domma-cms 1.8.14 → 1.8.16

package/plugins/security/server/facts.js

@@ -5,7 +5,12 @@
  *
  * Slow answers (the latest engine version, the certificate) are cached.
  */
+import dns from 'node:dns';
 import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
 import path from 'node:path';
 import tls from 'node:tls';
 import {getConfig} from '../../../server/config.js';
@@ -21,6 +26,7 @@ async function cached(key, ms, fn) {
     const hit = cache.get(key);
     if (hit && hit.until > Date.now()) return hit.value;
     const value = await fn();
+    if (cache.size > 200) for (const [k, v] of cache) if (v.until <= Date.now()) cache.delete(k);
     cache.set(key, {value, until: Date.now() + ms});
     return value;
 }
@@ -41,11 +47,11 @@ async function engine() {
     return {installed, latest};
 }
 
-/** Days left on the certificate the site serves (cached 6 h). */
-function certificate(host) {
-    return cached(`cert:${host}`, 6 * 3_600_000, () => new Promise((resolve) => {
+/** Days left on the certificate the site serves (cached 6 h). Connects only to the checked address. */
+export function certificate({host, address, port = 443}) {
+    return cached(`cert:${host}:${address}`, 6 * 3_600_000, () => new Promise((resolve) => {
         const done = (v) => { try { socket.destroy(); } catch { /* gone */ } resolve(v); };
-        const socket = tls.connect({host, port: 443, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
+        const socket = tls.connect({host: address, port, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
             const c = socket.getPeerCertificate();
             if (!c?.valid_to) return done({daysLeft: null, error: 'no certificate'});
             done({daysLeft: Math.floor((Date.parse(c.valid_to) - Date.now()) / 86_400_000), issuer: c.issuer?.O || c.issuer?.CN || ''});
@@ -55,23 +61,34 @@ function certificate(host) {
     }));
 }
 
-/** The security headers the public home page is served with. */
-async function headers(origin) {
-    try {
-        const res = await fetch(`${origin}/`, {redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT), headers: {'user-agent': 'Domma Security health check'}});
-        const h = (n) => res.headers.get(n) || '';
-        const csp = h('content-security-policy');
-        return {
-            https: origin.startsWith('https:'),
-            csp: Boolean(csp),
-            nosniff: /nosniff/i.test(h('x-content-type-options')),
-            frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
-            referrer: Boolean(h('referrer-policy')),
-            hsts: Boolean(h('strict-transport-security'))
-        };
-    } catch (e) {
-        return {error: e.name === 'TimeoutError' ? 'timed out' : (e.cause?.code || e.message)};
-    }
+/** The security headers the public home page is served with. Connects only to the checked address. */
+export function headers({host, proto, address, port}) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => { if (!settled) { settled = true; resolve(v); } };
+        const secure = proto === 'https';
+        const req = (secure ? https : http).request({
+            host: address, port: port || (secure ? 443 : 80), path: '/', method: 'GET', agent: false,
+            ...(secure ? {servername: host} : {}),
+            headers: {host, 'user-agent': 'Domma Security health check'}
+        }, (res) => {
+            const h = (n) => String(res.headers[n] || '');
+            const csp = h('content-security-policy');
+            res.resume();
+            finish({
+                https: secure,
+                csp: Boolean(csp),
+                nosniff: /nosniff/i.test(h('x-content-type-options')),
+                frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
+                referrer: Boolean(h('referrer-policy')),
+                hsts: Boolean(h('strict-transport-security'))
+            });
+        });
+        const timer = setTimeout(() => { finish({error: 'timed out'}); req.destroy(); }, TIMEOUT);
+        req.on('error', (e) => finish({error: e.code || e.message}));
+        req.on('close', () => clearTimeout(timer));
+        req.end();
+    });
 }
 
 /** Private paths asked of the CMS itself (locally, so Security's own probe filter does not hide them). */
@@ -91,18 +108,76 @@ async function probeFiles(port) {
 
 const isLocalHost = (h) => !h || h === 'localhost' || /^[\d.]+$/.test(h) || h.includes(':') || h.endsWith('.local') || h.endsWith('.test');
 
