domma-cms 1.10.16 → 1.10.17

package/server/routes/api/forms.js

@@ -27,7 +27,9 @@ import {deleteForm, ensureCollectionForForm, ensureFormsDir, listForms, readForm
 import {executeAction} from '../../services/actions.js';
 // The same rules the browser draws the buttons by (a Cancel link must be safe).
 import {buttonSettingsProblems, formClassProblems, publicButtonSettings} from '../../../public/js/form-submit.mjs';
-import {cleanUploadName, fileRefusal} from '../../../public/js/form-files.mjs';
+import {cleanUploadName, countRefusal, fileRefusal, fileRules, fileValueText, isFileValue} from '../../../public/js/form-files.mjs';
+import {sanitiseCsv} from '../../../public/js/collection-export.mjs';
+import {originOf, trustedOrigin} from '../../services/passwordReset.js';
 import {createTransport, mailFailure, sendFormEmail, TEST_EMAIL_FAILED} from '../../services/email.js';
 import {formActionFailed, formTriggerNotice} from '../../services/notification-sources.js';
 import {
@@ -44,7 +46,7 @@ import {getConfig} from '../../config.js';
 import {authenticate, requireAdmin, requirePermission} from '../../middleware/auth.js';
 import {hooks} from '../../services/hooks.js';
 import {pluginDenialFor} from '../../services/collectionAccess.js';
-import {saveMedia} from '../../services/content.js';
+import {deleteMedia, saveMedia} from '../../services/content.js';
 import {servedType} from '../../services/mediaTypes.js';
 import {v4 as uuidv4} from 'uuid';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
@@ -146,79 +148,171 @@ function validateUpload(fieldCfg, part, size) {
         || servedTypeRefusal(fieldCfg, part.filename || '');
 }
 
+/** What one submission's files may hold in memory together when server.json sets nothing: 50 MB. */
+export const DEFAULT_MAX_SUBMISSION_BYTES = 50 * 1024 * 1024;
+
+/**
+ * The most bytes one submission's files may hold in memory, all fields together:
+ * server.json `uploads.maxSubmissionBytes` (read fresh) when set; otherwise 50 MB or
+ * `uploads.maxFileSize`, whichever is larger, so one file the site takes is never
+ * refused for the total.
+ *
+ * @returns {number}
+ */
+export function maxSubmissionBytes() {
+    let uploads = {};
+    try { uploads = getConfig('server')?.uploads || {}; } catch { /* no server.json */ }
+    const set = Number(uploads.maxSubmissionBytes);
+    if (set > 0) return set;
+    return Math.max(DEFAULT_MAX_SUBMISSION_BYTES, Number(uploads.maxFileSize) || 0);
+}
+
+/** The refusal for a submission whose files together pass maxSubmissionBytes(). */
+export function submissionTooLarge(limit) {
+    const mb = limit / (1024 * 1024);
+    const size = mb >= 1 ? `${Math.round(mb * 10) / 10} MB` : `${Math.round(limit / 1024)} KB`;
+    return `The files sent are too large together (at most ${size} in one submission). Send fewer or smaller files.`;
+}
+
 /**
  * Drain a multipart request into a JSON-shaped body. Text parts become string
- * values; file parts are validated against the matching form field, saved to
- * `content/media/`, and replaced by a `{ url, name, size, mime }` reference.
+ * values; file parts are checked against the matching form field and held in
+ * memory, and the field's value becomes its reference - `{url, name, size, mime}`
+ * for a single field, a list of them for a `multiple` one - with the url filled
+ * in by saveFormFiles() once the whole submission has passed.
  *
- * Throws on validation failure (caller handles HTTP 400). Files are streamed
- * into memory up to fastify-multipart's configured limit - fine for the
- * resume-pdf / portrait-photo scale; large uploads should still use the admin
- * media flow.
+ * Throws on validation failure (caller handles HTTP 400): any one file a field
+ * would refuse, or more files than a field takes (countRefusal), refuses the
+ * submission. Files are held in memory up to fastify-multipart's configured
+ * limit, at most fileRules().maxFiles per field, and at most maxSubmissionBytes()
+ * for all of them together - the request is refused the moment the running
+ * total passes it, before the rest is read. Fine for the resume-pdf /
+ * portrait-photo scale; large uploads should still use the admin media flow.
  *
  * @param {import('fastify').FastifyRequest} request
  * @param {object} form
- * @returns {Promise<object>}
+ * @returns {Promise<{body: object, pending: Map<string, {buffer: Buffer, filename: string}[]>}>}
  */
 async function parseMultipartForm(request, form) {
     const out = {};
-    const pending = new Map();      // field name -> {buffer, filename}, saved by saveFormFiles()
+    const pending = new Map();      // field name -> [{buffer, filename}], saved by saveFormFiles()
     const fileFields = new Map(
         (form.fields || []).filter(f => f.type === 'file').map(f => [f.name, f])
     );
+    const drain = async (part) => { for await (const _ of part.file) { /* drain */ } };
+    const limit = maxSubmissionBytes();
+    let held = 0;                   // bytes of every file part so far, all fields
 
