domma-cms 1.6.46 → 1.6.48

package/server/services/markdown.js

@@ -1178,9 +1178,11 @@ async function processCollectionBlocks(markdown, tagSet) {
  */
 export async function renderScopedCollection(attrs, userId) {
     const opts = {extraFilter: {createdBy: userId}, scope: 'mine'};
-    return isInteractiveCollection(attrs)
-        ? renderCollectionBrowserShell(attrs, opts)
-        : renderCollectionFragment(attrs, opts);
+    // Drawn into the page with innerHTML by site.js, after the page itself was
+    // sanitised - so it is cleaned here, the same way.
+    return sanitizePageHtml(isInteractiveCollection(attrs)
+        ? await renderCollectionBrowserShell(attrs, opts)
+        : await renderCollectionFragment(attrs, opts));
 }
 
 /**
@@ -4528,6 +4530,87 @@ function processCtaBlocks(markdown) {
   return restore(processed);
 }
 
+/**
+ * Clean rendered page HTML - the one sanitiser every page fragment goes through,
+ * whether it is part of a full page (parseMarkdown) or drawn later in the
+ * browser (the scope="mine" fragment from renderScopedCollection), so a block
+ * or a {{{raw}}} field cannot carry a handler onto the page by the second road.
+ *
+ * @param {string} html
+ * @returns {string}
+ */
+export function sanitizePageHtml(html) {
+  const extensions = getSanitizeExtensions();
+  return sanitizeHtml(html, {
+    // `style` is intentionally allowed below so per-block custom CSS can
+    // reach the page. Admins write block templates; same trust model as
+    // content/custom.css. This flag silences sanitize-html's warning.
+    allowVulnerableTags: true,
+    // [embed] emits <iframe>/<video>; hostnames are gated by
+    // allowedIframeHostnames below (defence in depth over the render-time
+    // host allow-list).
+    allowedIframeHostnames: [
+      'www.youtube-nocookie.com', 'www.youtube.com', 'youtube.com',
+      'player.vimeo.com',
+      ...getEmbedAllowedHosts(),
+    ],
+    // sanitize-html drops a RELATIVE iframe src whenever allowedIframeHostnames
+    // is set, because it cannot match a hostname it has not been given. That
+    // silently emptied every [demo] iframe. A relative src is same-origin by
+    // definition, so the hostname gate has nothing to say about it: the gate
+    // exists to stop embedding somebody else's site, not your own page.
+    allowIframeRelativeUrls: true,
+    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
+      'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+      'form', 'input', 'textarea', 'select', 'option', 'optgroup',
+      'button', 'label', 'fieldset', 'legend',
+      // [embed] shortcode output
+      'iframe', 'video', 'source', 'figure', 'figcaption',
+      // <style> tags are emitted by block rendering (buildBlockStyleTag) so
+      // per-block custom CSS can reach the page. Admin-trust: block authors
+      // are admins, same security model as site-wide content/custom.css.
+      'style',
+      // dm-<name> custom-element tags - one per registered component. Refreshed
+      // by refreshComponentTagAllowlist() on startup and after create/delete.
+      // Component authors are super-admins, same trust model as plugin code.
+      ..._dmTagAllowlist,
+      ...extensions.tags
+    ]),
+    allowedAttributes: {
+      ...sanitizeHtml.defaults.allowedAttributes,
+      // aria-hidden marks decorative markup (menu spacers, the floating panel's
+      // drag grip) so it isn't announced as an empty item. aria-current marks
+      // the [menu] item for the page you are on. Both presentational only, no
+      // script surface - unlike the on* handlers stripped globally.
+      '*': ['class', 'id', 'style', 'data-*', 'aria-hidden', 'aria-current'],
+      img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
+      form: ['action', 'method'],
+      input: ['type', 'name', 'placeholder', 'value', 'required', 'disabled',
+        'readonly', 'min', 'max', 'step', 'pattern', 'maxlength',
+        'minlength', 'checked', 'autocomplete'],
+      textarea: ['name', 'placeholder', 'rows', 'cols', 'required',
+        'disabled', 'readonly', 'maxlength'],
+      select: ['name', 'required', 'disabled', 'multiple'],
+      option: ['value', 'selected', 'disabled'],
+      optgroup: ['label', 'disabled'],
+        button: ['type', 'disabled', 'aria-label', 'data-action', 'data-entry', 'data-confirm'],
+      label: ['for'],
+      fieldset: ['disabled'],
+      iframe: ['src', 'title', 'width', 'height', 'allow', 'allowfullscreen',
+        'loading', 'referrerpolicy', 'frameborder', 'style'],
+      video: ['controls', 'autoplay', 'muted', 'loop', 'playsinline',
+        'preload', 'poster', 'width', 'height', 'style'],
+      source: ['src', 'type'],
+      // Allow any attribute on every registered dm-* tag. Props are
+      // author-defined and enumerating them at sanitise time has no security
+      // benefit - custom-element attributes cannot execute JS on their own,
+      // and `on*` handlers + `javascript:` URLs are still stripped globally.
+      ..._dmTagAllowlist.reduce((acc, tag) => { acc[tag] = ['*']; return acc; }, {}),
+      ...extensions.attributes
+    }
+  });
+}
+
 /**
  * Parse a Markdown file string into frontmatter data and rendered HTML.
  *
@@ -4548,7 +4631,6 @@ function processCtaBlocks(markdown) {
  */
 export async function parseMarkdown(raw, opts = {}) {
   const {data, content} = matter(raw);
-  const extensions = getSanitizeExtensions();
 