+/** Not a public address: loopback, private, link-local, CGNAT, unique-local, unspecified, multicast. */
+export function isPrivateAddress(ip) {
+    const a = String(ip || '').toLowerCase().replace(/^::ffff:(?=\d+\.)/, '');
+    if (net.isIPv4(a)) {
+        const [o1, o2] = a.split('.').map(Number);
+        return o1 === 0 || o1 === 10 || o1 === 127 || o1 >= 224 || (o1 === 169 && o2 === 254) || (o1 === 172 && o2 >= 16 && o2 <= 31)
+            || (o1 === 192 && o2 === 168) || (o1 === 100 && o2 >= 64 && o2 <= 127) || (o1 === 192 && o2 === 0) || (o1 === 198 && (o2 === 18 || o2 === 19));
+    }
+    // IPv6: loopback, unspecified, IPv4-compatible/mapped (anything under ::/16), NAT64 (64:ff9b::), 6to4 (2002::),
+    // unique-local, link-local, site-local, multicast - an embedded IPv4 is never trusted to be public.
+    if (net.isIPv6(a)) return a.startsWith('::') || /^64:ff9b:/.test(a) || /^2002:/.test(a) || /^(fc|fd|fe[89a-f]|ff)/.test(a);
+    return true;
+}
+
+/** This machine's own public addresses (its network interfaces, not loopback or private ones). */
+export function ownPublicAddresses() {
+    return new Set(Object.values(os.networkInterfaces()).flat().filter(i => i && !i.internal)
+        .map(i => String(i.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '').split('%')[0]).filter(a => !isPrivateAddress(a)));
+}
+
+const urlHost = (raw) => {
+    try {
+        const u = new URL(String(raw || ''));
+        return /^https?:$/.test(u.protocol) ? {host: u.hostname.toLowerCase(), proto: u.protocol.slice(0, -1)} : null;
+    } catch { return null; }
+};
+
+/**
+ * Where the public checks (headers, HTTPS, certificate) may connect - never a host named by a
+ * visitor. The site's configured address (site.json `baseUrl`, else `url`) when it has a public
+ * name (a configured name that fails the checks gives null, never a fallback); otherwise the name the admin used, but ONLY when it resolves to one of this server's own
+ * public addresses (a hosted site has no configured address, and its name points here). Either
+ * way the connection is pinned to the checked address, so a second DNS answer cannot move it.
+ * Null = leave those checks unanswered (as on localhost).
+ *
+ * @returns {Promise<{host: string, proto: 'http'|'https', address: string, source: 'config'|'request'}|null>}
+ */
+export async function publicTarget(request, {site = getConfig('site') || {}, lookup = dns.promises.lookup, own = ownPublicAddresses()} = {}) {
+    const resolve = async (host) => {
+        try { return (await lookup(host, {all: true})).map(r => String(r.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '')); }
+        catch { return []; }
+    };
+    const configured = urlHost(site.baseUrl) || urlHost(site.url);
+    if (configured && !isLocalHost(configured.host)) {
+        const addrs = await resolve(configured.host);
+        // Every answer must be public (or this server's own): an address the admin typed is still not a way inside.
+        if (!addrs.length || !addrs.every(a => own.has(a) || !isPrivateAddress(a))) return null;
+        return {...configured, address: addrs[0], source: 'config'};
+    }
+    // A local configured address (the shipped default is http://localhost:4096) says nothing about the public name.
+
+    const host = String(request.hostname || '').split(':')[0].toLowerCase();
+    if (isLocalHost(host) || !/^[a-z0-9.-]+$/.test(host)) return null;
+    const mine = (await resolve(host)).find(a => own.has(a));
+    if (!mine) return null;
+    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+    return {host, proto, address: mine, source: 'request'};
+}
+
 /**
  * Everything the health check needs.
  *
- * @param {import('fastify').FastifyRequest} request - the admin asking (its host is the site's)
+ * @param {import('fastify').FastifyRequest} request - the admin asking
  * @param {{settings: object, checks: boolean, twoFactor?: boolean}} ctx
+ * @param {{target?: object}} [deps] - tests: options for publicTarget()
  */
-export async function gatherFacts(request, {settings, checks, twoFactor = false}) {
+export async function gatherFacts(request, {settings, checks, twoFactor = false}, deps = {}) {
     const server = readJson(path.join(CMS_ROOT, 'config', 'server.json')) || {};
     const port = Number(process.env.PORT) || server.port || 4096;
-    const host = String(request.hostname || '').split(':')[0];
-    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-    const origin = isLocalHost(host) ? `http://127.0.0.1:${port}` : `${proto}://${host}`;
+    const target = await publicTarget(request, deps.target);
 
