domma-cms 1.10.15 → 1.10.17

package/server/routes/api/media.js

@@ -2,6 +2,7 @@
  * Media API
  * GET    /api/media       - list media files
  * GET    /api/media/_count - the sidebar badge (plain text; see mediaBadge)
+ * GET    /api/media/_limits - what an upload may be (types, size, name length)
  * POST   /api/media       - upload a file
  * DELETE /api/media/:name - delete a file
  */
@@ -27,6 +28,22 @@ const ALLOWED_MIME_TYPES = new Set([
   'audio/mpeg', 'audio/mp3', 'audio/ogg', 'audio/wav', 'audio/webm',
 ]);
 
+/** The longest a sanitised file name may be. */
+const MAX_NAME_LENGTH = 200;
+
+/**
+ * What POST /media accepts, for the admin to refuse a file before sending it.
+ * `maxFileSize` is the multipart limit server.js registered at boot (config/server.json
+ * uploads.maxFileSize), so the browser and the server cannot disagree.
+ *
+ * @param {number|null|undefined} maxFileSize bytes
+ * @returns {{types: string[], maxFileSize: number|null, maxNameLength: number}}
+ */
+export function uploadLimits(maxFileSize) {
+    const n = Number(maxFileSize);
+    return {types: [...ALLOWED_MIME_TYPES], maxFileSize: n > 0 ? n : null, maxNameLength: MAX_NAME_LENGTH};
+}
+
 // Safe filename: strip path traversal and restrict to alphanumeric + safe chars
 function sanitiseFilename(name) {
     return path.basename(name).replace(/[^a-zA-Z0-9._-]/g, '_');
@@ -76,7 +93,7 @@ export function mediaBadge(files = [], now = Date.now()) {
     };
 }
 
-export async function mediaRoutes(fastify) {
+export async function mediaRoutes(fastify, opts = {}) {
     const canRead = {preHandler: [authenticate, requirePermission('media', 'read')]};
     const canCreate = {preHandler: [authenticate, requirePermission('media', 'create')]};
     const canUpdate = {preHandler: [authenticate, requirePermission('media', 'update')]};
@@ -88,12 +105,13 @@ export async function mediaRoutes(fastify) {
 
     // `_count` is not a file route: the only GET under /media/:name is /media/:name/info.
     fastify.get('/media/_count', canRead, async () => mediaBadge(await listMedia()));
+    fastify.get('/media/_limits', canCreate, async () => uploadLimits(opts.maxFileSize));
 
     fastify.post('/media', canCreate, async (request, reply) => {
       const results = [];
       for await (const data of request.files()) {
         const filename = sanitiseFilename(data.filename);
-          if (filename.length > 200) {
+          if (filename.length > MAX_NAME_LENGTH) {
               for await (const _ of data.file) { /* drain */
               }
               return reply.code(400).send({error: 'Filename is too long (max 200 characters).'});
@@ -108,6 +126,11 @@ export async function mediaRoutes(fastify) {
         const chunks = [];
         for await (const chunk of data.file) {
           chunks.push(chunk);
+        }
+        // Past uploads.maxFileSize the stream just stops: what arrived is the start of the
+        // file, and saving it left a broken file behind the 413.
+        if (data.file.truncated) {
+          return reply.code(413).send({error: 'request file too large'});
         }
           try {
               results.push(await saveMedia(filename, Buffer.concat(chunks)));

package/server/server.js

@@ -34,6 +34,7 @@ import {parseTrustProxy} from './services/network.js';
 import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
 import {registerAdminAssets} from './services/adminAssets.js';
+import {isActiveType, servedType} from './services/mediaTypes.js';
 import {connectSources, frameSources, imageSources} from './services/embedCsp.js';
 import {cspSources as gaSources} from './services/googleAnalytics.js';
 
@@ -419,8 +420,13 @@ await app.register(staticPlugin, {
     root: mediaDir,
     prefix: '/media/',
     decorateReply: false,
-    setHeaders: (reply) => {
+    setHeaders: (reply, filePath) => {
         reply.header('X-Content-Type-Options', 'nosniff');
+        // A file a browser would run as a document (HTML, any XML, SVG, script) is
+        // served sandboxed: shown, never able to script this site's address.
+        if (isActiveType(servedType(filePath))) {
+            reply.header('Content-Security-Policy', "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+        }
     }
 });
 
