domma-cms 1.8.14 → 1.8.16

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [1.8.16] - 2026-10-16
+
+- **Fixed: the mail server setting could be used to probe the server's own network.** An admin could set the outgoing mail server in Site Settings to any internal address and port, and "Send test email" showed the mail library's own error, which says what is listening there. On sites a Domma CMS Manager hosts (signed-only), the mail server must now be `localhost`, `127.0.0.1`, `::1` or a public mail server, on port 25, 465, 587 or 2525; a private or internal address is refused when the setting is saved and when mail is sent, and the connection goes to the address that was checked, so a second DNS answer cannot point it somewhere else. Mailboxes in the mail tools follow the same rules there (IMAP on 143 or 993), and are checked at every connection rather than only when saved. On every site, a failed test email now says "Could not send the test email. Check the mail server settings." and the full error goes to the server log only; the same goes for the failed-email notice and the mail tools' connection errors. Self-hosted sites can still send through an internal relay.
+
+- **Fixed: the Security Tool's health check could be pointed at another server.** It fetched the address the incoming request named. It now checks only the site's own address (Security 1.2.1).
+
+## [1.8.15] - 2026-10-16
+
+- **Fixed: a view or filter on a MongoDB collection could run JavaScript inside the database server.** A saved view, the view editor's live results, a `[view]` or `[collection]` on a page, a collection filter, an `/api/v1` query or an API Builder endpoint could carry `$where`, `$function`, `$accumulator` and the like - hidden at any depth - and MongoDB would run it. Every query is now checked in one place before MongoDB sees it, and refused with a plain message if it holds anything that runs code, writes (`$out`, `$merge`), reads beyond the site's own collections (`$unionWith`, `$graphLookup`, a `$lookup` into another database or something that is not one of the site's collections) or uses a name like `__proto__`. A view is checked when it is saved, too. Ordinary filters and views work as before; a `$lookup` that names a collection by its plain name (`people` rather than `cms_people`) now works on MongoDB as it already did on files. An entry id sent as anything but text (`{"$ne": ""}` in an Action's run request, say) no longer picks whichever MongoDB entry matched first.
+- **Fixed: webhooks could call addresses inside the server's own network.** An Action's webhook step and a form's webhook would send a request anywhere - `http://127.0.0.1:…`, a private LAN address, or the cloud metadata address. They now reach public addresses only: the name is looked up first and every address it gives must be public and not this server's own, the request goes to the address that was checked (so a second lookup cannot swap in an internal one), redirects into a private address are refused, and only ports 80 and 443 are used. A webhook's own headers (an API key, say) are not passed on when it redirects to another site, and it cannot set `Host`. A form's webhook that answers with an error is now reported like any other failed form action. Self-hosted sites that send webhooks to their own network can allow it in `config/server.json` with `outboundAllowPrivate` - `true`, or a list of host names, addresses and ranges. It has no effect on a site its host runs signed-only (every site Domma CMS Manager hosts).
+
 ## [1.8.14] - 2026-10-16
 
 - **Signed-only sites close every way of putting plugin code on the server.** With `requireSignedPlugins: true` in `config/server.json` (or `DOMMA_SIGNED_ONLY=1` in the environment, which Domma CMS Manager sets on the sites it hosts), unsigned plugin files are refused straight away with a plain message - no "install anyway?" question first - and New plugin and changes in a plugin's code editor are refused too: the Marketplace screen leaves New plugin off, and the code editor opens read only. Installing and updating from the Marketplace work as before. A licensed plugin's source stays closed on such a site, Super Admins included. MongoDB connection options that could start a program or read a file on the server (`autoEncryption`, `tls…File` and the like) are refused there as well. Self-hosted sites, where the setting is off, are unchanged.