     const users = (await listUsers()).map(u => ({name: u.name, email: u.email, role: u.role, lastLogin: u.lastLogin || null,
         createdAt: u.createdAt || null, isActive: u.isActive !== false, level: getEffectiveLevel(u)}));
@@ -111,10 +186,11 @@ export async function gatherFacts(request, {settings, checks, twoFactor = false}
 
     const [eng, cert, head, probes] = await Promise.all([
         engine(),
-        isLocalHost(host) ? Promise.resolve(null) : certificate(host),
+        target ? certificate(target) : Promise.resolve(null),
         // Headers and HTTPS are about the PUBLIC site: without a public name to ask (a check run by the site
-        // itself, or on localhost) they are left unanswered rather than judged on the local port.
-        isLocalHost(host) ? Promise.resolve(null) : headers(origin),
+        // itself, on localhost, or a name that is not this server's) they are left unanswered rather than
+        // judged on the local port.
+        target ? headers(target) : Promise.resolve(null),
         probeFiles(port)
     ]);
     const smtp = getConfig('site')?.smtp || {};

package/plugins/security/tests/facts.test.js

@@ -0,0 +1,109 @@
+/** Security - the health check never connects to a host a visitor names (Host / X-Forwarded-Host). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import Fastify from 'fastify';
+import {certificate, gatherFacts, headers, isPrivateAddress, publicTarget} from '../server/facts.js';
+
+const OWN = '82.165.196.228';
+const DNS = {'evil.example': ['203.0.113.9'], 'inside.example': ['127.0.0.1'], 'lan.example': ['10.0.0.5'],
+    'site.example': [OWN], 'mixed.example': ['10.0.0.5', OWN], 'configured.example': ['198.51.100.7']};
+
+/** A fake resolver that records every name it was asked about. */
+function resolver() {
+    const asked = [];
+    const lookup = async (host) => {
+        asked.push(host);
+        if (!DNS[host]) throw Object.assign(new Error('ENOTFOUND'), {code: 'ENOTFOUND'});
+        return DNS[host].map(address => ({address, family: address.includes(':') ? 6 : 4}));
+    };
+    return {asked, lookup};
+}
+
+/** Run publicTarget() on a real Fastify request (trustProxy on, so X-Forwarded-Host is believed - the worst case). */
+async function targetFor(headers, deps) {
+    const app = Fastify({trustProxy: true});
+    app.get('/t', async (request) => ({target: await publicTarget(request, deps)}));
+    const res = await app.inject({method: 'GET', url: '/t', headers});
+    await app.close();
+    return res.json().target;
+}
+
+test('a forged Host or X-Forwarded-Host is never a target', async () => {
+    for (const headers of [
+        {host: 'evil.example'},
+        {host: 'site.example', 'x-forwarded-host': 'evil.example'},
+        {host: 'inside.example'},
+        {host: 'site.example', 'x-forwarded-host': 'lan.example'},
+        {host: 'site.example', 'x-forwarded-host': 'nowhere.example'},
+        {host: '169.254.169.254'},
+        {host: 'site.example', 'x-forwarded-host': '10.0.0.5:8080'}
+    ]) {
+        const {lookup} = resolver();
+        assert.equal(await targetFor(headers, {site: {}, lookup, own: new Set([OWN])}), null, JSON.stringify(headers));
+    }
+});
+
+test('the name the admin used is checked only when it resolves to this server, and pinned there', async () => {
+    const {lookup} = resolver();
+    const t = await targetFor({host: 'site.example', 'x-forwarded-proto': 'https'}, {site: {url: 'http://localhost:4096'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'site.example', proto: 'https', address: OWN, source: 'request'});
+    // Several answers: the connection goes to this server's own one, never the other.
+    const m = await targetFor({host: 'mixed.example'}, {site: {}, lookup, own: new Set([OWN])});
+    assert.equal(m.address, OWN);
+});
+
+test('a configured public address wins, and the request headers are not even looked up', async () => {
