domma-cms 1.8.34 → 1.8.35

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.8.35] - 2026-10-21
+
+- **Missing pages answer 404 again on sites without their own 404 page.** Since 1.8.29 such a site answered every missing address with a server error, because the built-in 404 and 403 pages called a helper that had been moved away. The address shown on those pages is escaped, as before.
+
 ## [1.8.34] - 2026-10-21
 
 - **Docs, Garage, Messages and Theme Roller are free, and come with Domma CMS.** They need no licence any more, on your own server or ours, and ship in the engine beside Blog, Booking and the other free Tools - switched off until you switch them on. Sites that already have them keep their data and settings; the update replaces the licensed copy with the free one. Docs 2.14.0, Garage 1.6.0, Messages 1.9.0, Theme Roller 1.3.0. Docs Pro stays a paid Tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.34",
+  "version": "1.8.35",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/public.js

@@ -44,6 +44,22 @@ export function getBaseUrl(request) {
 import {sendHtml} from '../services/htmlResponse.js';
 export {sendHtml};
 
+/**
+ * Escape user-controlled strings before interpolating into HTML.
+ * Prevents reflected XSS in the built-in 403 and 404 pages.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeHtml(str) {
+    return String(str)
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
 export async function publicRoutes(fastify) {
     // Admin panel: serve index.html for all /admin/* paths (SPA fallback)
     fastify.get('/admin', async (request, reply) => {