package/CLAUDE.md

@@ -125,6 +125,23 @@ Collection entry I/O is delegated to a storage adapter. Schema management is alw
 - System preset collections (`presetCollections.js` - roles, user profiles, projects, notifications, api tokens/endpoints) are **always** file-based whatever their schema says, and cannot be moved (`isFixedToFile()`)
 - **Exception - the user-data presets** (`USER_DATA_PRESET_SLUGS`: `notes-notes`, `todo-items`, `contacts-contacts`, `contacts-groups`): `resolveUserDataPreset()` in `adapterRegistry.js` uses MongoDB only when the schema declares it (notes and todo do by default, contacts declare file), the named connection is connected, AND their `data.json` holds no rows; otherwise files. Rows in files (or in both stores) keep it on files and are logged with counts (`getStorageConflicts()`), because switching would show users an empty store - the Storage move (id-preserving) settles it. No connection configured = files, silently (MongoDB is Pro); configured but down = files + the storage-down notice. `seedAll()` keeps these presets' existing `storage` block, so a move survives a restart
 - Absence of `config/connections.json` = file mode (server.js wraps Mongo init in try/catch)
+- **User-shaped queries reach MongoDB only through `mongoQueryGuard.js`**: `toSafeMongoQuery()` (MongoAdapter.list - so every
+  filter source: `[collection]`, `/api/v1` params, API Builder) and `toSafeMongoPipeline()` (views' native aggregation;
+  `validateStages()` runs the same check on save). Refused at any depth, dotted keys a part at a time: code
+  (`$where`, `$function`, `$accumulator`, BSON Code), writes/other data (`$out`, `$merge`, `$unionWith`,
+  `$graphLookup`, server-state stages, a `$lookup` not into a site `cms_<slug>` collection) and `__proto__`/`constructor`/
+  `prototype`. A new path that hands user input to `find`/`aggregate` must go through one of the two
+- **Outbound requests to user-chosen URLs go through `services/outbound.js` `safeFetch()`** (Actions' webhook step,
+  form webhooks; plugins fetching a user's URL should too) - never bare `fetch`. Public addresses only after DNS, the
+  connection pinned to the checked address, never this server's own addresses, redirects re-checked, ports 80/443.
+  `server.json` `outboundAllowPrivate` (`true` or a list of hosts/addresses/CIDRs) lifts it for self-hosters and is
+  ignored when `codePolicy.signedOnly()`. `wpImport/fetch.js` shares its address rules and pinned request
+- **Mail hosts a user typed go through `services/mailHost.js` `resolveMailHost()`** (outbound.js's address rules). On a
+  signed-only site: `localhost`/`127.0.0.1`/`::1` or a public server, ports 25/465/587/2525 (IMAP 143/993), connected by
+  the checked address with the name as TLS `servername`; nothing the site sets lifts it. `email.js` `createTransport()`
+  does it per send there; self-hosted site SMTP is unchecked (internal relays are normal). The mail plugins' connections
+  (`_lib/mail` imapPool, send.js) re-check and pin through `hostGuard.js` `pinMailHost()`. Send errors reach the browser
+  as plain words only (`email.js` `mailFailure()` logs the raw text): the server's words say what listens on a port.
 
 ## Roles & Permissions
 
@@ -367,7 +384,7 @@ restarting) mid-run - keep that file's name and meaning.
 - **The XML reader is its own** (`xml.js`): any DOCTYPE or ENTITY is refused, only the predefined and numeric
   entities decode - do not swap in a parser that expands entities. Zips (`zip.js`) are read by offset with
   zip-slip names dropped and ratio/size caps; nothing is ever extracted under its own name.
-- **Media downloads go through `fetch.js` only**: the export's own hosts, every resolved address public, the
+- **Media downloads go through `fetch.js` only** (address rules and pinned request shared with `services/outbound.js`): the export's own hosts, every resolved address public, the
   connection pinned to the checked address, never the server's own interface addresses, ports 80/443 only, no
   redirect off-host; a non-image/PDF body that sniffs as HTML or script is refused (it would be served from /media).
   `WP_IMPORT_ALLOW_PRIVATE_HOSTS=1` (ignored when `NODE_ENV=production`) is the tests' and local browser checks' way

