next-tinacms-cloudinary 27.0.2 → 27.0.3

package/dist/handlers.js

@@ -81,6 +81,11 @@ function resolveDirectory(rawDirectory) {
   return normalized + "/";
 }
 
+// src/search-expression.ts
+function escapeSearchValue(value) {
+  return value.replace(/[\\"*]/g, "\\$&");
+}
+
 // src/upload-filename.ts
 function safeUploadName(originalName) {
   const base = originalName.split(/[/\\]/).pop() || "";
@@ -157,8 +162,10 @@ async function uploadMedia(req, res) {
 }
 async function listMedia(req, res, opts) {
   try {
+    const rawDirectory = req.query.directory;
+    const directory = Array.isArray(rawDirectory) ? rawDirectory[0] : rawDirectory;
     const mediaListOptions = {
-      directory: req.query.directory || '""',
+      directory: directory || '""',
       limit: parseInt(req.query.limit, 10) || 500,
       offset: req.query.offset,
       filesOnly: req.query.filesOnly === "true" || false
@@ -175,14 +182,14 @@ async function listMedia(req, res, opts) {
         throw e;
       }
     }
-    const query = useRootDirectory ? 'folder=""' : `folder="${mediaListOptions.directory}"`;
+    const query = useRootDirectory ? 'folder=""' : `folder="${escapeSearchValue(mediaListOptions.directory)}"`;
     const response = await cloudinary.search.expression(query).max_results(mediaListOptions.limit).next_cursor(mediaListOptions.offset).execute();
     const files = response.resources.map(getCloudinaryToTinaFunc(opts));
-    cloudinary.api.folders = (directory = '""') => {
+    cloudinary.api.folders = (directory2 = '""') => {
       if (useRootDirectory) {
         return cloudinary.api.root_folders();
       } else {
-        return cloudinary.api.sub_folders(directory);
+        return cloudinary.api.sub_folders(directory2);
       }
     };
     let folders = [];

package/dist/search-expression.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Escape a value for interpolation into a quoted Cloudinary Search API term.
+ *
+ * Cloudinary treats a double-quoted term literally except for `"` and `*`,
+ * which keep their meaning and must be backslash-escaped. Backslash is escaped
+ * too as a conservative hedge; callers reach this through resolveDirectory,
+ * which already rejects backslashes, so that branch is unreachable today.
+ *
+ * See https://cloudinary.com/documentation/search_expressions
+ */
+export declare function escapeSearchValue(value: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-cloudinary",
   "type": "module",
-  "version": "27.0.2",
+  "version": "27.0.3",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "cloudinary": "^1.41.3",
-    "multer": "1.4.5-lts.1"
+    "multer": "2.2.0"
   },
   "devDependencies": {
     "@types/crypto-js": "^3.1.47",
@@ -30,11 +30,11 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "@tinacms/scripts": "1.6.2",
-    "tinacms": "3.11.0"
+    "@tinacms/scripts": "1.6.3",
+    "tinacms": "3.12.0"
   },
   "peerDependencies": {
-    "tinacms": "^3.11.0"
+    "tinacms": "^3.12.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"