@@ -563,7 +569,7 @@ await app.register(contentPublicRoutes, {prefix: '/api'});
 await app.register(contentApiRoutes,    {prefix: '/api'});
 await app.register(sidebarRoutes,       {prefix: '/api'});
 await app.register(documentationRoutes, {prefix: '/api'});
-await app.register(mediaRoutes,       { prefix: '/api' });
+await app.register(mediaRoutes,       { prefix: '/api', maxFileSize: serverConfig.uploads.maxFileSize });
 await app.register(usersRoutes,       { prefix: '/api' });
 await app.register(pluginsRoutes,            { prefix: '/api' });
 await app.register(pluginMarketplaceRoutes,  { prefix: '/api' });

package/server/services/collections.js

@@ -271,6 +271,9 @@ export function validateEntryData(schema, data, excused = []) {
     const skip = new Set(excused);
     for (const field of (schema.fields || [])) {
         if (skip.has(field.name)) continue;
+        // Files only arrive through a form, which enforces its own `required`; the entry
+        // editor cannot add one, so a required file field must not stop an entry saving.
+        if (field.type === 'file') continue;
         const val = data[field.name];
         const isEmpty = val === undefined || val === null || val === '';
         if (field.required && isEmpty) {

package/server/services/email.js

@@ -5,6 +5,7 @@
 import nodemailer from 'nodemailer';
 import {signedOnly} from './codePolicy.js';
 import {normaliseMailHost, resolveMailHost} from './mailHost.js';
+import {fileRefs, fileUrl, fileValueText} from '../../public/js/form-files.mjs';
 
 /**
  * What a person is told when mail could not be sent. The mail server's own
@@ -283,14 +284,24 @@ export async function sendEmail(transport, {from, fromName, to, subject, html, t
  * Builds a generic table of field→value pairs from the submitted data.
  *
  * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
+ * A file field's value (one reference, or a list from a `multiple` field) is shown
+ * as a link per file, made absolute with `baseUrl` (site.json) when the site has one.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string, type?: string}>, data: Record<string, unknown>, baseUrl?: string }} opts
  * @returns {Promise<void>}
  * @throws {Error} If sending the email fails.
  */
-export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
+export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data, baseUrl = '' }) {
+    const isFile = (field) => field.type === 'file' && fileRefs(data[field.name]).length > 0;
+    const fileLinks = (val) => fileRefs(val).map((f) => {
+        const url = fileUrl(f, baseUrl);
+        const name = escapeHtml(f.name || url);
+        return /^(https?:\/\/|\/)/i.test(url) ? `<a href="${escapeHtml(url)}">${name}</a>` : name;
+    }).join('<br>');
     const rows = fields.map(field => {
         const val  = data[field.name] ?? '';
-        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
+        const safe = isFile(field) ? fileLinks(val) : escapeHtml(String(val)).replace(/\n/g, '<br>');
         const safeLabel = escapeHtml(field.label || field.name);
         return `
         <tr>
@@ -301,7 +312,7 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
 
     const plainRows = fields.map(field => {
         const val = data[field.name] ?? '';
-        return `${field.label || field.name}: ${val}`;
+        return `${field.label || field.name}: ${isFile(field) ? fileValueText(val, {base: baseUrl}) : val}`;
     }).join('\n');
 
     const html = `

package/server/services/forms.js

@@ -198,7 +198,9 @@ function toFormFieldType(type) {
         string: 'string', text: 'string', email: 'email', tel: 'tel',
         number: 'number', textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -223,6 +225,7 @@ function buildFormFromCollection(schema) {
         };
         if (f.options) field.options = f.options;
         if (f.validation) field.validation = f.validation;
+        if (f.type === 'file' && f.multiple) field.multiple = true;
         return field;
     });
 
@@ -286,7 +289,9 @@ function toCollectionFieldType(type) {
         string: 'string', email: 'email', tel: 'tel', number: 'number',
         textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -329,9 +334,12 @@ export async function ensureCollectionForForm(form) {
                 name: f.name,
                 type: toCollectionFieldType(f.type),
                 label: f.label || f.name,
-                required: !!f.required
+                // A file field's `required` is the form's to enforce (it sees the upload);
+                // copied here it would stop the entry editor saving an entry without one.
+                required: f.type === 'file' ? false : !!f.required
             };
             if (f.options) field.options = f.options;
+            if (f.type === 'file' && f.multiple) field.multiple = true;
             if (f.validation) field.validation = f.validation;
             return field;
         });

package/server/services/markdown.js

@@ -631,13 +631,29 @@ function isFileRef(v) {
     return v && typeof v === 'object' && typeof v.url === 'string' && typeof v.name === 'string';
 }
 