package/docs/configuration.md

@@ -31,6 +31,7 @@ Controls the HTTP server.
 | `logging.level` | string | Log verbosity: `fatal`, `error`, `warn`, `info`, `debug`, `trace`, `silent`. Defaults to `info` in development, `warn` otherwise. `warn` hides 4xx responses and plugin `log.info` output, so a failed admin action leaves no trace - raise it to `info` if you need to diagnose one. Overridden by the `LOG_LEVEL` env var. |
 | `restartOnPluginToggle` | boolean | `true` | Restart the server automatically when an admin enables or disables a plugin. See **Plugin toggles restart the server** below |
 | `requireSignedPlugins` | boolean | `false` | When `true`, the site runs only plugin code the Marketplace signed: an unsigned `.dcmsplugin` (e.g. one exported from another site) is refused even if the installer confirms it, New plugin is refused, a plugin's files cannot be changed in the code editor (it opens read only), licensed source cannot be read even by a Super Admin, and MongoDB connection options that start a program or read a file (`autoEncryption`, `tls…File`, …) cannot be saved. A bundle with a signature that does not verify is always refused, whatever this is set to. Read fresh on every check, and also as it was at boot, so changing the file on a running site can switch it on but not off. `DOMMA_SIGNED_ONLY=1` in the environment turns it on whatever the file says - Domma CMS Manager sets it on the sites it hosts. Nothing in the admin writes `server.json`. See `server/services/codePolicy.js` |
+| `outboundAllowPrivate` | boolean \| string[] | `false` | Webhooks (an Action's webhook step, a form's webhook) reach public addresses only: the name is looked up and every address must be public and not the server's own, the request is pinned to that address, redirects into private addresses are refused, and only ports 80 and 443 are used. A self-hosted site that sends webhooks inside its own network sets `true` to lift those rules for every request, or a list of host names, addresses and CIDR ranges (`["n8n.lan", "192.168.10.0/24", "fd00::/8"]`) to lift them for those only - a name passes if it is listed, or if every address it resolves to is. Ignored on a signed-only site (`requireSignedPlugins` / `DOMMA_SIGNED_ONLY=1`), so a hosted site's admin cannot open the host's network. Read fresh on every request. See `server/services/outbound.js` |
 
 ### Plugin toggles restart the server
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.14",
+  "version": "1.8.16",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/mail/hostGuard.js

@@ -11,14 +11,22 @@
  * the admin chose) or `allowPrivateMailHosts` is set for a site whose mail
  * server really is on its LAN.
  *
- * The pure half is `isPrivateAddress` / `isLocalName` in unsubscribe.js; this
- * module adds the lookup, which the tests inject.
+ * The address rules are core's (services/outbound.js `isBlockedAddress`, and
+ * services/mailHost.js on a signed-only site, where nothing above lifts them);
+ * `isLocalName` is unsubscribe.js's. Checking a name and then connecting by
+ * name lets a second DNS answer point the connection inward, so the
+ * connections themselves (imapPool.js, send.js) go through `pinMailHost()`:
+ * checked again, and connected to the address that was checked.
  *
  * @module _lib/mail/hostGuard
  */
 import dns from 'node:dns/promises';
 import net from 'node:net';
-import {isLocalName, isPrivateAddress} from './unsubscribe.js';
+import {getConfig} from '../../../server/config.js';
+import {isBlockedAddress} from '../../../server/services/outbound.js';
+import {MailHostRefused, normaliseMailHost, resolveMailHost} from '../../../server/services/mailHost.js';
+import {signedOnly} from '../../../server/services/codePolicy.js';
+import {isLocalName} from './unsubscribe.js';
 
 const REFUSED = 'That server is on this machine\'s own network, so the site will not connect to it. '
     + 'Use the mail server\'s public name, or ask the site administrator to allow private mail hosts.';
@@ -30,33 +38,58 @@ const REFUSED = 'That server is on this machine\'s own network, so the site will
  * @returns {string}
  */
 export function normaliseHost(host) {
-    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+    return normaliseMailHost(host);
+}
+
+/** Does `allowPrivate` / `ownSmtpHost` let this (self-hosted) site reach the name anywhere? */
+function exempt(name, {allowPrivate, ownSmtpHost}) {
+    return allowPrivate === true || (!!ownSmtpHost && normaliseHost(ownSmtpHost) === name);
 }
 
