domma-cms 0.102.0 → 0.102.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.102.0",
+  "version": "0.102.1",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/blog/lib/layouts.js

@@ -176,8 +176,10 @@ export function formatDate(value, fmt) {
 export function interpolate(tpl, vars) {
     return String(tpl ?? '')
         .replace(/<!--[\s\S]*?-->/g, '')
-        .replace(/\{\{\{(\w+)\}\}\}/g, (_, k) => String(vars[k] ?? ''))
-        .replace(/\{\{(\w+)(?::([^{}]+))?\}\}/g, (_, k, fmt) => {
+        // One pass, so a value put in is never read again for placeholders: a post that
+        // shows "{{date}}" in its text keeps it, instead of getting today's date.
+        .replace(/\{\{\{(\w+)\}\}\}|\{\{(\w+)(?::([^{}]+))?\}\}/g, (_, raw, k, fmt) => {
+            if (raw !== undefined) return String(vars[raw] ?? '');
             const v = vars[k] ?? '';
             if (fmt) {
                 const f = formatDate(v, fmt);

package/plugins/blog/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "blog",
   "displayName": "Blog",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "tier": "free",
   "description": "Public-facing blog with posts, categories and comments - layouts and listings built from editable blocks.",
   "author": "Domma CMS",

package/plugins/blog/tests/layouts.test.js

@@ -130,3 +130,9 @@ test('a card shows its date as dd/mm/yyyy; the machine value stays ISO', () => {
     assert.equal(v.date, '07/09/2026');
     assert.equal(v.publishedAt, '2026-09-07T10:00:00Z');
 });
+
+test('interpolate: a raw value is never read again for placeholders', () => {
+    // A post that shows "{{date}}" in its text keeps it.
+    assert.equal(interpolate('<div>{{{content}}}</div><p>{{title}}</p>', {content: '<code>{{date}} {{title}}</code>', title: 'T', date: 'X'}),
+        '<div><code>{{date}} {{title}}</code></div><p>T</p>');
+});

package/plugins/free-tier.lock.json

@@ -1,9 +1,9 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@45a0ace",
+  "source": "dcms-marketplace@f79220a",
   "plugins": {
     "blog": {
-      "version": "1.9.3",
+      "version": "1.9.4",
       "files": {
         "CLAUDE.md": "926730d510cc38f6764ffcb9afbed1c3ae3a547117c6c0243b14f899271350fb",
         "admin/css/index.css": "6142a6b756e1218157842528830b1e84f592f0b84b7d5ce6449db421b6f4b039",
@@ -43,14 +43,14 @@
         "config.js": "ee67396262762f5c31269d258affd75f7392a3e364f72f7792c2f1cdafd94bba",
         "docs/guide.md": "6a7466881851797789a18e0d32c4fcb515f2259b110948c55be03923c38e0de5",
         "lib/access.js": "af47440c7233a56000641a3231d7e9ff81b12f40dfb9528aa6dd4e2dd9bca8df",
-        "lib/layouts.js": "0a921fb427c5ffe0a31eb687a6f8f10cb5573a1ad638a88ce386b687b49a2692",
+        "lib/layouts.js": "dbb6ae9e514ccaf600a732702925b905131dea166d90fe759a62b6652e78e1de",
         "lib/nav-link.js": "6a8f9368bb8aee1c21e90fb335a691859cb9a9bc250c2b9167a33ca9189fa2ff",
         "lib/notices.js": "a9a2918ee6f5f7e0bbaeced0d3539584279bdbe68d15472a8615bdddb4ef905b",
         "lib/page.js": "bfb6a355a027feaf775d6d8ac871fc6d999354774e018f8e16caec551e99f40a",
         "lib/render.js": "0e97c6a950bc962c8d8ea4b2f21d06cb73fbcdc738d8942d6935d01309a29b1d",
         "lib/samples.js": "e8cdb77ce22e43937707f6854d3a5cb722437dc584e22ac7b24480bef686cf85",
         "plugin.js": "0aa46a01b5298065497f39729b88e34a9f56ac684b0a14f8d94ab6007f0221d0",
-        "plugin.json": "f74ba12c5dfef7d0b9accd267cc0c4e333ea61a936cc8afa565db82da5b02389",
+        "plugin.json": "7bfba248651527bb98fa388a66234a53e9808c6a28e878504a1fa9fae216b658",
         "plugin.public.js": "67e109da613237d9ec52e7cc2f3442bb61ca5a51cb184448b9f0d993e50f7ae3",
         "public/blog.css": "fd733e6b624190da1e70dc1b6613e2376efd7f7570a28fab311d81006d03d960",
         "public/blog.js": "d01c72a9834dcc7c5241923371f2b164ac30d20ac9f1a5c5dc5b71fa3cb09f08",
@@ -66,7 +66,7 @@
         "templates/post.html": "28e9f06071115ecc4fbba007b35782732bf12ef72528525893d424e3c4f0313f",
         "tests/access.test.js": "65b760910117c3a44195543acdcff91074f39b4e5567911a2bd8676204152cb2",
         "tests/comment-notices.test.js": "34026cc9a2a4746cf87bc41df8be849fadaa43091a72ac2aa1d06c1f437bf618",
-        "tests/layouts.test.js": "4219d0e1dab7ed11d176e8eb55086531fc4eaf375cdf3d7aea5b85073d2ace7e",
+        "tests/layouts.test.js": "554cff8194bd650cfb5f2a83c1f51c25f427c07f7dbfdc2ad9ad69bb38fca6a0",
         "tests/nav-link.test.js": "d36e33ad7483abca27ae6e2098ad2f75bafa18d91f3beba70372ebe6b9b88994",
         "tests/notices.test.js": "2b02aa84e780dc4c82e6c503fc8fe17c64a63bee0709627866ef97c99cb4e131",
         "tests/public.test.js": "a6fcdc4ede242aa050ffe5a52f970d6bec1f4a70ae78967eb8a7bdeec73df19d"