+    const {asked, lookup} = resolver();
+    const t = await targetFor({host: 'evil.example', 'x-forwarded-host': 'evil.example'},
+        {site: {baseUrl: 'https://configured.example'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'configured.example', proto: 'https', address: '198.51.100.7', source: 'config'});
+    assert.deepEqual(asked, ['configured.example']);
+});
+
+test('a configured address that resolves inside is refused, with no fallback to the request', async () => {
+    const {asked, lookup} = resolver();
+    assert.equal(await targetFor({host: 'site.example'}, {site: {url: 'https://lan.example'}, lookup, own: new Set([OWN])}), null);
+    assert.deepEqual(asked, ['lan.example']);
+});
+
+test('gatherFacts with forged headers leaves the public checks unanswered and connects nowhere', async () => {
+    const {asked, lookup} = resolver();
+    const request = {hostname: 'evil.example', protocol: 'https',
+        headers: {host: 'evil.example', 'x-forwarded-host': 'evil.example', 'x-forwarded-proto': 'https'}};
+    const settings = {lockout: {enabled: true}, policy: {enabled: true, minLength: 10}};
+    const started = Date.now();
+    const facts = await gatherFacts(request, {settings, checks: true}, {target: {site: {}, lookup, own: new Set([OWN])}});
+    assert.equal(facts.headers, null);
+    assert.equal(facts.cert, null);
+    assert.deepEqual(asked, ['evil.example']);
+    assert.ok(Date.now() - started < 20_000);
+});
+
+test('isPrivateAddress', () => {
+    for (const a of ['127.0.0.1', '10.1.2.3', '172.16.0.1', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '192.0.0.8', '198.18.0.1',
+        '::', '::1', '::7f00:1', '::ffff:127.0.0.1', '64:ff9b::a00:1', '2002:7f00:1::1', 'fd00::1', 'fe80::1', 'fec0::1', 'ff02::1', 'nonsense'])
+        assert.equal(isPrivateAddress(a), true, a);
+    for (const a of [OWN, '8.8.8.8', '2a00:1450:4009::1'])
+        assert.equal(isPrivateAddress(a), false, a);
+});
+
+test('the checks connect to the pinned address, sending the name only as Host / SNI', async () => {
+    const seen = [];
+    const web = http.createServer((req, res) => { seen.push(req.headers.host); res.setHeader('x-content-type-options', 'nosniff'); res.end('ok'); });
+    await new Promise(r => web.listen(0, '127.0.0.1', r));
+    const h = await headers({host: 'site.example', proto: 'http', address: '127.0.0.1', port: web.address().port});
+    web.close();
+    assert.deepEqual(seen, ['site.example']);
+    assert.equal(h.nosniff, true);
+    assert.equal(h.https, false);
+
+    let connected = 0;
+    const raw = net.createServer((sock) => { connected++; sock.destroy(); });
+    await new Promise(r => raw.listen(0, '127.0.0.1', r));
+    const c = await certificate({host: 'pinned.example', address: '127.0.0.1', port: raw.address().port});
+    raw.close();
+    assert.equal(connected, 1);
+    assert.equal(c.daysLeft, null);
+});

package/server/routes/api/forms.js

@@ -27,7 +27,7 @@ import {deleteForm, ensureCollectionForForm, ensureFormsDir, listForms, readForm
 import {executeAction} from '../../services/actions.js';
 // The same rules the browser draws the buttons by (a Cancel link must be safe).
 import {buttonSettingsProblems, formClassProblems, publicButtonSettings} from '../../../public/js/form-submit.mjs';
-import {createTransport, sendFormEmail} from '../../services/email.js';
+import {createTransport, mailFailure, sendFormEmail, TEST_EMAIL_FAILED} from '../../services/email.js';
 import {formActionFailed, formTriggerNotice} from '../../services/notification-sources.js';
 import {
     clearEntries,
@@ -45,6 +45,7 @@ import {hooks} from '../../services/hooks.js';
 import {saveMedia} from '../../services/content.js';
 import {v4 as uuidv4} from 'uuid';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
+import {safeFetch} from '../../services/outbound.js';
 