+/** A `multiple` file field's value: a non-empty list of nothing but file references. */
+function isFileRefList(v) {
+    return Array.isArray(v) && v.length > 0 && v.every(isFileRef);
+}
+
+/** One file reference as HTML: a thumbnail link for an image, a download link otherwise. */
+function fileRefHtml(ref) {
+    const url  = escapeAttr(ref.url);
+    const name = escapeHtmlText(ref.name);
+    if (String(ref.mime || '').startsWith('image/')) {
+        return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
+    }
+    return `<a href="${url}" download>${name}</a>`;
+}
+
 /**
  * Resolve the display value for one field on one entry.
  *
  * For a `type: reference` field, returns the resolved label from `_refs`
  * (set by `references.resolveReferences()`); arrays join with ", ", missing
  * targets render as "<id> (missing)". For a `type: file` field (or any field
- * holding a stored file ref), returns the filename. Everything else returns
+ * holding a stored file ref), returns the filename - names joined with ", " for a
+ * `multiple` field's list. Everything else returns
  * the raw value with `null`/`undefined` collapsed to '' and arrays joined.
  *
  * @param {object} entry
@@ -654,6 +670,7 @@ function displayValue(entry, field) {
     }
     const raw = entry.data?.[field.name];
     if (isFileRef(raw)) return raw.name;
+    if (isFileRefList(raw)) return raw.map(f => f.name).join(', ');
     if (raw == null) return '';
     if (Array.isArray(raw)) return raw.join(', ');
     return String(raw);
@@ -679,14 +696,8 @@ function displayValueHtml(entry, field) {
         }
     }
     const raw = entry.data?.[field.name];
-    if (isFileRef(raw)) {
-        const url  = escapeAttr(raw.url);
-        const name = escapeHtmlText(raw.name);
-        if (String(raw.mime || '').startsWith('image/')) {
-            return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
-        }
-        return `<a href="${url}" download>${name}</a>`;
-    }
+    if (isFileRef(raw)) return fileRefHtml(raw);
+    if (isFileRefList(raw)) return raw.map(fileRefHtml).join(' ');
     return escapeHtmlText(displayValue(entry, field));
 }
 

package/server/services/mediaTypes.js

@@ -0,0 +1,22 @@
+/**
+ * The type /media/ serves a stored file as, and whether a browser would run it.
+ *
+ * Uploads are served by @fastify/static from the site's own address, so a file a browser
+ * renders as a document - HTML, any XML (an XHTML-namespace <script> runs in one), SVG,
+ * script - could act with an admin's session. The lookup is the one @fastify/static makes
+ * (its own copy of `mime`), so what is checked is what is served.
+ */
+import {createRequire} from 'module';
+
+const requireHere = createRequire(import.meta.url);
+const mime = requireHere(requireHere.resolve('mime', {paths: [requireHere.resolve('@fastify/send')]}));
+
+/** The Content-Type /media/ would send for a file name, or null when it has none. */
+export function servedType(name) {
+    return mime.getType(String(name || '')) || null;
+}
+
+/** Whether a served type is one a browser runs as a document or script. */
+export function isActiveType(type) {
+    return /^(text\/html|text\/xml|application\/xml|image\/svg)|\+xml$|javascript|ecmascript/i.test(String(type || ''));
+}

package/server/templates/page.html

@@ -25,8 +25,8 @@
     <link rel="stylesheet" href="/dist/domma/themes/domma-themes.css">
 
     <!-- Site CSS -->
-    <link rel="stylesheet" href="/public/css/site.css?v=20261024-menu-highlight-fix">
-    <link rel="stylesheet" href="/public/css/forms.css?v=20260927-submit-btn-css">
+    <link rel="stylesheet" href="/public/css/site.css?v=20261025-range-slider-css">
+    <link rel="stylesheet" href="/public/css/forms.css?v=20261025-dropzone-css">
     <!-- Menu item hover / current-page effects. Loaded after site.css so a
          menu's own highlight wins over the blanket link styling there. -->
     <link rel="stylesheet" href="/public/css/menu-highlight.css?v=20261024-menu-highlight-fix">
@@ -178,12 +178,14 @@
          reads window.FormLogicEngine and window.DommaCollectionBrowser. -->
     <!-- Interactive Collection Browser (used by [collection] shortcodes with
          searchable / filterable / sortable / paginate attributes) -->
-    <script src="/public/js/collection-browser.js?v=20260927-scope-mine" defer></script>
+    <!-- Its range-filter arithmetic; a module that runs first and sets window.DommaCollectionRange -->
+    <script src="/public/js/collection-range.mjs?v=20261025-range-slider" type="module"></script>
+    <script src="/public/js/collection-browser.js?v=20261025-range-slider" defer></script>
     <!-- Core Forms logic engine (must run before forms.js and site.js) -->
-    <script src="/public/js/form-logic-engine.js?v=20260927-submit-btn" defer></script>
+    <script src="/public/js/form-logic-engine.js?v=20261025-dropzone-disable" defer></script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20261022-cookie-settings" type="module"></script>
+    <script src="/public/js/site.js?v=20261025-dropzone-range" type="module"></script>
     <script src="/public/js/collection-context.js?v=20261010-utf8-payloads" type="module"></script>
     {{ctxMenusModule}}
 
@@ -193,7 +195,7 @@
     <script src="/public/js/menu-float.js?v=20260927-float" type="module"></script>
 
     <!-- Core Forms renderer -->
-    <script src="/public/js/forms.js?v=20261015-smooth-caret" type="module"></script>
+    <script src="/public/js/forms.js?v=20261025-form-dropzone" type="module"></script>
 
     <!-- Core effects runtime -->
     <script src="/public/js/effects.js?v=20261015-occasions" defer></script>