domma-cms 1.8.40 → 1.8.41

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.8.41] - 2026-10-23
+
+- **A page can show images from another site.** `csp.imgHosts` in `config/server.json` adds hosts to the Content-Security-Policy's `img-src` (`imageSources()` in `server/services/embedCsp.js`, beside `connectSources()`; bare hostnames, https only). The policy allowed only the site's own images, so an `<img>` from anywhere else - a "Featured on" badge, say - was blocked.
+
 ## [1.8.40] - 2026-10-22
 
 - **Every collection entry is in the page for robots.** An interactive collection or view now puts every entry in the page HTML for robots that run no JavaScript, also when it loads its pages from the server, up to 1,000 (was 200, and only the first page in server mode). A collection past 1,000 shows as a warning in the SEO audit.

package/docs/DommaFeatures.md

@@ -1334,6 +1334,7 @@ The four Tools below were plugins until 0.67.0 and are now part of the CMS. They
 - **`TRUST_PROXY`** - Takes Fastify's own values: `loopback` (recommended behind Apache or the manager, and the default for new sites the manager creates), a list of addresses or CIDR ranges, or a hop count. `1` or `true` trusts every hop, which lets a visitor spoof their IP address.
   Where: `server/services/network.js` - Since: 0.83.0.
 - **Reading other sites from a page** - `csp.connectHosts` in `config/server.json` lets public pages fetch from the listed hosts (added to the CSP's `connect-src`, https only); domma-cms.com's Pricing page reads the Pro Tool prices from dcm this way.
+- **Showing images from other sites** - `csp.imgHosts` in `config/server.json` lets public pages show images from the listed hosts (added to the CSP's `img-src`, https only); without it only the site's own images load.
 - **Public asset CORS** - `cors.publicPrefixes` in `config/server.json` adds `Access-Control-Allow-Origin: *` to GET and HEAD requests under the listed paths only, so other sites can import scripts or assets from them.
   Where: `server/services/publicCors.js`.
 - **Email service** - A Nodemailer transport built from the SMTP settings in `site.json`, used for form emails, password resets and notices. With no SMTP host set, mail goes to a throwaway Ethereal test inbox, which reports success but delivers to nobody. The CMS makes this visible in Settings, in health checks and with an "Email not set up" notification. New sites ship with an SMTP host, defaulting to a local mail server on port 25 or taken from the environment.

package/docs/configuration.md

@@ -27,6 +27,7 @@ Controls the HTTP server.
 | `cors.origin` | boolean / string / string[] | `false` | Passed directly to `@fastify/cors`. `false` disables CORS. Set to `"*"` or a domain to allow cross-origin requests |
 | `cors.publicPrefixes` | string[] | `[]` | Absolute path prefixes whose **GET and HEAD** responses carry `Access-Control-Allow-Origin: *`, so other origins can hot-link those assets. A module script is fetched in CORS mode, so this is what makes e.g. `/public/demos/` importable from elsewhere. `@fastify/cors` decides per origin and cannot express a path, hence the separate key. Reads only - it never widens a write, and it applies to listed prefixes only. A value that is not an absolute path is ignored |
 | `csp.connectHosts` | string[] | `[]` | Other sites a public page may read from in the browser (`fetch`), added to the Content-Security-Policy's `connect-src` as `https://<host>`. The site itself and cdn.jsdelivr.net are always allowed. Bare hostnames only (`dcm.dommajs.org`); a scheme, path, port or wildcard is ignored. Read at boot, so restart after changing it |
+| `csp.imgHosts` | string[] | `[]` | Other sites a public page may show images from (an `<img>` hosted elsewhere, such as a badge or partner logo), added to the Content-Security-Policy's `img-src` as `https://<host>`. The site itself, `data:` and `blob:` are always allowed; without this an image from another site is blocked - upload it to Media instead if you can. Bare hostnames only (`statics.startupbase.io`); a scheme, path, port or wildcard is ignored. Read at boot, so restart after changing it |
 | `uploads.maxFileSize` | number | `10485760` (10 MB) | Maximum allowed upload size in bytes |
 | `logging.level` | string | Log verbosity: `fatal`, `error`, `warn`, `info`, `debug`, `trace`, `silent`. Defaults to `info` in development, `warn` otherwise. `warn` hides 4xx responses and plugin `log.info` output, so a failed admin action leaves no trace - raise it to `info` if you need to diagnose one. Overridden by the `LOG_LEVEL` env var. |
 | `restartOnPluginToggle` | boolean | `true` | Restart the server automatically when an admin enables or disables a plugin. See **Plugin toggles restart the server** below |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.40",
+  "version": "1.8.41",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -33,7 +33,7 @@ import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
 import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
-import {connectSources, frameSources} from './services/embedCsp.js';
+import {connectSources, frameSources, imageSources} from './services/embedCsp.js';
 import {cspSources as gaSources} from './services/googleAnalytics.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -128,7 +128,8 @@ await app.register(helmet, {
             // (services/googleAnalytics.js) - a site without one keeps exactly this policy.
             scriptSrc: ["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'", 'https://cdn.jsdelivr.net', gaSources('script')],
             styleSrc: ["'self'", "'unsafe-inline'", 'https://cdn.jsdelivr.net', 'https://fonts.googleapis.com'],
-            imgSrc: ["'self'", 'data:', 'blob:', gaSources('img')],
+            // config/server.json csp.imgHosts: other sites a page may show images from (services/embedCsp.js).
+            imgSrc: [...imageSources(serverConfig.csp?.imgHosts), gaSources('img')],
             fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
             // config/server.json csp.connectHosts: other sites a page may read from (services/embedCsp.js).
             connectSrc: [...connectSources(serverConfig.csp?.connectHosts), gaSources('connect')],

package/server/services/embedCsp.js

@@ -50,3 +50,22 @@ export function connectSources(connectHosts = []) {
         .map(h => `https://${h}`);
     return [...new Set([...ALWAYS_CONNECTED, ...extra])];
 }
+
+/** What a page may always show images from: the site itself, and inline/data and blob images. */
+export const ALWAYS_IMAGED = ["'self'", 'data:', 'blob:'];
+
+/**
+ * The img-src: the site, data: and blob:, and every host in config/server.json `csp.imgHosts` - for a page
+ * that shows an image hosted elsewhere (a badge, a partner logo). Bare hostnames only, served over https;
+ * anything else is dropped. Read at boot, like connect-src.
+ *
+ * @param {string[]} imgHosts - config/server.json csp.imgHosts
+ * @returns {string[]} img-src sources
+ */
+export function imageSources(imgHosts = []) {
+    const extra = (Array.isArray(imgHosts) ? imgHosts : [])
+        .map(h => String(h).trim().toLowerCase())
+        .filter(h => HOST_RE.test(h))
+        .map(h => `https://${h}`);
+    return [...new Set([...ALWAYS_IMAGED, ...extra])];
+}