From 7dba032703ae95a1934df0e44893cd4e683b0628 Mon Sep 17 00:00:00 2001
From: Scott Duensing <scott@duensing.com>
Date: Wed, 1 Jul 2026 20:05:05 -0500
Subject: [PATCH] More security issues addressed.

---
 lib/action.js    | 15 ++++++++++++---
 lib/constants.js |  2 +-
 package.json     |  2 +-
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/lib/action.js b/lib/action.js
index e83622d..90bb54d 100644
--- a/lib/action.js
+++ b/lib/action.js
@@ -72,9 +72,18 @@ const buildPostPayload = (configuration, row, mediaIds, nowIso) => {
         .map((s) => s.trim())
         .filter(Boolean);
     const value = [{ content, image: mediaIds.map((id) => ({ id })) }];
-    const date  = configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField
-        ? new Date(row[configuration.scheduleField]).toISOString()
-        : nowIso;
+    let date = nowIso;
+    if (configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField) {
+        // The schedule field is free-text row data; a blank or non-date value makes
+        // new Date(...).toISOString() throw an unhandled RangeError that fails the
+        // action with a cryptic message. Validate and fail with an actionable one.
+        const raw    = row[configuration.scheduleField];
+        const parsed = new Date(raw);
+        if (Number.isNaN(parsed.getTime())) {
+            throw new Error(`${PLUGIN_NAME}: schedule field "${configuration.scheduleField}" is not a valid date (${JSON.stringify(raw)}); set a parseable date to schedule this post`);
+        }
+        date = parsed.toISOString();
+    }
 
     return {
         type:  configuration.when,
diff --git a/lib/constants.js b/lib/constants.js
index 2a7933f..e1ba984 100644
--- a/lib/constants.js
+++ b/lib/constants.js
@@ -1,7 +1,7 @@
 // Compile-time constants for the postiz-poster plugin.
 
 const PLUGIN_NAME    = "postiz-poster";
-const PLUGIN_VERSION = "0.0.1";
+const PLUGIN_VERSION = "0.0.2";
 
 // Postiz public REST API. The surface is identical for self-hosted and cloud;
 // only the base URL (plugin config) differs. Endpoint paths below are appended
diff --git a/package.json b/package.json
index 25bed36..50bfba3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "postiz-poster",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Saltcorn plugin: publish table rows to social networks (Mastodon, Bluesky, X, LinkedIn, Facebook, Instagram, Threads, and more) through a Postiz instance -- self-hosted or cloud -- via a single per-trigger action. Channels are chosen from the live Postiz integration list; post content and optional media come from row fields.",
   "main": "index.js",
   "scripts": {