 /**
- * Check one host.
+ * Check one host (the save and "test these details" routes).
+ *
+ * On a signed-only (hosted) site the rules are core's services/mailHost.js and
+ * nothing the site's admin sets lifts them: loopback names or public servers,
+ * on the mail ports when `port` is given. `allowPrivate` and `ownSmtpHost`
+ * count on self-hosted sites only.
+ *
+ * Passing is not the end of it: every connection checks again and connects to
+ * the address it checked (`pinMailHost`), so a name that resolves differently
+ * later (DNS rebinding) is caught there.
  *
  * @param   {string} host
  * @param   {object} [options]
  * @param   {boolean} [options.allowPrivate]  - the site's `allowPrivateMailHosts` setting
  * @param   {string}  [options.ownSmtpHost]   - the site's configured outgoing server; always allowed
- * @param   {(host: string) => Promise<{address: string}[]>} [options.lookup] - DNS, injectable
+ * @param   {number}  [options.port]          - checked against the mail ports on a signed-only site
+ * @param   {'smtp'|'imap'} [options.kind]    - which mail ports
+ * @param   {boolean} [options.signed]        - codePolicy.signedOnly() when omitted
+ * @param   {Function} [options.lookup] - DNS, injectable
  * @returns {Promise<{ok: true} | {ok: false, error: string}>}
  */
-export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup} = {}) {
+export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup, port, kind = 'imap', signed} = {}) {
     const name = normaliseHost(host);
     if (!name) return {ok: false, error: 'A server is required.'};
-    if (allowPrivate) return {ok: true};
-    if (ownSmtpHost && normaliseHost(ownSmtpHost) === name) return {ok: true};
+    if (signed ?? signedOnly()) {
+        try {
+            await resolveMailHost(name, port, {kind, signed: true, anyPort: port === undefined, ...(lookup && {lookup})});
+            return {ok: true};
+        } catch (err) {
+            if (err.mailHostRefused) return {ok: false, error: err.message};
+            return {ok: true}; // unresolvable: the connection attempt says so
+        }
+    }
+    if (exempt(name, {allowPrivate, ownSmtpHost})) return {ok: true};
 
     if (net.isIP(name)) {
-        return isPrivateAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
+        return isBlockedAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
     }
     if (isLocalName(name)) return {ok: false, error: REFUSED};
 
     let answers;
     try {
-        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true})))(name);
+        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true, verbatim: true})))(name, {all: true, verbatim: true});
     } catch {
         // Unresolvable: let the connection attempt say so in its own words.
         // The check is about where a name points, not whether it exists.
@@ -65,10 +98,61 @@ export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '
     // Every answer must be public: a name with one private A record among
     // public ones is exactly the rebinding trick the check exists for.
     const addresses = (answers ?? []).map(a => (typeof a === 'string' ? a : a?.address)).filter(Boolean);
-    if (addresses.some(isPrivateAddress)) return {ok: false, error: REFUSED};
+    if (addresses.some(isBlockedAddress)) return {ok: false, error: REFUSED};
     return {ok: true};
 }
 