 /**
  * Detect form↔collection mismatches at save time so admins know BEFORE
@@ -961,11 +962,15 @@ export async function formsRoutes(fastify) {
         const webhookAction = form.actions?.webhook;
         if (record && webhookAction?.enabled && webhookAction.url) {
             try {
-                await fetch(webhookAction.url, {
-                    method:  webhookAction.method || 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body:    JSON.stringify({ form: slug, data })
+                // services/outbound.js: public addresses only, pinned, no redirect inward.
+                const method = String(webhookAction.method || 'POST').toUpperCase();
+                const res = await safeFetch(webhookAction.url, {
+                    method,
+                    headers:  { 'Content-Type': 'application/json' },
+                    body:     method === 'GET' || method === 'HEAD' ? undefined : JSON.stringify({ form: slug, data }),
+                    truncate: true
                 });
+                if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);
             } catch (err) {
                 fastify.log.warn(`[forms] Webhook failed for "${slug}": ${err.message}`);
                 formActionFailed(slug, form.title, 'webhook', err.message);
@@ -1058,7 +1063,9 @@ export async function formsRoutes(fastify) {
             });
             return { ok: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send test email: ${err.message}` });
+            // Plain words only - the server's own are in the log (email.js mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 }

package/server/routes/api/settings.js

@@ -11,7 +11,9 @@ import {faviconSource, generateFavicon} from '../../services/favicon.js';
 import {saveMedia} from '../../services/content.js';
 import {randomUUID} from 'node:crypto';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
-import {createTransport} from '../../services/email.js';
+import {createTransport, mailFailure, TEST_EMAIL_FAILED} from '../../services/email.js';
+import {signedOnly} from '../../services/codePolicy.js';
+import {resolveMailHost} from '../../services/mailHost.js';
 import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
@@ -171,6 +173,17 @@ export async function settingsRoutes(fastify) {
         if (merged.smtp && merged.smtp.pass === '' && existing.smtp?.pass) {
             merged.smtp = {...merged.smtp, pass: existing.smtp.pass};
         }
+        // Hosted sites: refuse a mail server this site would not connect to, at
+        // save, so it is not found out at the first password reset.
+        if (signedOnly() && merged.smtp?.host
+            && (merged.smtp.host !== existing.smtp?.host || merged.smtp.port !== existing.smtp?.port)) {
+            try {
+                await resolveMailHost(merged.smtp.host, Number(merged.smtp.port) || 587, {kind: 'smtp', signed: true});
+            } catch (err) {
+                if (err.mailHostRefused) return reply.code(400).send({error: err.message});
+                // A name that does not resolve yet is the send's problem, not the save's.
+            }
+        }
         saveConfig('site', merged);
         await cache.invalidateTags(['site']);
         return { success: true };
@@ -182,16 +195,16 @@ export async function settingsRoutes(fastify) {
             return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
         }
 
-        // Shared transport factory - carries the self-signed-cert TLS relaxation.
-        // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
-        const transporter = await createTransport(smtp);
-
         const to = request.body?.to || smtp.fromAddress;
         if (!to) {
             return reply.status(400).send({ error: 'No recipient address. Provide "to" in the request body or set a From Address.' });
         }
 
         try {
+            // Shared transport factory - carries the self-signed-cert TLS relaxation
+            // and, on hosted sites, the mail-host rules (services/mailHost.js).
+            // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
+            const transporter = await createTransport(smtp);
             await transporter.sendMail({
                 from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
                 to,
@@ -201,7 +214,10 @@ export async function settingsRoutes(fastify) {
             });
             return { success: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send email: ${err.message}` });
+            // Never the mail server's words: they say what listens on a host and
+            // port. The detail is in the server log (mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 

package/server/services/actions.js

@@ -203,10 +203,13 @@ async function executeStep(step, collection, entry, context) {
             const body    = cfg.body ? interpolateValue(cfg.body, context) : undefined;
             const headers = { 'Content-Type': 'application/json', ...(cfg.headers || {}) };
 