     for await (const part of request.parts()) {
         if (part.type === 'file') {
             const fieldCfg = fileFields.get(part.fieldname);
+            const list = pending.get(part.fieldname) || [];
+            const rules = fieldCfg ? fileRules(fieldCfg) : null;
             // An unknown file field, or a second file for one that holds one: drain and
             // skip rather than 400, so a form that gains a file input later doesn't reject
             // older submissions in-flight from a stale page.
-            if (!fieldCfg || pending.has(part.fieldname)) {
-                for await (const _ of part.file) { /* drain */ }
+            if (!fieldCfg || (!rules.multiple && list.length)) {
+                await drain(part);
                 continue;
             }
+            // More than a multiple field takes refuses the submission, before the
+            // extra file is read into memory.
+            if (list.length >= rules.maxFiles) {
+                await drain(part);
+                throw new Error(countRefusal(fieldCfg, list.length + 1));
+            }
             const chunks = [];
-            for await (const chunk of part.file) chunks.push(chunk);
+            let over = false;
+            for await (const chunk of part.file) {
+                if (over) continue;                // the rest of this part is drained, not held
+                held += chunk.length;
+                if (held > limit) {
+                    // Stop holding at once: drop what is read, then refuse
+                    over = true;
+                    chunks.length = 0;
+                    pending.clear();
+                    continue;
+                }
+                chunks.push(chunk);
+            }
+            if (over) throw new Error(submissionTooLarge(limit));
             const buffer = Buffer.concat(chunks);
             // Over the server's own upload cap the part arrives cut short, not refused
             const size = part.file.truncated ? Infinity : buffer.length;
             const err  = validateUpload(fieldCfg, part, size);
             if (err) throw new Error(err);
             if (buffer.length === 0) continue;     // empty file input - skip
-            pending.set(part.fieldname, {buffer, filename: part.filename});
-            out[part.fieldname] = {
-                url:  '',
-                name: part.filename,
-                size: buffer.length,
-                mime: part.mimetype
-            };
-        } else if (!pending.has(part.fieldname)) {
-            // Text field - last value wins on duplicates (browser-standard); a file
-            // already sent under the name keeps it.
+            list.push({buffer, filename: part.filename});
+            pending.set(part.fieldname, list);
+            const ref = {url: '', name: part.filename, size: buffer.length, mime: part.mimetype};
+            if (rules.multiple) (Array.isArray(out[part.fieldname]) ? out[part.fieldname] : (out[part.fieldname] = [])).push(ref);
+            else out[part.fieldname] = ref;
+        } else if (!fileFields.has(part.fieldname)) {
+            // Text field - last value wins on duplicates (browser-standard). A file
+            // field's value only ever comes from its file parts (fileFieldsOnly).
             out[part.fieldname] = part.value;
         }
     }
     return {body: out, pending};
 }
 
