domma-cms 0.84.0 → 0.84.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.84.0",
+  "version": "0.84.1",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@de88d71",
+  "source": "dcms-marketplace@46444b1",
   "plugins": {
     "blog": {
       "version": "1.6.3",
@@ -77,7 +77,7 @@
       }
     },
     "security": {
-      "version": "1.0.1",
+      "version": "1.0.3",
       "files": {
         "CLAUDE.md": "a9b7574236740de80513a535fb761127fa306f2177a5dda6e761213b1ad5b287",
         "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
@@ -91,11 +91,11 @@
         "admin/views/security.js": "dcd38e07c5e83bbe013f5d764c52edef76d28ed4c3fe1cba8c5a59ce1b93e962",
         "bin/unlock.js": "5fcc3c0ef3ba3c424a366aa62896f51abad578183dfde283aa838a86549ca785",
         "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
-        "plugin.js": "1561f1ed79c919e6e95407a159a3b151aa7cd867893ba17d62a8761a7fbd383b",
-        "plugin.json": "888663d6e1f9f8e9606685ec39dedad8db5f891ab91e9a8132f5292e898b5f60",
+        "plugin.js": "3051c886f77b1b1e7f45873fbdcd78a5ba2d72caea97bde1235e84a298ab6114",
+        "plugin.json": "bdcc88f0f5dec2d707806687ca80e1697255af49b4f30f43650e3824775deef8",
         "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
         "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
-        "server/facts.js": "392d8d5e74308bad8b9ff8de39c4e6221bbfd919a1cff6e0f8038937b04152f0",
+        "server/facts.js": "25538a8d1cfe012688fceb8ec0d0dd7b43ac9e168430723d6fb731183701fb46",
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
         "tests/security.test.js": "951636a0e42ac8dbf78b69ca7e7e2adcd4e29d94a51998e738c3afa742c00866"
       }

package/plugins/security/plugin.js

@@ -19,6 +19,7 @@
  *   GET|PUT /settings
  */
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import fp from 'fastify-plugin';
@@ -40,6 +41,14 @@ const NAME = 'security';
 /** A call from this machine itself, not a relayed visitor. */
 const genuinelyLocal = (request) => isLoopbackIp(request.raw?.socket?.remoteAddress) && !request.headers['x-forwarded-for'];
 
+/**
+ * This machine's own addresses (public ones included). A request from one is the
+ * server calling itself through the public name - a site's health check, Site
+ * Manager's certificate checks - and is never blocked or counted as probing.
+ */
+const OWN = new Set(Object.values(os.networkInterfaces()).flat().filter(Boolean).map(i => plainIp(i.address)));
+const isOwnAddress = (ip) => OWN.has(plainIp(ip));
+
 let commonPasswords = null;
 function common() {
     if (commonPasswords) return commonPasswords;
@@ -72,6 +81,7 @@ async function security(fastify, options = {}) {
         try {
             if (genuinelyLocal(request)) return;
             const ip = plainIp(request.ip);
+            if (isOwnAddress(ip)) return;
             const now = Date.now();
             const s = state.get();
             const blocked = blockedBy(s, ip, now);

package/plugins/security/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",

package/plugins/security/server/facts.js

@@ -112,7 +112,9 @@ export async function gatherFacts(request, {settings, checks, twoFactor = false}
     const [eng, cert, head, probes] = await Promise.all([
         engine(),
         isLocalHost(host) ? Promise.resolve(null) : certificate(host),
-        headers(origin),
+        // Headers and HTTPS are about the PUBLIC site: without a public name to ask (a check run by the site
+        // itself, or on localhost) they are left unanswered rather than judged on the local port.
+        isLocalHost(host) ? Promise.resolve(null) : headers(origin),
         probeFiles(port)
     ]);
     const smtp = getConfig('site')?.smtp || {};