   // Pipeline (earlier stages are already HTML when later ones run; keep in step
   // with "Shortcode Nesting Rules" in CLAUDE.md and docs/markdown-shortcodes.md):
@@ -4607,74 +4689,7 @@ export async function parseMarkdown(raw, opts = {}) {
   const withSlideover = processSlideoverBlocks(withBanner);
   const rendered = marked.parse(withSlideover);
 
-  const sanitized = sanitizeHtml(rendered, {
-    // `style` is intentionally allowed below so per-block custom CSS can
-    // reach the page. Admins write block templates; same trust model as
-    // content/custom.css. This flag silences sanitize-html's warning.
-    allowVulnerableTags: true,
-    // [embed] emits <iframe>/<video>; hostnames are gated by
-    // allowedIframeHostnames below (defence in depth over the render-time
-    // host allow-list).
-    allowedIframeHostnames: [
-      'www.youtube-nocookie.com', 'www.youtube.com', 'youtube.com',
-      'player.vimeo.com',
-      ...getEmbedAllowedHosts(),
-    ],
-    // sanitize-html drops a RELATIVE iframe src whenever allowedIframeHostnames
-    // is set, because it cannot match a hostname it has not been given. That
-    // silently emptied every [demo] iframe. A relative src is same-origin by
-    // definition, so the hostname gate has nothing to say about it: the gate
-    // exists to stop embedding somebody else's site, not your own page.
-    allowIframeRelativeUrls: true,
-    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
-      'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-      'form', 'input', 'textarea', 'select', 'option', 'optgroup',
-      'button', 'label', 'fieldset', 'legend',
-      // [embed] shortcode output
-      'iframe', 'video', 'source', 'figure', 'figcaption',
-      // <style> tags are emitted by block rendering (buildBlockStyleTag) so
-      // per-block custom CSS can reach the page. Admin-trust: block authors
-      // are admins, same security model as site-wide content/custom.css.
-      'style',
-      // dm-<name> custom-element tags - one per registered component. Refreshed
-      // by refreshComponentTagAllowlist() on startup and after create/delete.
-      // Component authors are super-admins, same trust model as plugin code.
-      ..._dmTagAllowlist,
-      ...extensions.tags
-    ]),
-    allowedAttributes: {
-      ...sanitizeHtml.defaults.allowedAttributes,
-      // aria-hidden marks decorative markup (menu spacers, the floating panel's
-      // drag grip) so it isn't announced as an empty item. aria-current marks
-      // the [menu] item for the page you are on. Both presentational only, no
-      // script surface - unlike the on* handlers stripped globally.
-      '*': ['class', 'id', 'style', 'data-*', 'aria-hidden', 'aria-current'],
-      img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
-      form: ['action', 'method'],
-      input: ['type', 'name', 'placeholder', 'value', 'required', 'disabled',
-        'readonly', 'min', 'max', 'step', 'pattern', 'maxlength',
-        'minlength', 'checked', 'autocomplete'],
-      textarea: ['name', 'placeholder', 'rows', 'cols', 'required',
-        'disabled', 'readonly', 'maxlength'],
-      select: ['name', 'required', 'disabled', 'multiple'],
-      option: ['value', 'selected', 'disabled'],
-      optgroup: ['label', 'disabled'],
-        button: ['type', 'disabled', 'aria-label', 'data-action', 'data-entry', 'data-confirm'],
-      label: ['for'],
-      fieldset: ['disabled'],
-      iframe: ['src', 'title', 'width', 'height', 'allow', 'allowfullscreen',
-        'loading', 'referrerpolicy', 'frameborder', 'style'],
-      video: ['controls', 'autoplay', 'muted', 'loop', 'playsinline',
-        'preload', 'poster', 'width', 'height', 'style'],
-      source: ['src', 'type'],
-      // Allow any attribute on every registered dm-* tag. Props are
-      // author-defined and enumerating them at sanitise time has no security
-      // benefit - custom-element attributes cannot execute JS on their own,
-      // and `on*` handlers + `javascript:` URLs are still stripped globally.
-      ..._dmTagAllowlist.reduce((acc, tag) => { acc[tag] = ['*']; return acc; }, {}),
-      ...extensions.attributes
-    }
-  });
+  const sanitized = sanitizePageHtml(rendered);
 
   const html = applyTransforms('markdown:afterParse', sanitized);
 

package/server/services/sidebar-migration.js

@@ -111,7 +111,7 @@ function DOC_TUTORIALS_SUBMENU() {
         text: 'Tutorials', icon: 'document',
         items: [
             {text: 'Building a CRUD App', url: '#/tutorials/crud',   icon: 'database'},
-            {text: 'Writing a Plugin',    url: '#/tutorials/plugin', icon: 'package'},
+            {text: 'Writing a Tool',      url: '#/tutorials/plugin', icon: 'package'},
             {text: 'Form Follow-Up',      url: '#/tutorials/forms',  icon: 'layout'}
         ]
     };
@@ -385,6 +385,18 @@ export async function ensureFolderKeys(opts = {}) {
         changed = true;
     }
 
+    // Plugins are Tools, so the tutorial became "Writing a Tool" in 1.6.48. Renamed once
+    // (`meta.writingToolName`) and only where the item still says Writing a Plugin.
+    if (!menu.meta?.writingToolName && items.length) {
+        const rename = (list) => (list || []).forEach(n => {
+            if (n && n.url === '#/tutorials/plugin' && String(n.text || '').trim() === 'Writing a Plugin') n.text = 'Writing a Tool';
+            if (Array.isArray(n?.items)) rename(n.items);
+        });
+        rename(items);
+        menu.meta = {...(menu.meta || {}), writingToolName: true};
+        changed = true;
+    }
+
     // An empty menu is left empty: the renderer's minimal fallback (Dashboard,
     // Menus) is what an admin needs to repair it, and a lone Tools folder would
     // stop that fallback from applying.