Showcase
${escapeHtml(setting(settings, "home.highlight.title", "Featured and Newly Added"))}
@@ -484,9 +542,11 @@ app.get("/admin", (req, res) => {
app.get("/admin/setup", (req, res) => {
if (adminCount()) return res.redirect("/admin/login");
+ if (!setupAuthorized(req)) return requireSetupToken(req, res, () => {});
res.send(authLayout("Create Owner Account", `
Create the first owner login. No password is stored as plain text.
`));
});
-app.post("/admin/setup", async (req, res) => {
+app.post("/admin/setup", requireSetupToken, async (req, res) => {
if (adminCount()) return res.redirect("/admin/login");
const password = String(req.body.password || "");
if (password.length < 10) return res.status(400).send("Please use a password with at least 10 characters.");
@@ -732,13 +792,13 @@ app.get("/admin/items/:id/edit", requireAdmin, (req, res) => {
renderAdmin(req, res, `Edit ${item.name}`, "items", itemEditor(item, res.locals.csrfToken));
});
-app.post("/admin/items/new", requireAdmin, upload.array("images", 8), async (req, res, next) => {
+app.post("/admin/items/new", requireAdmin, upload.array("images", 8), csrfCheck, async (req, res, next) => {
try {
const id = await saveItem(req, null);
res.redirect(`/admin/items/${id}/edit`);
} catch (error) { next(error); }
});
-app.post("/admin/items/:id/edit", requireAdmin, upload.array("images", 8), async (req, res, next) => {
+app.post("/admin/items/:id/edit", requireAdmin, upload.array("images", 8), csrfCheck, async (req, res, next) => {
try {
await saveItem(req, req.params.id);
res.redirect(`/admin/items/${req.params.id}/edit`);
@@ -835,10 +895,10 @@ app.get("/admin/services/:id/edit", requireAdmin, (req, res) => {
const service = db.prepare("SELECT * FROM services WHERE id=?").get(req.params.id);
renderAdmin(req, res, `Edit ${service.name}`, "services", serviceEditor(service, res.locals.csrfToken));
});
-app.post("/admin/services/new", requireAdmin, upload.single("image"), async (req, res, next) => {
+app.post("/admin/services/new", requireAdmin, upload.single("image"), csrfCheck, async (req, res, next) => {
try { const id = await saveService(req, null); res.redirect(`/admin/services/${id}/edit`); } catch (e) { next(e); }
});
-app.post("/admin/services/:id/edit", requireAdmin, upload.single("image"), async (req, res, next) => {
+app.post("/admin/services/:id/edit", requireAdmin, upload.single("image"), csrfCheck, async (req, res, next) => {
try { await saveService(req, req.params.id); res.redirect(`/admin/services/${req.params.id}/edit`); } catch (e) { next(e); }
});
app.post("/admin/services/:id/duplicate", requireAdmin, (req, res) => {
@@ -950,7 +1010,7 @@ app.get("/admin/media", requireAdmin, (req, res) => {
${media.map((m) => `
${escapeHtml(m.title || m.original_name)}
${escapeHtml(m.url)} ยท ${bytes(m.size_bytes)}
`).join("")}
`;
renderAdmin(req, res, "Media Library", "media", body);
});
-app.post("/admin/media", requireAdmin, upload.array("images", 10), async (req, res, next) => {
+app.post("/admin/media", requireAdmin, upload.array("images", 10), csrfCheck, async (req, res, next) => {
try {
for (const file of req.files || []) await storeImage(file, req.body);
audit(req.admin.id, "Uploaded images", `${req.files?.length || 0} files`, req.ip);
diff --git a/src/utils.js b/src/utils.js
index 79dc8f7..5272da8 100644
--- a/src/utils.js
+++ b/src/utils.js
@@ -71,6 +71,32 @@ function safeJson(value, fallback = {}) {
}
}
+function safeCssColor(value, fallback = "#000000") {
+ const text = String(value || "").trim();
+ if (/^#[0-9a-fA-F]{3}([0-9a-fA-F]{3})?$/.test(text)) return text;
+ if (/^rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}(\s*,\s*(0|1|0?\.\d+))?\s*\)$/.test(text)) return text;
+ return fallback;
+}
+
+function safeCssNumber(value, fallback = 0, min = 0, max = 1) {
+ const number = Number(value);
+ if (!Number.isFinite(number)) return fallback;
+ return Math.min(max, Math.max(min, number));
+}
+
+function safeCssKeyword(value, allowed, fallback) {
+ const text = String(value || "").trim().toLowerCase();
+ return allowed.includes(text) ? text : fallback;
+}
+
+function safeCssUrl(value) {
+ const text = String(value || "").trim();
+ if (!text) return "";
+ if (/^\/[A-Za-z0-9/_\-.%]+$/.test(text)) return text;
+ if (/^https:\/\/[^\s"'()<>]+$/i.test(text)) return text;