-            const res = await fetch(url, {
+            // services/outbound.js: public addresses only, pinned, no redirect inward.
+            const { safeFetch } = await import('./outbound.js');
+            const res = await safeFetch(url, {
                 method,
                 headers,
-                body: body !== undefined ? JSON.stringify(body) : undefined
+                body: body !== undefined && method !== 'GET' && method !== 'HEAD' ? JSON.stringify(body) : undefined,
+                truncate: true
             });
 
             if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);

package/server/services/adapters/MongoAdapter.js

@@ -19,7 +19,7 @@
  *   count(slug)               → number
  *   archive(slug)             → string|null (set the entries aside after a storage move)
  */
-import { toMongoQuery } from '../filterEngine.js';
+import { toSafeMongoQuery } from '../mongoQueryGuard.js';
 
 /** Prefix applied to all CMS collection names in MongoDB to avoid collisions. */
 const PREFIX = 'cms_';
@@ -36,6 +36,19 @@ function strip(doc) {
     return rest;
 }
 
+/**
+ * An entry id as it may be put in a query: text only. An object from a JSON
+ * body (`{"$ne": ""}`) would otherwise be read as an operator and pick
+ * whichever entry matched first.
+ *
+ * @param {unknown} entryId
+ * @returns {string}
+ */
+function idOf(entryId) {
+    if (typeof entryId !== 'string' && typeof entryId !== 'number') throw Object.assign(new Error('Entry not found'), {statusCode: 404});
+    return String(entryId);
+}
+
 export class MongoAdapter {
 
     /**
@@ -67,7 +80,7 @@ export class MongoAdapter {
      * and structured filtering.
      *
      * `filter` is translated to native MongoDB query operators via
-     * `filterEngine.toMongoQuery()` and pushed down to the database - page
+     * `mongoQueryGuard.toSafeMongoQuery()` and pushed down to the database - page
      * authors writing `[collection where_salary_gte="50000"]` get index-aware
      * queries automatically. When `search` is present, all documents are
      * fetched and filtered in memory (same behaviour as FileAdapter, kept
@@ -88,7 +101,9 @@ export class MongoAdapter {
 
         const sortField = sort === 'createdAt' ? 'meta.createdAt' : `data.${sort}`;
         const sortDir   = order === 'desc' ? -1 : 1;
-        const query     = filter ? toMongoQuery(filter) : {};
+        // The one translation of a user-shaped filter for MongoDB - refuses
+        // anything that would run code on the server (mongoQueryGuard.js).
+        const query     = toSafeMongoQuery(filter);
 
         if (search) {
             // Fetch matching (by filter) docs and substring-match in memory.
@@ -140,8 +155,9 @@ export class MongoAdapter {
      * @returns {Promise<object|null>}
      */
     async get(slug, entryId) {
+        if (typeof entryId !== 'string' && typeof entryId !== 'number') return null;
         const col = await this._col(slug);
-        const doc = await col.findOne({ id: entryId }, { projection: { _id: 0 } });
+        const doc = await col.findOne({ id: idOf(entryId) }, { projection: { _id: 0 } });
         return doc || null;
     }
 
@@ -169,7 +185,7 @@ export class MongoAdapter {
      */
     async update(slug, entryId, updated) {
         const col    = await this._col(slug);
-        const result = await col.replaceOne({ id: entryId }, { ...updated });
+        const result = await col.replaceOne({ id: idOf(entryId) }, { ...updated });
         if (result.matchedCount === 0) throw new Error('Entry not found');
         return updated;
     }
@@ -184,7 +200,7 @@ export class MongoAdapter {
      */
     async remove(slug, entryId) {
         const col    = await this._col(slug);
-        const result = await col.deleteOne({ id: entryId });
+        const result = await col.deleteOne({ id: idOf(entryId) });
         if (result.deletedCount === 0) throw new Error('Entry not found');
     }
 

