More security issues addressed.

lib/action.js

@@ -72,9 +72,18 @@ const buildPostPayload = (configuration, row, mediaIds, nowIso) => {
         .map((s) => s.trim())
         .filter(Boolean);
     const value = [{ content, image: mediaIds.map((id) => ({ id })) }];
-    const date  = configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField
-        ? new Date(row[configuration.scheduleField]).toISOString()
-        : nowIso;
+    let date = nowIso;
+    if (configuration.when === POST_TYPES.SCHEDULE && configuration.scheduleField) {
+        // The schedule field is free-text row data; a blank or non-date value makes
+        // new Date(...).toISOString() throw an unhandled RangeError that fails the
+        // action with a cryptic message. Validate and fail with an actionable one.
+        const raw    = row[configuration.scheduleField];
+        const parsed = new Date(raw);
+        if (Number.isNaN(parsed.getTime())) {
+            throw new Error(`${PLUGIN_NAME}: schedule field "${configuration.scheduleField}" is not a valid date (${JSON.stringify(raw)}); set a parseable date to schedule this post`);
+        }
+        date = parsed.toISOString();
+    }
 
     return {
         type:  configuration.when,

lib/constants.js

@@ -1,7 +1,7 @@
 // Compile-time constants for the postiz-poster plugin.
 
 const PLUGIN_NAME    = "postiz-poster";
-const PLUGIN_VERSION = "0.0.1";
+const PLUGIN_VERSION = "0.0.2";
 
 // Postiz public REST API. The surface is identical for self-hosted and cloud;
 // only the base URL (plugin config) differs. Endpoint paths below are appended

package.json

@@ -1,6 +1,6 @@
 {
   "name": "postiz-poster",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Saltcorn plugin: publish table rows to social networks (Mastodon, Bluesky, X, LinkedIn, Facebook, Instagram, Threads, and more) through a Postiz instance -- self-hosted or cloud -- via a single per-trigger action. Channels are chosen from the live Postiz integration list; post content and optional media come from row fields.",
   "main": "index.js",
   "scripts": {