+ return "";
+}
+
module.exports = {
escapeHtml,
cleanRichText,
@@ -80,5 +106,9 @@ module.exports = {
bytes,
checkbox,
listFromText,
- safeJson
+ safeJson,
+ safeCssColor,
+ safeCssNumber,
+ safeCssKeyword,
+ safeCssUrl
};
diff --git a/storage/server.pid b/storage/server.pid
deleted file mode 100644
index ebf57c3..0000000
--- a/storage/server.pid
+++ /dev/null
@@ -1 +0,0 @@
-32184
diff --git a/storage/server.stderr.log b/storage/server.stderr.log
deleted file mode 100644
index e69de29..0000000
diff --git a/storage/server.stdout.log b/storage/server.stdout.log
deleted file mode 100644
index e69de29..0000000
diff --git a/test/smoke.test.js b/test/smoke.test.js
index 76c920a..da7fe72 100644
--- a/test/smoke.test.js
+++ b/test/smoke.test.js
@@ -1,8 +1,23 @@
const test = require("node:test");
const assert = require("node:assert/strict");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
const request = require("supertest");
+
+const testRoot = fs.mkdtempSync(path.join(os.tmpdir(), "dws-test-"));
+process.env.DATABASE_PATH = path.join(testRoot, "site.sqlite");
+process.env.UPLOAD_DIR = path.join(testRoot, "uploads");
+process.env.BACKUP_DIR = path.join(testRoot, "backups");
+process.env.SESSION_SECRET = "test-session-secret-with-more-than-thirty-two-characters";
+process.env.SETUP_TOKEN = "test-setup-token-with-enough-length";
+
const { app } = require("../src/server");
+function csrfFrom(html) {
+ return /name="_csrf" value="([^"]+)"/.exec(html)?.[1] || "";
+}
+
test("public pages load", async () => {
for (const path of ["/", "/items", "/services", "/about-contact", "/healthz"]) {
const response = await request(app).get(path);
@@ -15,10 +30,79 @@ test("admin redirects to setup or login", async () => {
assert.equal([302, 303].includes(response.status), true);
});
+test("owner setup requires the private setup token", async () => {
+ const agent = request.agent(app);
+
+ const locked = await agent.get("/admin/setup");
+ assert.equal(locked.status, 403);
+
+ const setupPage = await agent.get("/admin/setup?token=test-setup-token-with-enough-length");
+ assert.equal(setupPage.status, 200);
+ const token = csrfFrom(setupPage.text);
+
+ const takeover = await agent
+ .post("/admin/setup")
+ .type("form")
+ .send({
+ _csrf: token,
+ name: "Attacker",
+ email: "attacker@example.com",
+ password: "attacker-password"
+ });
+ assert.equal(takeover.status, 403);
+
+ const created = await agent
+ .post("/admin/setup")
+ .type("form")
+ .send({
+ _csrf: token,
+ setup_token: "test-setup-token-with-enough-length",
+ name: "Owner",
+ email: "owner@example.com",
+ password: "owner-password-123"
+ });
+ assert.equal(created.status, 302);
+ assert.equal(created.headers.location, "/admin/dashboard");
+
+ const dashboard = await agent.get("/admin/dashboard");
+ assert.equal(dashboard.status, 200);
+
+ const setupAfterClaim = await agent.get("/admin/setup?token=test-setup-token-with-enough-length");
+ assert.equal(setupAfterClaim.status, 302);
+ assert.equal(setupAfterClaim.headers.location, "/admin/login");
+});
+
+test("multipart admin uploads pass CSRF after form parsing", async () => {
+ const agent = request.agent(app);
+ const loginPage = await agent.get("/admin/login");
+ const loginToken = csrfFrom(loginPage.text);
+ const login = await agent
+ .post("/admin/login")
+ .type("form")
+ .send({
+ _csrf: loginToken,
+ email: "owner@example.com",
+ password: "owner-password-123"
+ });
+ assert.equal(login.status, 302);
+
+ const mediaPage = await agent.get("/admin/media");
+ const uploadToken = csrfFrom(mediaPage.text);
+ const sampleImage = path.join(__dirname, "..", "public", "uploads", "sample-hero.png");
+ const upload = await agent
+ .post("/admin/media")
+ .field("_csrf", uploadToken)
+ .field("title", "Test upload")
+ .field("alt", "Test upload")
+ .attach("images", sampleImage);
+ assert.equal(upload.status, 302);
+ assert.equal(upload.headers.location, "/admin/media");
+});
+
test("contact form requires complete fields", async () => {
const agent = request.agent(app);
const page = await agent.get("/about-contact");
- const token = /name="_csrf" value="([^"]+)"/.exec(page.text)?.[1];
+ const token = csrfFrom(page.text);
const response = await agent
.post("/contact")
.send(`_csrf=${encodeURIComponent(token || "")}&name=&email=bad&subject=&message=`);