From d355ce38a7bf7bde2997704770a29bfcb936da30 Mon Sep 17 00:00:00 2001
From: Do Siki <dosiki852@gmail.com>
Date: Mon, 17 Aug 2026 17:25:51 +0200
Subject: [PATCH] fix: make CMS publish environment explicit

---
 content-editor.js                       | 9 +++++----
 scripts/test-content-editor-security.js | 1 +
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/content-editor.js b/content-editor.js
index 0f06c34..a8783d9 100644
--- a/content-editor.js
+++ b/content-editor.js
@@ -450,11 +450,12 @@ if (toast) setTimeout(() => toast.remove(), 3500);
 
 const CMS_USER = process.env.CMS_USER;
 const CMS_PASS = process.env.CMS_PASS;
+const CMS_DEPLOY_ENV = process.env.CMS_DEPLOY_ENV;
 const CSRF_TOKEN = process.env.CMS_CSRF_TOKEN || crypto.randomBytes(32).toString('hex');
 const rateLimits = new Map();
 
 function securityConfigIsValid() {
-  return Boolean(CMS_USER && CMS_PASS);
+  return Boolean(CMS_USER && CMS_PASS && ['staging', 'production'].includes(CMS_DEPLOY_ENV));
 }
 
 function getClientAddress(req) {
@@ -595,8 +596,8 @@ const server = http.createServer(async (req, res) => {
           res.end(JSON.stringify({ ok: false, error: stderr || stdout || error.message }));
         }
       } else {
-        // If a deploy.sh script exists, run it optionally in background
-        exec('cd ../../../ && ./deploy.sh production > deploy.log 2>&1 &');
+        // Deploy only the explicitly configured environment; never default to production.
+        exec(`cd ../../../ && ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1 &`);
         writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'ok' });
         res.end(JSON.stringify({ ok: true, output: stdout }));
       }
@@ -619,7 +620,7 @@ const server = http.createServer(async (req, res) => {
 
 if (require.main === module) {
   if (!securityConfigIsValid()) {
-    throw new Error('CMS_USER és CMS_PASS nélkül a Content Editor nem indítható el.');
+    throw new Error('CMS_USER, CMS_PASS és érvényes CMS_DEPLOY_ENV nélkül a Content Editor nem indítható el.');
   }
   server.listen(PORT, '127.0.0.1', () => {
     console.log(`\n✅ mozdIT Content Editor fut: http://localhost:${PORT}\n`);
diff --git a/scripts/test-content-editor-security.js b/scripts/test-content-editor-security.js
index 1bacf86..fb2704d 100644
--- a/scripts/test-content-editor-security.js
+++ b/scripts/test-content-editor-security.js
@@ -4,6 +4,7 @@ const assert = require('assert/strict');
 
 process.env.CMS_USER = 'test-editor';
 process.env.CMS_PASS = 'not-a-real-secret';
+process.env.CMS_DEPLOY_ENV = 'staging';
 const {
   hasValidCredentials,
   hasValidCsrfToken,