domma-cms 1.10.16 → 1.10.18

package/server/services/forms.js

@@ -9,6 +9,38 @@ import {fileURLToPath} from 'url';
 import * as cache from './cache/index.js';
 import {buttonSettingsProblems, formClassProblems} from '../../public/js/form-submit.mjs';
 import {fileIn} from './safePath.js';
+import {getConfig} from '../config.js';
+
+/** What one submission's files may hold in memory together when server.json sets nothing: 50 MB. */
+export const DEFAULT_MAX_SUBMISSION_BYTES = 50 * 1024 * 1024;
+
+/**
+ * The most bytes one submission's files may hold in memory, all fields together:
+ * server.json `uploads.maxSubmissionBytes` (read fresh) when set; otherwise 50 MB or
+ * `uploads.maxFileSize`, whichever is larger, so one file the site takes is never
+ * refused for the total.
+ *
+ * @returns {number}
+ */
+export function maxSubmissionBytes() {
+    let uploads = {};
+    try { uploads = getConfig('server')?.uploads || {}; } catch { /* no server.json */ }
+    const set = Number(uploads.maxSubmissionBytes);
+    if (set > 0) return set;
+    return Math.max(DEFAULT_MAX_SUBMISSION_BYTES, Number(uploads.maxFileSize) || 0);
+}
+
+/**
+ * A form as a page draws it, told the per-submission file cap when it has a file field,
+ * so the page refuses a file that would pass it before anything is sent.
+ *
+ * @param {object} form
+ * @returns {object}
+ */
+export function publicFileLimits(form) {
+    const hasFiles = (form?.fields || []).some(f => f && f.type === 'file');
+    return hasFiles ? {...form, fileLimits: {maxTotalBytes: maxSubmissionBytes()}} : form;
+}
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -44,6 +76,11 @@ export async function readForm(slug) {
  */
 export async function writeForm(slug, data) {
     await ensureFormsDir();
+    // fileLimits is the server's config, added to the copy a page is given - never stored
+    if (data && 'fileLimits' in data) {
+        const {fileLimits: _limits, ...rest} = data;
+        data = rest;
+    }
     const file = fileIn(FORMS_DIR, slug, '.json');
     await fs.writeFile(file, JSON.stringify(data, null, 4) + '\n', 'utf8');
     await cache.invalidateTags([`form:${slug}`]);
@@ -198,7 +235,9 @@ function toFormFieldType(type) {
         string: 'string', text: 'string', email: 'email', tel: 'tel',
         number: 'number', textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -223,6 +262,7 @@ function buildFormFromCollection(schema) {
         };
         if (f.options) field.options = f.options;
         if (f.validation) field.validation = f.validation;
+        if (f.type === 'file' && f.multiple) field.multiple = true;
         return field;
     });
 
@@ -286,7 +326,9 @@ function toCollectionFieldType(type) {
         string: 'string', email: 'email', tel: 'tel', number: 'number',
         textarea: 'textarea', select: 'select', radio: 'radio',
         checkbox: 'checkbox', 'checkbox-group': 'checkbox-group',
-        date: 'date', time: 'time', url: 'url', hidden: 'hidden'
+        date: 'date', time: 'time', url: 'url', hidden: 'hidden',
+        // {url, name, size, mime} - a list of them when the field is `multiple`
+        file: 'file'
     };
     return map[type] || 'string';
 }
@@ -329,9 +371,12 @@ export async function ensureCollectionForForm(form) {
                 name: f.name,
                 type: toCollectionFieldType(f.type),
                 label: f.label || f.name,
-                required: !!f.required
+                // A file field's `required` is the form's to enforce (it sees the upload);
+                // copied here it would stop the entry editor saving an entry without one.
+                required: f.type === 'file' ? false : !!f.required
             };
             if (f.options) field.options = f.options;
+            if (f.type === 'file' && f.multiple) field.multiple = true;
             if (f.validation) field.validation = f.validation;
             return field;
         });

package/server/services/markdown.js

@@ -23,6 +23,7 @@ import {buildTextStyle} from '../../public/js/text-style.mjs';
 import {buildScribeStyle} from '../../public/js/scribe-style.mjs';
 import {CHARACTERS, resolveCharacterSize} from '../../public/js/celebrations/character-catalog.mjs';
 import {publicButtonSettings} from '../../public/js/form-submit.mjs';
+import {publicFileLimits} from './forms.js';
 import {applyShortcodeExpiry} from './shortcodeExpiry.js';
 
 const __dirname_md = path.dirname(fileURLToPath(import.meta.url));
@@ -631,13 +632,29 @@ function isFileRef(v) {
     return v && typeof v === 'object' && typeof v.url === 'string' && typeof v.name === 'string';
 }
 