+/**
+ * A file field's value is only ever what this server made of the files it was
+ * sent: whatever a JSON body (or a text part) says one holds - a reference to
+ * any address - is dropped, so an entry never links to a file nobody uploaded.
+ *
+ * @param {object} form
+ * @param {object} body - mutated
+ * @param {Map<string, unknown>|null} pending
+ */
+function fileFieldsOnly(form, body, pending) {
+    if (!body || typeof body !== 'object') return;
+    for (const f of form.fields || []) {
+        if (f.type !== 'file' || !f.name || pending?.has(f.name)) continue;
+        if (body[f.name] !== undefined && body[f.name] !== '') body[f.name] = '';
+    }
+}
+
 /**
  * Write the files of a submission that passed every check, into the reference objects
  * parseMultipartForm() left in `body`. Only the fields that will be kept are written -
  * nothing a bot, a rate-limited or refused submission or a switched-off field sent
  * reaches content/media/.
  *
- * @param {Map<string, {buffer: Buffer, filename: string}>} pending
+ * If one cannot be written, the ones already written for this submission are removed
+ * and the error is thrown - a submission keeps all its files or none.
+ *
+ * @param {Map<string, {buffer: Buffer, filename: string}[]>} pending
  * @param {object} body
  * @param {Set<string>} keep - field names the submission keeps
+ * @returns {Promise<string[]>} the media file names written (for removeFormFiles)
  */
 async function saveFormFiles(pending, body, keep) {
-    for (const [name, file] of pending) {
-        if (!keep.has(name)) {
-            delete body[name];
-            continue;
+    const written = [];
+    try {
+        for (const [name, files] of pending) {
+            if (!keep.has(name)) {
+                delete body[name];
+                continue;
+            }
+            const refs = Array.isArray(body[name]) ? body[name] : [body[name]];
+            for (let i = 0; i < files.length; i++) {
+                const saved = await saveMedia(safeFilename(files[i].filename), files[i].buffer);
+                written.push(saved.name);
+                refs[i].url = saved.url;
+            }
         }
-        const saved = await saveMedia(safeFilename(file.filename), file.buffer);
-        body[name].url = saved.url;
+    } catch (err) {
+        await removeFormFiles(written);
+        throw err;
+    }
+    return written;
+}
+
+/** Remove a submission's written files again (it was not stored after all). Never throws. */
+async function removeFormFiles(names) {
+    for (const name of names || []) {
+        try { await deleteMedia(name); } catch { /* already gone */ }
     }
 }
 
@@ -244,17 +338,34 @@ function isRateLimited(slug, ip, limitPerMinute) {
     return false;
 }
 
-function submissionsToCSV(form, entries) {
+/** A stored answer as plain text: lists joined with "; ", objects as JSON. */
+function answerCsvText(raw) {
+    if (raw == null) return '';
+    if (Array.isArray(raw)) return raw.map(v => (v && typeof v === 'object' ? JSON.stringify(v) : String(v))).join('; ');
+    if (typeof raw === 'object') return JSON.stringify(raw);
+    return String(raw);
+}
+
+/**
+ * One CSV cell: quoted, inner quotes doubled, and a leading =, +, -, @, TAB or CR
+ * neutralised (sanitiseCsv, as the public collection export does) - a visitor's
+ * answer must not run as a formula in the spreadsheet an admin opens.
+ */
+function csvCell(text) {
+    return `"${sanitiseCsv(String(text ?? '')).replace(/"/g, '""')}"`;
+}
+
+export function submissionsToCSV(form, entries) {
     const fields  = (form.fields || []).filter(f => f.type !== 'page-break' && f.type !== 'spacer');
-    const headers = [...fields.map(f => `"${f.label || f.name}"`), '"Date"'];
+    const headers = [...fields.map(f => csvCell(f.label || f.name)), csvCell('Date')];
     const rows    = entries.map(e => {
         const cols = fields.map(f => {
             const raw = e.data?.[f.name] ?? '';
-            const str = Array.isArray(raw) ? raw.join('; ') : String(raw);
-            const val = str.replace(/"/g, '""');
-            return `"${val}"`;
+            // Files: "cv.pdf (/media/…)", several joined with "; " like any list. Anything
+            // else in the column (an older text answer) is written as it is.
+            return csvCell(isFileValue(raw) ? fileValueText(raw) : answerCsvText(raw));
         });
-        cols.push(`"${e.meta?.createdAt || ''}"`);
+        cols.push(csvCell(e.meta?.createdAt || ''));
         return cols.join(',');
     });
     return [headers.join(','), ...rows].join('\n');
@@ -812,6 +923,7 @@ export async function formsRoutes(fastify) {
                 return reply.status(400).send({ error: err.message });
             }
         }
+        fileFieldsOnly(form, body, pendingFiles);
         const settings = form.settings || {};
 