+/**
+ * Is `allowPrivateMailHosts` on for a mail plugin on this site? Read from
+ * config/plugins.json for the connections made without a plugin's config in
+ * hand (email-pro's SMTP test). Never consulted on a signed-only site.
+ *
+ * @returns {boolean}
+ */
+export function pluginsAllowPrivate() {
+    try {
+        const plugins = getConfig('plugins') || {};
+        return ['mail-reader', 'email-pro'].some(n => plugins[n]?.settings?.allowPrivateMailHosts === true);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Check a host at the moment of connecting, and say which address to connect
+ * to - the address that was checked, so a second DNS answer cannot swap an
+ * internal one in (DNS rebinding). The name is returned as `servername` for
+ * TLS (SNI and the certificate check).
+ *
+ * @param   {string} host
+ * @param   {number} port
+ * @param   {object} [options]
+ * @param   {'smtp'|'imap'} [options.kind='imap']
+ * @param   {boolean} [options.allowPrivate] - pluginsAllowPrivate() when omitted
+ * @param   {string}  [options.ownSmtpHost]  - siteSmtpHost(getConfig) when omitted
+ * @param   {boolean} [options.signed]
+ * @param   {Function} [options.lookup]
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws  {Error} MailHostRefused (`mailHostRefused`), or code ENOTFOUND
+ */
+export async function pinMailHost(host, port, {kind = 'imap', allowPrivate, ownSmtpHost, signed, lookup} = {}) {
+    const name = normaliseHost(host);
+    const isSigned = signed ?? signedOnly();
+    const opts = {kind, signed: isSigned, ...(lookup && {lookup})};
+    if (isSigned) return resolveMailHost(name, port, opts);
+    const free = exempt(name, {
+        allowPrivate: allowPrivate ?? pluginsAllowPrivate(),
+        ownSmtpHost: ownSmtpHost ?? siteSmtpHost(getConfig)
+    });
+    if (!free && !net.isIP(name) && isLocalName(name)) throw new MailHostRefused(REFUSED);
+    try {
+        return await resolveMailHost(name, port, {...opts, checkAddresses: !free});
+    } catch (err) {
+        if (err.mailHostRefused) throw new MailHostRefused(REFUSED);
+        throw err;
+    }
+}
+
 /**
  * The site's own outgoing server, from config/site.json `smtp.host` (what
  * core `createTransport` sends with), read through a getter so a test can

package/plugins/_lib/mail/imapPool.js

@@ -27,6 +27,7 @@
  * @module mail-reader/services/imapPool
  */
 import {ImapFlow} from 'imapflow';
+import {pinMailHost} from './hostGuard.js';
 
 /**
  * Identify a connection's target. A change to any of these means the cached
@@ -98,8 +99,16 @@ export function createPool(config) {
             auth = {user: auth.user, accessToken: r.accessToken};
         }
 
+        // Checked here, at every connect, and connected to the checked address
+        // (the name kept for TLS) - see hostGuard.js pinMailHost.
+        const pinned = await pinMailHost(connection.host, connection.port, {kind: 'imap', allowPrivate: config.allowPrivateMailHosts === true});
+
         const attempt = async (withAuth) => {
-            const client = new ImapFlow(clientOptions({...connection, auth: withAuth}));
+            const client = new ImapFlow({
+                ...clientOptions({...connection, auth: withAuth}),
+                host: pinned.address,
+                ...(pinned.servername && {servername: pinned.servername})
+            });
             prepare(client);
             try {
                 await client.connect();
@@ -300,7 +309,10 @@ export function createPool(config) {
     // Never hold the process open on account of an idle mail connection.
     reaper.unref?.();
 
-    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient, get size() {
+    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient,
+        // What send.js passes to hostGuard.js pinMailHost for this plugin's outgoing servers.
+        mailHostOptions: {allowPrivate: config.allowPrivateMailHosts === true},
+        get size() {
         return pool.size;
     }};
 }
@@ -321,7 +333,7 @@ export function createPool(config) {
  */
 export function describeError(err, connection = {}) {
     if (!err) return 'Unknown error.';
-    if (err.needsReconnect) return err.message;
+    if (err.needsReconnect || err.mailHostRefused) return err.message;
     // A signed-in (OAuth2) mailbox has no password to blame.
     if ((err.authenticationFailed || err.code === 'EAUTH' || err.code === 'EOAUTH2') && (connection.auth?.accessToken !== undefined || connection.auth?.type === 'OAuth2')) {
         return 'The mail server refused the sign-in. If it keeps happening, Reconnect the mailbox.';
@@ -366,6 +378,16 @@ export function describeError(err, connection = {}) {
         case 'ECONNRESET':
             return 'The mail server did not respond in time.';
         default:
-            return err.message || 'The mail server connection failed.';
+            // Words that are ours, or a mail server's answer to a command after
+            // it greeted and (for IMAP) signed us in - those say nothing about
+            // what else listens on a host and port.
+            if (err.name === 'MailKeyError' || err.responseStatus === 'NO' || err.responseStatus === 'BAD'
+                || err.code === 'EENVELOPE' || err.code === 'EMESSAGE') {
+                return err.message || 'The mail server connection failed.';
+            }
+            // Anything else stays out of the browser: a greeting, a banner or a
+            // socket error is exactly what a port scan reads. The log has it.
+            console.warn(`[mail] connection to ${connection.host || 'the mail server'}:${connection.port || '?'} failed${err.code ? ` (${err.code})` : ''}: ${err.message || err}`);
+            return 'The mail server connection failed. Check the server settings.';
     }
 }

