fix: make CMS publish environment explicit

content-editor.js

@@ -450,11 +450,12 @@ if (toast) setTimeout(() => toast.remove(), 3500);
 
 const CMS_USER = process.env.CMS_USER;
 const CMS_PASS = process.env.CMS_PASS;
+const CMS_DEPLOY_ENV = process.env.CMS_DEPLOY_ENV;
 const CSRF_TOKEN = process.env.CMS_CSRF_TOKEN || crypto.randomBytes(32).toString('hex');
 const rateLimits = new Map();
 
 function securityConfigIsValid() {
-  return Boolean(CMS_USER && CMS_PASS);
+  return Boolean(CMS_USER && CMS_PASS && ['staging', 'production'].includes(CMS_DEPLOY_ENV));
 }
 
 function getClientAddress(req) {
@@ -595,8 +596,8 @@ const server = http.createServer(async (req, res) => {
           res.end(JSON.stringify({ ok: false, error: stderr || stdout || error.message }));
         }
       } else {
-        // If a deploy.sh script exists, run it optionally in background
+        // Deploy only the explicitly configured environment; never default to production.
-        exec('cd ../../../ && ./deploy.sh production > deploy.log 2>&1 &');
+        exec(`cd ../../../ && ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1 &`);
         writeAudit('publish_finished', { clientAddress, user: CMS_USER, result: 'ok' });
         res.end(JSON.stringify({ ok: true, output: stdout }));
       }
@@ -619,7 +620,7 @@ const server = http.createServer(async (req, res) => {
 
 if (require.main === module) {
   if (!securityConfigIsValid()) {
-    throw new Error('CMS_USER és CMS_PASS nélkül a Content Editor nem indítható el.');
+    throw new Error('CMS_USER, CMS_PASS és érvényes CMS_DEPLOY_ENV nélkül a Content Editor nem indítható el.');
   }
   server.listen(PORT, '127.0.0.1', () => {
     console.log(`\n✅ mozdIT Content Editor fut: http://localhost:${PORT}\n`);

scripts/test-content-editor-security.js

@@ -4,6 +4,7 @@ const assert = require('assert/strict');
 
 process.env.CMS_USER = 'test-editor';
 process.env.CMS_PASS = 'not-a-real-secret';
+process.env.CMS_DEPLOY_ENV = 'staging';
 const {
   hasValidCredentials,
   hasValidCsrfToken,