         // Best-effort auth - never reject, just enrich.
@@ -915,7 +1027,15 @@ export async function formsRoutes(fastify) {
         }
 
         // The checks are done: only now do a submission's files reach content/media/
-        if (pendingFiles?.size) await saveFormFiles(pendingFiles, body, record ? visibleFieldNames : new Set());
+        let writtenFiles = [];
+        if (pendingFiles?.size) {
+            try {
+                writtenFiles = await saveFormFiles(pendingFiles, body, record ? visibleFieldNames : new Set());
+            } catch (err) {
+                fastify.log.warn(`[forms] Saving the files of a "${slug}" submission failed: ${err.message}`);
+                return reply.status(500).send({error: 'Your files could not be saved, so the submission was not sent. Please try again.'});
+            }
+        }
 
         // Build submission data - only include visible fields
         const data = {};
@@ -970,12 +1090,15 @@ export async function formsRoutes(fastify) {
                 // storage is explicitly disabled with no slug. Fail loudly
                 // rather than silently lose submissions.
                 fastify.log.warn(`[forms] Submission for "${slug}" had no target collection "${targetSlug}"`);
+                await removeFormFiles(writtenFiles);
                 return reply.status(500).send({
                     error: `Submission not saved - target collection "${targetSlug}" does not exist. Please contact the site administrator.`
                 });
             }
         } catch (err) {
             fastify.log.warn(`[forms] Collection write failed for "${slug}" → "${targetSlug}": ${err.message}`);
+            // Not stored, so its files are not kept either
+            await removeFormFiles(writtenFiles);
             // Distinguish validation errors (user-actionable) from other
             // failures (admin needs to look) so the message helps the right
             // person. Validation errors typically start with "Validation failed:".
@@ -999,7 +1122,10 @@ export async function formsRoutes(fastify) {
                     subject:   `${emailAction.subjectPrefix || `[${form.title}]`} New submission`,
                     formTitle: form.title,
                     fields:    form.fields,
-                    data
+                    data,
+                    // File links in the email are absolute: site.json baseUrl, else an address an
+                    // admin has signed in at (trustedOrigin - never just this request's Host)
+                    baseUrl:   await trustedOrigin(originOf(request)).catch(() => '')
                 });
             } catch (err) {
                 fastify.log.warn(`[forms] Email send failed for "${slug}": ${err.message}`);

package/server/services/collections.js

@@ -271,6 +271,9 @@ export function validateEntryData(schema, data, excused = []) {
     const skip = new Set(excused);
     for (const field of (schema.fields || [])) {
         if (skip.has(field.name)) continue;
+        // Files only arrive through a form, which enforces its own `required`; the entry
+        // editor cannot add one, so a required file field must not stop an entry saving.
+        if (field.type === 'file') continue;
         const val = data[field.name];
         const isEmpty = val === undefined || val === null || val === '';
         if (field.required && isEmpty) {

package/server/services/email.js

@@ -5,6 +5,7 @@
 import nodemailer from 'nodemailer';
 import {signedOnly} from './codePolicy.js';
 import {normaliseMailHost, resolveMailHost} from './mailHost.js';
+import {fileRefs, fileUrl, fileValueText} from '../../public/js/form-files.mjs';
 
 /**
  * What a person is told when mail could not be sent. The mail server's own
@@ -283,14 +284,24 @@ export async function sendEmail(transport, {from, fromName, to, subject, html, t
  * Builds a generic table of field→value pairs from the submitted data.
  *
  * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
+ * A file field's value (one reference, or a list from a `multiple` field) is shown
+ * as a link per file, made absolute with `baseUrl` (site.json) when the site has one.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string, type?: string}>, data: Record<string, unknown>, baseUrl?: string }} opts
  * @returns {Promise<void>}
  * @throws {Error} If sending the email fails.
  */
-export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
+export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data, baseUrl = '' }) {
+    const isFile = (field) => field.type === 'file' && fileRefs(data[field.name]).length > 0;
+    const fileLinks = (val) => fileRefs(val).map((f) => {
+        const url = fileUrl(f, baseUrl);
+        const name = escapeHtml(f.name || url);
+        return /^(https?:\/\/|\/)/i.test(url) ? `<a href="${escapeHtml(url)}">${name}</a>` : name;
+    }).join('<br>');
     const rows = fields.map(field => {
         const val  = data[field.name] ?? '';
-        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
+        const safe = isFile(field) ? fileLinks(val) : escapeHtml(String(val)).replace(/\n/g, '<br>');
         const safeLabel = escapeHtml(field.label || field.name);
         return `
         <tr>
@@ -301,7 +312,7 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
 