package/server/services/markdown.js

@@ -330,9 +330,8 @@ export function buildBlockStyleTag(blockName, css) {
  * Interpolate a block template against a single collection entry.
  *
  * Triple-brace `{{{field}}}` - raw HTML pass-through (no escape). Use for
- * fields that contain pre-rendered HTML. Must be processed BEFORE double-brace
- * so the outer `{`/`}` of a triple match aren't consumed by the double-brace
- * regex. Double-brace `{{field}}` - HTML-escaped (default, safe), with an
+ * fields that contain pre-rendered HTML. Both kinds are filled in ONE pass, so
+ * an inserted value is never scanned for placeholders again. Double-brace `{{field}}` - HTML-escaped (default, safe), with an
  * optional `:format` suffix (e.g. `{{_createdAt:DD MMM YYYY}}`) that applies
  * moment-style date formatting when the value parses as a Date.
  *
@@ -341,10 +340,10 @@ export function buildBlockStyleTag(blockName, css) {
  * @returns {string}
  */
 function interpolateBlockTemplate(blockTemplate, e) {
-    let html = blockTemplate.replace(/\{\{\{(\w+)\}\}\}/g, (_, key) => {
-        return String(e.data?.[key] ?? '');
-    });
-    html = html.replace(/\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, key, fmt) => {
+    // One pass: a raw value put in (pre-rendered HTML) is never read again for
+    // placeholders - text that shows "{{title}}" keeps it.
+    return blockTemplate.replace(/\{\{\{(\w+)\}\}\}|\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, raw, key, fmt) => {
+        if (raw !== undefined) return String(e.data?.[raw] ?? '');
         let value;
         if (key === '_id') value = e.id ?? '';
         else if (key === '_createdAt') value = e.meta?.createdAt ?? '';
@@ -356,7 +355,6 @@ function interpolateBlockTemplate(blockTemplate, e) {
         }
         return escapeHtmlText(value);
     });
-    return html;
 }
 
 /**
@@ -408,10 +406,10 @@ function renderCollectionBlocks(entries, blockTemplate, emptyMsg, ctaOpts, cols,
 }
 
 function renderBlockFromAttrs(tmpl, attrs, blockName = '') {
-    // Triple-brace raw pass-through first, then double-brace escaped.
-    let rendered = tmpl.replace(/\{\{\{(\w+)\}\}\}/g, (_, key) => String(attrs[key] ?? ''));
-    // `{{field}}` with optional `:format` suffix (e.g. `{{date:DD MMM YYYY}}`).
-    rendered = rendered.replace(/\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, key, fmt) => {
+    // Triple-brace raw pass-through and `{{field}}` (optional `:format`, e.g. `{{date:DD MMM YYYY}}`)
+    // in one pass, so a raw value is never read again for placeholders.
+    const rendered = tmpl.replace(/\{\{\{(\w+)\}\}\}|\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, rawKey, key, fmt) => {
+        if (rawKey !== undefined) return String(attrs[rawKey] ?? '');
         const raw = attrs[key] ?? '';
         if (fmt) {
             const formatted = formatDate(raw, fmt);