package/plugins/_lib/mail/poller.js

@@ -13,6 +13,7 @@
  * @module _lib/mail/poller
  */
 import {selectDuePolls} from './pollSchedule.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. Finer than any poll interval. */
 const TICK_MS = 30_000;
@@ -49,7 +50,7 @@ export function createPoller({listAccounts, syncAccount, defaultMinutes, logger,
         } catch (err) {
             const failures = (entry.failures ?? 0) + 1;
             state.set(account.id, {
-                lastAttemptAt: Date.now(), failures, running: false, lastError: err.message
+                lastAttemptAt: Date.now(), failures, running: false, lastError: describeError(err)
             });
             // Warn, not error: a mail server being unreachable is an ordinary
             // condition, and the backoff already handles it.

package/plugins/_lib/mail/readRoutes.js

@@ -240,7 +240,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     }
 
     /** Where this server may be asked to connect - see hostGuard.js. */
-    const guardHost = (host) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig)});
+    const guardHost = (host, port) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig), port, kind: 'imap'});
     // Each test is a connection attempt whose answer says what is listening: a few a minute per address is plenty.
     const testLimit = {config: {rateLimit: {max: 10, timeWindow: '1 minute'}}};
 
@@ -258,7 +258,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, null);
         if (!result.ok) return reply.code(400).send({error: result.error});
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, null, result.value);
@@ -277,7 +277,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
         // A signed-in mailbox's servers are the provider's and cannot be edited here.
-        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host);
+        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
@@ -343,7 +343,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 throw err;
             }
         }
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         let pass = result.value.password;

package/plugins/_lib/mail/scheduler.js

@@ -24,6 +24,7 @@
  */
 import * as accounts from './accounts.js';
 import {sendMessage} from './send.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. */
 const TICK_MS = 5_000;
@@ -118,11 +119,13 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             // the sender is told (the send-failed notice) instead of waiting.
             const giveUp = err?.needsReconnect || (item.attempts ?? 1) >= MAX_ATTEMPTS;
             await store.finishSend(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : err.message}
+                // describeError: a queue item is read in the browser, and the mail
+                // server's own words are for the log (they say what listens on a port).
+                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : describeError(err)}
                 // Back to pending, a little later. `finishedAt` is set either
                 // way, which is harmless on a retry and is what tells a
                 // screen when the last attempt was.
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message});
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err)});
 
             logger.warn(
                 `[mail] queued send ${item._id} failed (attempt ${item.attempts}): ${err.message}`
@@ -186,8 +189,8 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             const attempts = (item.attempts ?? 0) + 1;
             const giveUp = err?.needsReconnect || attempts >= MAX_ATTEMPTS;
             await store.finishSnooze(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : err.message, attempts}
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message, attempts});
+                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : describeError(err), attempts}
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err), attempts});
             logger.warn(
                 `[mail] could not wake snoozed message ${item._id} (attempt ${attempts}): ${err.message}`
             );

package/plugins/_lib/mail/send.js

@@ -14,6 +14,7 @@ import nodemailer from 'nodemailer';
 
 import {bareAddress, formatFrom} from '../admin/mail/identity.js';
 import {describeError} from './imapPool.js';
+import {pinMailHost} from './hostGuard.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
 import {normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
 