package/server/services/email.js

@@ -3,6 +3,82 @@
  * Nodemailer transport factory and generic form email sending utility.
  */
 import nodemailer from 'nodemailer';
+import {signedOnly} from './codePolicy.js';
+import {resolveMailHost} from './mailHost.js';
+
+/**
+ * What a person is told when mail could not be sent. The mail server's own
+ * words (and the library's) go to the server log only: they say what is
+ * listening on a host and port, which is how a mail setting becomes a scanner
+ * of the server's network.
+ */
+export const MAIL_SEND_FAILED = 'Could not send the email. Check the mail server settings.';
+export const TEST_EMAIL_FAILED = 'Could not send the test email. Check the mail server settings.';
+
+/** The error every send fails with: plain words, nothing from the server. */
+export class MailSendError extends Error {
+    constructor(message = MAIL_SEND_FAILED, {refused = false} = {}) {
+        super(message);
+        this.code = 'EMAILSEND';
+        this.mailSendFailed = true;
+        // The host or port was refused by services/mailHost.js - the message is ours, not the server's.
+        this.refused = refused;
+    }
+}
+
+/**
+ * Log a send failure in full, and hand back the plain error to throw.
+ *
+ * @param {unknown} err
+ * @returns {MailSendError}
+ */
+export function mailFailure(err) {
+    if (err instanceof MailSendError) return err;
+    const detail = err?.message || String(err);
+    console.warn(`[email] send failed${err?.code ? ` (${err.code})` : ''}: ${detail}`);
+    return err?.mailHostRefused ? new MailSendError(err.message, {refused: true}) : new MailSendError();
+}
+
+/** Wrap sendMail/verify (promise or callback style) so only plain errors leave. */
+function guardTransportErrors(transport) {
+    for (const method of ['sendMail', 'verify']) {
+        const real = transport[method]?.bind(transport);
+        if (!real) continue;
+        transport[method] = (...args) => {
+            const cb = typeof args.at(-1) === 'function' ? args.pop() : null;
+            const p = Promise.resolve().then(() => real(...args)).catch(err => { throw mailFailure(err); });
+            if (!cb) return p;
+            p.then(info => cb(null, info), err => cb(err));
+            return undefined;
+        };
+    }
+    return transport;
+}
+
+/**
+ * A transport for a signed-only site: each send checks the host again and
+ * connects to the address it checked (the name kept for TLS), so neither a
+ * changed setting nor a second DNS answer can point it inward. nodemailer's SMTP
+ * transport opens a connection per message anyway, so a transport per send
+ * costs nothing extra.
+ */
+function pinnedTransport(base, {lookup} = {}) {
+    const open = async () => {
+        const {address, servername} = await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+        return nodemailer.createTransport({...base, host: address, ...(servername && {servername})});
+    };
+    const run = async (method, args) => {
+        const t = await open();
+        try { return await t[method](...args); } finally { t.close(); }
+    };
+    return guardTransportErrors({
+        options: {...base},
+        sendMail: (message) => run('sendMail', [message]),
+        verify: () => run('verify', []),
+        close: () => {},
+        isIdle: () => true
+    });
+}
 
 let lastSendResult = null;
 
@@ -70,15 +146,27 @@ export function isSmtpConfigured(smtp) {
  * @returns {Promise<import('nodemailer').Transporter>}
  * @throws {Error} If Ethereal test account creation fails.
  */
-export async function createTransport(smtp) {
+export async function createTransport(smtp, {signed, lookup} = {}) {
     if (isSmtpConfigured(smtp)) {
-        return nodemailer.createTransport({
+        const base = {
             host: smtp.host,
-            port: smtp.port || 587,
+            port: Number(smtp.port) || 587,
             secure: smtp.secure || false,
             auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
             tls: { rejectUnauthorized: false }
-        });
+        };
+        // Hosted (signed-only) sites: loopback or a public mail server on a mail
+        // port, connected by the checked address - services/mailHost.js.
+        // Self-hosted sites may use any relay, internal ones included, as before.
+        if (signed ?? signedOnly()) {
+            try {
+                await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+            } catch (err) {
+                throw mailFailure(err);
+            }
+            return pinnedTransport(base, {lookup});
+        }
+        return guardTransportErrors(nodemailer.createTransport(base));
     }
 
     // No SMTP configured - use Ethereal for dev/demo.
@@ -152,8 +240,9 @@ export async function sendEmail(transport, {from, fromName, to, subject, html, t
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }
 
@@ -213,7 +302,8 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }

package/server/services/filterEngine.js

@@ -262,7 +262,9 @@ export function toMongoQuery(filter) {
 
     // Collapse single-operator sub-docs that only contain $eq back to a flat value.
     for (const [path, sub] of Object.entries(query)) {
-        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub) {
+        // Only a plain value: an object here would be read as operators, not matched as a value.
+        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub
+            && (sub.$eq === null || typeof sub.$eq !== 'object')) {
             query[path] = sub.$eq;
         }
     }