813bc46640
A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron +pubsub triggers, the transactional-outbox notification chain, a docs before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a durable Workflow (validate -> enrich || seo -> publish -> finalize) started with workflow::start and polled with workflow::run_status, visualized live with Svelte Flow. FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue found (each tagged [PiCloud] vs [CMS]); the platform fixes for the actionable ones ship in the preceding commit. Also folds in the read-only `pic` allowlist entries added to .claude/settings.json during the session (fewer-permission-prompts). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
1.7 KiB
Plaintext
44 lines
1.7 KiB
Plaintext
// POST /cms/admin/media — upload an image (author+). Two ways in, since the
|
|
// platform fix (F-026):
|
|
// 1. JSON: { name, content_type, data_base64 }
|
|
// 2. RAW BINARY: Content-Type: image/png, body = the bytes, ?name=file.png
|
|
// (the platform hands a non-JSON binary body to the script as base64).
|
|
// SVG is rejected (it can carry scripts -> stored XSS).
|
|
import "auth" as auth;
|
|
let g = auth::guard(ctx, ["admin", "author"]);
|
|
if !g.ok { return g.response; }
|
|
|
|
let allowed = ["image/png", "image/jpeg", "image/gif", "image/webp"];
|
|
let name = ();
|
|
let content_type = ();
|
|
let bytes = ();
|
|
|
|
let b = ctx.request.body;
|
|
if type_of(b) == "map" {
|
|
// (1) JSON path
|
|
if b.data_base64 == () || b.name == () || b.content_type == () {
|
|
return #{ statusCode: 400, body: #{ error: "name, content_type, data_base64 required" } };
|
|
}
|
|
name = b.name;
|
|
content_type = b.content_type;
|
|
bytes = base64::decode(b.data_base64);
|
|
} else if type_of(b) == "string" {
|
|
// (2) raw binary path — body is the platform's base64 of the raw bytes
|
|
let ct = ctx.request.headers["content-type"];
|
|
if ct == () { return #{ statusCode: 400, body: #{ error: "content-type header required" } }; }
|
|
content_type = ct;
|
|
name = ctx.request.query["name"];
|
|
if name == () { name = "upload"; }
|
|
bytes = base64::decode(b);
|
|
} else {
|
|
return #{ statusCode: 400, body: #{ error: "empty body" } };
|
|
}
|
|
|
|
if !allowed.contains(content_type) {
|
|
return #{ statusCode: 415, body: #{ error: "unsupported content_type (images only, no svg)" } };
|
|
}
|
|
|
|
let media = files::collection("media");
|
|
let id = media.create(#{ name: name, content_type: content_type, data: bytes });
|
|
#{ statusCode: 201, body: #{ id: id, name: name, content_type: content_type, size: bytes.len() } }
|