@@ -213,22 +214,31 @@ export async function sendMessage({
     // running its own mail server with a self-signed certificate has the same
     // problem in both directions, and two switches for one decision is how
     // one of them ends up wrong.
-    const transport = nodemailer.createTransport({
-        ...smtp.transport,
-        tls: {rejectUnauthorized: !allowInsecureTLS}
-    });
-    const info = await transport.sendMail({
-        envelope: {
-            // Bare, always. A display name here is not decoration the server
-            // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
-            // is a free-text field somebody may well have typed a name into.
-            from: bareAddress(smtp.from),
-            to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
-                .map(a => a.address)
-        },
-        raw
-    });
-    transport.close();
+    // The mail server's own words never leave as the error (they say what
+    // listens on a port): describeError's plain text, the detail in the log.
+    let transport;
+    let info;
+    try {
+        transport = nodemailer.createTransport({
+            ...await pinnedTransport(smtp.transport, pool?.mailHostOptions),
+            tls: {rejectUnauthorized: !allowInsecureTLS}
+        });
+        info = await transport.sendMail({
+            envelope: {
+                // Bare, always. A display name here is not decoration the server
+                // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
+                // is a free-text field somebody may well have typed a name into.
+                from: bareAddress(smtp.from),
+                to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
+                    .map(a => a.address)
+            },
+            raw
+        });
+    } catch (err) {
+        throw plainSendError(err, smtp.transport);
+    } finally {
+        transport?.close();
+    }
 
     const messageAction = await recordMessageAction({
         source: draft.sourceMessage, account, pool, poolKey, connection, store
@@ -383,15 +393,54 @@ async function findSentFolder(pool, poolKey, connection) {
     return findSpecialFolder(pool, poolKey, connection, '\\Sent');
 }
 
+/**
+ * A send failure as plain words. Our own errors (a refused host, a mailbox that
+ * needs signing in again) pass as they are; anything from the server or the
+ * library becomes describeError()'s text, keeping `code` so a caller can still
+ * tell an authentication failure from the rest.
+ *
+ * @param   {Error} err
+ * @param   {object} transportConfig
+ * @returns {Error}
+ */
+export function plainSendError(err, transportConfig = {}) {
+    if (!err || err.needsReconnect || err.mailHostRefused || err.name === 'MailKeyError') return err;
+    const plain = new Error(describeError(err, transportConfig));
+    if (err.code) plain.code = err.code;
+    if (err.responseCode) plain.responseCode = err.responseCode;
+    return plain;
+}
+
+/**
+ * A mailbox's transport settings with the host checked and pinned: connect to
+ * the address hostGuard.js checked, keep the name for TLS. Throws when the
+ * host or port is refused, or the name does not resolve.
+ *
+ * @param   {object} transportConfig - {host, port, ...}
+ * @param   {{allowPrivate?: boolean}} [guard] - the plugin's allowPrivateMailHosts, when the caller has it
+ * @returns {Promise<object>}
+ */
+export async function pinnedTransport(transportConfig, guard = {}) {
+    const port = Number(transportConfig.port) || (transportConfig.secure ? 465 : 587);
+    const {address, servername} = await pinMailHost(transportConfig.host, port, {kind: 'smtp', ...(guard || {})});
+    return {...transportConfig, port, host: address, ...(servername && {servername})};
+}
+
 /**
  * Try the outgoing server without sending anything.
  *
  * @param   {object} transportConfig
  * @returns {Promise<{ok: boolean, error?: string}>}
  */
-export async function verifySmtp(transportConfig, allowInsecureTLS = false) {
+export async function verifySmtp(transportConfig, allowInsecureTLS = false, guard = undefined) {
+    let pinned;
+    try {
+        pinned = await pinnedTransport(transportConfig, guard);
+    } catch (err) {
+        return {ok: false, error: describeError(err, transportConfig)};
+    }
     const transport = nodemailer.createTransport({
-        ...transportConfig,
+        ...pinned,
         connectionTimeout: 10_000,
         tls: {rejectUnauthorized: !allowInsecureTLS}
     });

