chunkSize = end - start + 1
-
-        const data: ReadableStream<Uint8Array> = await streamFile(pathToFile, { start, end })
-
-        res = new NextResponse(data, {
-            headers: {
-                'Content-Range': `bytes ${start}-${end}/${videoSize}`,
-                'Accept-Ranges': 'bytes',
-                'Content-Length': chunkSize.toString(),
-                'Content-Type': videoMimeType,
-            },
-            status: 206,
-        })
-    } else {
-        const data: ReadableStream<Uint8Array> = await streamFile(pathToFile)
-        res = new NextResponse(data, {
-            headers: {
-                'Content-Length': videoSize.toString(),
-                'Content-Type': videoMimeType,
-            },
-            status: 200,
-        })
+    try {
+        if (range) {
+            const parts = range.replace(/bytes=/, '').split('-')
+            const start = parseInt(parts[0] ?? '0', 10)
+            const end = parts[1] ? parseInt(parts[1], 10) : videoSize - 1
+            const chunkSize = end - start + 1
+
+            const data: ReadableStream<Uint8Array> = await streamFile(pathToFile, { start, end })
+
+            res = new NextResponse(data, {
+                headers: {
+                    'Content-Range': `bytes ${start}-${end}/${videoSize}`,
+                    'Accept-Ranges': 'bytes',
+                    'Content-Length': chunkSize.toString(),
+                    'Content-Type': videoMimeType,
+                    'X-Content-Type-Options': 'nosniff',
+                    'Content-Security-Policy': "sandbox; default-src 'none'",
+                    'Referrer-Policy': 'no-referrer',
+                },
+                status: 206,
+            })
+        } else {
+            const data: ReadableStream<Uint8Array> = await streamFile(pathToFile)
+            res = new NextResponse(data, {
+                headers: {
+                    'Content-Length': videoSize.toString(),
+                    'Content-Type': videoMimeType,
+                    'X-Content-Type-Options': 'nosniff',
+                    'Content-Security-Policy': "sandbox; default-src 'none'",
+                    'Referrer-Policy': 'no-referrer',
+                },
+                status: 200,
+            })
+        }
+    } catch {
+        return NextResponse.json({ error: 'File not found' }, { status: 404 })
     }
 
     return res

package/templates/default/components/media/protected-document.tsx

@@ -26,10 +26,8 @@ const ProtectedDocument = ({
 
     return (
         <div className={className}>
-            {loading && (
-                <div className='animate-pulse bg-gray-500' style={{ width, height }} />
-            )}
-            <embed
+            {loading && <div className='animate-pulse bg-gray-500' style={{ width, height }} />}
+            <iframe
                 src={url}
                 className='max-w-full'
                 width={width}

package/templates/default/package.json

@@ -70,7 +70,7 @@
     "nanoid": "^5.1.2",
     "next": "16.2.5",
     "next-themes": "^0.4.6",
-    "nextjs-cms": "0.9.32",
+    "nextjs-cms": "0.9.33",
     "plaiceholder": "^3.0.0",
     "prettier-plugin-tailwindcss": "^0.7.2",
     "qrcode": "^1.5.4",