+/** A `multiple` file field's value: a non-empty list of nothing but file references. */
+function isFileRefList(v) {
+    return Array.isArray(v) && v.length > 0 && v.every(isFileRef);
+}
+
+/** One file reference as HTML: a thumbnail link for an image, a download link otherwise. */
+function fileRefHtml(ref) {
+    const url  = escapeAttr(ref.url);
+    const name = escapeHtmlText(ref.name);
+    if (String(ref.mime || '').startsWith('image/')) {
+        return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
+    }
+    return `<a href="${url}" download>${name}</a>`;
+}
+
 /**
  * Resolve the display value for one field on one entry.
  *
  * For a `type: reference` field, returns the resolved label from `_refs`
  * (set by `references.resolveReferences()`); arrays join with ", ", missing
  * targets render as "<id> (missing)". For a `type: file` field (or any field
- * holding a stored file ref), returns the filename. Everything else returns
+ * holding a stored file ref), returns the filename - names joined with ", " for a
+ * `multiple` field's list. Everything else returns
  * the raw value with `null`/`undefined` collapsed to '' and arrays joined.
  *
  * @param {object} entry
@@ -654,6 +671,7 @@ function displayValue(entry, field) {
     }
     const raw = entry.data?.[field.name];
     if (isFileRef(raw)) return raw.name;
+    if (isFileRefList(raw)) return raw.map(f => f.name).join(', ');
     if (raw == null) return '';
     if (Array.isArray(raw)) return raw.join(', ');
     return String(raw);
@@ -679,14 +697,8 @@ function displayValueHtml(entry, field) {
         }
     }
     const raw = entry.data?.[field.name];
-    if (isFileRef(raw)) {
-        const url  = escapeAttr(raw.url);
-        const name = escapeHtmlText(raw.name);
-        if (String(raw.mime || '').startsWith('image/')) {
-            return `<a href="${url}" target="_blank" rel="noopener"><img src="${url}" alt="${name}" loading="lazy" class="dm-file-thumb"></a>`;
-        }
-        return `<a href="${url}" download>${name}</a>`;
-    }
+    if (isFileRef(raw)) return fileRefHtml(raw);
+    if (isFileRefList(raw)) return raw.map(fileRefHtml).join(' ');
     return escapeHtmlText(displayValue(entry, field));
 }
 
@@ -4450,7 +4462,7 @@ async function processFormBlocks(markdown, tagSet) {
       const {actions: _actions, ...publicForm} = form;
       // A Cancel link that is not safe to draw stays out of the page source.
       if (publicForm.settings) publicForm.settings = publicButtonSettings(publicForm.settings);
-      const encoded = Buffer.from(JSON.stringify(publicForm)).toString('base64');
+      const encoded = Buffer.from(JSON.stringify(publicFileLimits(publicForm))).toString('base64');
         const extraClass = attrs.class ? ` ${escapeAttr(attrs.class)}` : '';
         const idAttr = attrs.id ? ` id="${escapeAttr(attrs.id)}"` : '';
         replacement = `<div class="cms-form-embed${extraClass}" data-form-inline="${escapeAttr(encoded)}"${idAttr}>${formSummaryHtml(form)}</div>`;

package/server/templates/page.html

@@ -185,7 +185,7 @@
     <script src="/public/js/form-logic-engine.js?v=20261025-dropzone-disable" defer></script>
 
     <!-- Site initialisation -->
-    <script src="/public/js/site.js?v=20261025-dropzone-range" type="module"></script>
+    <script src="/public/js/site.js?v=20261025-files-total" type="module"></script>
     <script src="/public/js/collection-context.js?v=20261010-utf8-payloads" type="module"></script>
     {{ctxMenusModule}}
 
@@ -195,7 +195,7 @@
     <script src="/public/js/menu-float.js?v=20260927-float" type="module"></script>
 
     <!-- Core Forms renderer -->
-    <script src="/public/js/forms.js?v=20261025-form-dropzone" type="module"></script>
+    <script src="/public/js/forms.js?v=20261025-forms-files-total" type="module"></script>
 
     <!-- Core effects runtime -->
     <script src="/public/js/effects.js?v=20261015-occasions" defer></script>