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@ddb1e0c",
+  "source": "dcms-marketplace@af8baa8",
   "plugins": {
     "blog": {
       "version": "1.10.1",
@@ -165,9 +165,9 @@
       }
     },
     "security": {
-      "version": "1.2.0",
+      "version": "1.2.1",
       "files": {
-        "CLAUDE.md": "c4a8cedeff2af492871d2b9af446c6b73792881f4e428e189516105508bc07e5",
+        "CLAUDE.md": "1aabef04e77d9bd10ead195851a75c358b5c6657a57ad217495cf7b5b0d63538",
         "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
         "admin/lib/health.js": "3b233a3d29b2d69c333321602c13233b8221cfe1114aa03903739d9ae8ad65d5",
         "admin/lib/ip.js": "cf33be4fa2e2cad37bafd12ebec17f293891a88de402caad1bf9c9a57ce87680",
@@ -183,11 +183,12 @@
         "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
         "docs/guide.md": "a27d5303f9146057fd79c2093d7476ada1a5ee4fd14d34df7f94ad8555d88ca0",
         "plugin.js": "9d3a2e8b56dd637407c8abd93252dda9f67042231bc79d35771f766a62022c14",
-        "plugin.json": "5cf525d76b1f043a475268f8d37622bdb53120e0c34a1068930d7fcff88ea686",
+        "plugin.json": "c7ebf55a71048e914ca8e6d2f042fb099123367e1e6fd694cfbf9eb2e4146852",
         "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
         "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
-        "server/facts.js": "25538a8d1cfe012688fceb8ec0d0dd7b43ac9e168430723d6fb731183701fb46",
+        "server/facts.js": "8dbf6802acd9103fe4ca8d5e7d2dfc97c169df6d47bea72b33411cd22fee597b",
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
+        "tests/facts.test.js": "dc59d307033c7a9887b4d522bccd9e9d4986b6ed5cb4ffe1287282a93f54cb11",
         "tests/screen-state.test.js": "5349273cf7cfe526a05f929115a6e4e66287e6fb05b252ea859e182e88e3925e",
         "tests/security.test.js": "f0cb70dcb28bc8b3de8d3b39064616296382c5b0f97bfd615ee8e24fe3b031bc"
       }

package/plugins/security/CLAUDE.md

@@ -24,7 +24,10 @@ Ships with the engine (free tier, `make sync-free-tier`); switched ON when it fi
   `kind: 'reset'` lines - their `ok` is not a sign-in. Older engines never emit the event: nothing changes there.
 - **Health check**: `server/facts.js` gathers (users, engine vs npm latest, certificate via tls, security headers of the
   public home page, private paths fetched LOCALLY, TRUST_PROXY, bind, SMTP, licences); `admin/lib/health.js` judges.
-  Unknown = 'info', never a pass. Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
+  Unknown = 'info', never a pass. The public checks (headers, HTTPS, certificate) connect ONLY to `publicTarget()`:
+  site.json `baseUrl`/`url` when it is a public name (every DNS answer public), else the admin's own Host but only
+  when it resolves to one of this server's public interface addresses - never a host a visitor names (1.2.1). The
+  connection is pinned to the checked address (no second DNS lookup). Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
   when a failing check is critical.
 - Engines before 0.83 have no sign-in checks: the plugin logs it, the screen says so, lockout/rules are off.
 - plugin.json `minCmsVersion: "0.83.0"` (1.1.1) states that floor; core enforces it at install/update from the release after 0.92.1,
@@ -63,3 +66,8 @@ what strangers typed). Public data (emails, addresses, user-agents) only through
   `security.rule-draft.<user>`. Pure parts in `admin/lib/screen-state.js` (Pro's copy adds Audit and 2FA).
 - Every list: click/Enter/Shift+F10/right-click/⋮ open the row menu (a check row opens its details on click). Filter
   counts follow the search; skeletons; help popovers started after mount. Keep this screen alike with Security Pro's.
+
+## 1.2.1 (2026-10-16)
+
+- Health check: the headers/certificate fetch no longer goes to whatever Host / X-Forwarded-Host a request carried
+  (a forged one made the server connect anywhere). `publicTarget()` in server/facts.js; `tests/facts.test.js`.

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-10-15",
+  "date": "2026-10-16",
   "minCmsVersion": "0.83.0",
   "icon": "shield",
   "permissions": [