AI_Slop/sc-postiz-poster
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

More security issues addressed.

Browse source
This commit is contained in:
Scott Duensing 2026-07-01 20:05:05 -05:00
parent 8742d02022
commit 7dba032703
3 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
lib/action.js
View file

@ -72,9 +72,18 @@ const buildPostPayload = (configuration, row, mediaIds, nowIso) => {
.map((s) => s.trim()) .map((s) => s.trim())
.filter(Boolean); .filter(Boolean);
const value = [{ content, image: mediaIds.map((id) => ({ id })) }]; const value = [{ content, image: mediaIds.map((id) => ({ id })) }];
const date = configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField let date = nowIso;
? new Date(row[configuration.scheduleField]).toISOString() if (configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField) {
: nowIso; // The schedule field is free-text row data; a blank or non-date value makes
// new Date(...).toISOString() throw an unhandled RangeError that fails the
// action with a cryptic message. Validate and fail with an actionable one.
const raw = row[configuration.scheduleField];
const parsed = new Date(raw);
if (Number.isNaN(parsed.getTime())) {
throw new Error(`${PLUGIN_NAME}: schedule field "${configuration.scheduleField}" is not a valid date (${JSON.stringify(raw)}); set a parseable date to schedule this post`);
}
date = parsed.toISOString();
}
return { return {
type: configuration.when, type: configuration.when,

2
lib/constants.js
View file

@ -1,7 +1,7 @@
// Compile-time constants for the postiz-poster plugin. // Compile-time constants for the postiz-poster plugin.
const PLUGIN_NAME = "postiz-poster"; const PLUGIN_NAME = "postiz-poster";
const PLUGIN_VERSION = "0.0.1"; const PLUGIN_VERSION = "0.0.2";
// Postiz public REST API. The surface is identical for self-hosted and cloud; // Postiz public REST API. The surface is identical for self-hosted and cloud;
// only the base URL (plugin config) differs. Endpoint paths below are appended // only the base URL (plugin config) differs. Endpoint paths below are appended

2
package.json
View file

@ -1,6 +1,6 @@
{ {
"name": "postiz-poster", "name": "postiz-poster",
"version": "0.0.1", "version": "0.0.2",
"description": "Saltcorn plugin: publish table rows to social networks (Mastodon, Bluesky, X, LinkedIn, Facebook, Instagram, Threads, and more) through a Postiz instance -- self-hosted or cloud -- via a single per-trigger action. Channels are chosen from the live Postiz integration list; post content and optional media come from row fields.", "description": "Saltcorn plugin: publish table rows to social networks (Mastodon, Bluesky, X, LinkedIn, Facebook, Instagram, Threads, and more) through a Postiz instance -- self-hosted or cloud -- via a single per-trigger action. Channels are chosen from the live Postiz integration list; post content and optional media come from row fields.",
"main": "index.js", "main": "index.js",
"scripts": { "scripts": {