     const plainRows = fields.map(field => {
         const val = data[field.name] ?? '';
-        return `${field.label || field.name}: ${val}`;
+        return `${field.label || field.name}: ${isFile(field) ? fileValueText(val, {base: baseUrl}) : val}`;
     }).join('\n');
 
     const html = `

package/server/services/forms.js

@@ -198,7 +198,9 @@ function toFormFieldType(type) {
         string: 'string', text: 'string', email: 'email', tel: 'tel',
         number: 'number', textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -223,6 +225,7 @@ function buildFormFromCollection(schema) {
         };
         if (f.options) field.options = f.options;
         if (f.validation) field.validation = f.validation;
+        if (f.type === 'file' && f.multiple) field.multiple = true;
         return field;
     });
 
@@ -286,7 +289,9 @@ function toCollectionFieldType(type) {
         string: 'string', email: 'email', tel: 'tel', number: 'number',
         textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -329,9 +334,12 @@ export async function ensureCollectionForForm(form) {
                 name: f.name,
                 type: toCollectionFieldType(f.type),
                 label: f.label || f.name,
-                required: !!f.required
+                // A file field's `required` is the form's to enforce (it sees the upload);
+                // copied here it would stop the entry editor saving an entry without one.
+                required: f.type === 'file' ? false : !!f.required
             };
             if (f.options) field.options = f.options;
+            if (f.type === 'file' && f.multiple) field.multiple = true;
             if (f.validation) field.validation = f.validation;
             return field;
         });

package/server/services/markdown.js

@@ -631,13 +631,29 @@ function isFileRef(v) {
     return v && typeof v === 'object' && typeof v.url === 'string' && typeof v.name === 'string';
 }
 
+/** A `multiple` file field's value: a non-empty list of nothing but file references. */
+function isFileRefList(v) {
+    return Array.isArray(v) && v.length > 0 && v.every(isFileRef);
+}
+
+/** One file reference as HTML: a thumbnail link for an image, a download link otherwise. */
+function fileRefHtml(ref) {
+    const url  = escapeAttr(ref.url);
+    const name = escapeHtmlText(ref.name);
+    if (String(ref.mime || '').startsWith('image/')) {
+        return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
+    }
+    return `<a href="${url}" download>${name}</a>`;
+}
+
 /**
  * Resolve the display value for one field on one entry.
  *
  * For a `type: reference` field, returns the resolved label from `_refs`
  * (set by `references.resolveReferences()`); arrays join with ", ", missing
  * targets render as "<id> (missing)". For a `type: file` field (or any field
- * holding a stored file ref), returns the filename. Everything else returns
+ * holding a stored file ref), returns the filename - names joined with ", " for a
+ * `multiple` field's list. Everything else returns
  * the raw value with `null`/`undefined` collapsed to '' and arrays joined.
  *
  * @param {object} entry
@@ -654,6 +670,7 @@ function displayValue(entry, field) {
     }
     const raw = entry.data?.[field.name];
     if (isFileRef(raw)) return raw.name;
+    if (isFileRefList(raw)) return raw.map(f => f.name).join(', ');
     if (raw == null) return '';
     if (Array.isArray(raw)) return raw.join(', ');
     return String(raw);
@@ -679,14 +696,8 @@ function displayValueHtml(entry, field) {
         }
     }
     const raw = entry.data?.[field.name];
-    if (isFileRef(raw)) {
-        const url  = escapeAttr(raw.url);
-        const name = escapeHtmlText(raw.name);
-        if (String(raw.mime || '').startsWith('image/')) {
-            return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
-        }
-        return `<a href="${url}" download>${name}</a>`;
-    }
+    if (isFileRef(raw)) return fileRefHtml(raw);
+    if (isFileRefList(raw)) return raw.map(fileRefHtml).join(' ');
     return escapeHtmlText(displayValue(entry, field));
 }