ghost 4.22.3 → 4.25.0

package/core/frontend/web/middleware/serve-public-file.js

@@ -11,20 +11,41 @@ const messages = {
     fileNotFound: 'File not found'
 };
 
-function createPublicFileMiddleware(file, type, maxAge) {
-    let content;
-    const publicFilePath = config.get('paths').publicFilePath;
-    const filePath = file.match(/^public/) ? path.join(publicFilePath, file.replace(/^public/, '')) : path.join(publicFilePath, file);
+/**
+ * If this request has a ?v= param, make sure the cache has the same key
+ *
+ * @param {Object} req
+ * @param {Object} cache
+ * @returns {boolean}
+ */
+function matchCacheKey(req, cache) {
+    if (req.query && req.query.v && cache && cache.key) {
+        return req.query.v === cache.key;
+    }
+
+    return true;
+}
+
+function createPublicFileMiddleware(location, file, mime, maxAge) {
+    let cache;
+    // These files are provided by Ghost, and therefore live inside of the core folder
+    const staticFilePath = config.get('paths').publicFilePath;
+    // These files are built on the fly, and must be saved in the content folder
+    const builtFilePath = config.getContentPath('public');
+
+    let locationPath = location === 'static' ? staticFilePath : builtFilePath;
+
+    const filePath = file.match(/^public/) ? path.join(locationPath, file.replace(/^public/, '')) : path.join(locationPath, file);
     const blogRegex = /(\{\{blog-url\}\})/g;
 
     return function servePublicFileMiddleware(req, res, next) {
-        if (content) {
-            res.writeHead(200, content.headers);
-            return res.end(content.body);
+        if (cache && matchCacheKey(req, cache)) {
+            res.writeHead(200, cache.headers);
+            return res.end(cache.body);
         }
 
         // send image files directly and let express handle content-length, etag, etc
-        if (type.match(/^image/)) {
+        if (mime.match(/^image/)) {
             return res.sendFile(filePath, (err) => {
                 if (err && err.status === 404) {
                     // ensure we're triggering basic asset 404 and not a templated 404
@@ -57,29 +78,31 @@ function createPublicFileMiddleware(file, type, maxAge) {
 
             let str = buf.toString();
 
-            if (type === 'text/xsl' || type === 'text/plain' || type === 'application/javascript') {
+            if (mime === 'text/xsl' || mime === 'text/plain' || mime === 'application/javascript') {
                 str = str.replace(blogRegex, urlUtils.urlFor('home', true).replace(/\/$/, ''));
             }
 
-            content = {
+            cache = {
                 headers: {
-                    'Content-Type': type,
+                    'Content-Type': mime,
                     'Content-Length': Buffer.from(str).length,
                     ETag: `"${crypto.createHash('md5').update(str, 'utf8').digest('hex')}"`,
                     'Cache-Control': `public, max-age=${maxAge}`
                 },
-                body: str
+                body: str,
+                key: req.query && req.query.v ? req.query.v : null
             };
-            res.writeHead(200, content.headers);
-            res.end(content.body);
+
+            res.writeHead(200, cache.headers);
+            res.end(cache.body);
         });
     };
 }
 
 // ### servePublicFile Middleware
 // Handles requests to robots.txt and favicon.ico (and caches them)
-function servePublicFile(file, type, maxAge) {
-    const publicFileMiddleware = createPublicFileMiddleware(file, type, maxAge);
+function servePublicFile(location, file, type, maxAge) {
+    const publicFileMiddleware = createPublicFileMiddleware(location, file, type, maxAge);
 
     return function servePublicFileMiddleware(req, res, next) {
         if (req.path === '/' + file) {

package/core/frontend/web/site.js

@@ -104,15 +104,15 @@ module.exports = function setupSiteApp(options = {}) {
     siteApp.use(mw.serveFavicon());
 
     // Serve sitemap.xsl file
-    siteApp.use(mw.servePublicFile('sitemap.xsl', 'text/xsl', constants.ONE_DAY_S));
+    siteApp.use(mw.servePublicFile('static', 'sitemap.xsl', 'text/xsl', constants.ONE_DAY_S));
 
     // Serve stylesheets for default templates
-    siteApp.use(mw.servePublicFile('public/ghost.css', 'text/css', constants.ONE_HOUR_S));
-    siteApp.use(mw.servePublicFile('public/ghost.min.css', 'text/css', constants.ONE_YEAR_S));
+    siteApp.use(mw.servePublicFile('static', 'public/ghost.css', 'text/css', constants.ONE_HOUR_S));
+    siteApp.use(mw.servePublicFile('static', 'public/ghost.min.css', 'text/css', constants.ONE_YEAR_S));
 
     // Card assets
-    siteApp.use(mw.servePublicFile('public/cards.min.css', 'text/css', constants.ONE_YEAR_S));
-    siteApp.use(mw.servePublicFile('public/cards.min.js', 'text/js', constants.ONE_YEAR_S));
+    siteApp.use(mw.servePublicFile('built', 'public/cards.min.css', 'text/css', constants.ONE_YEAR_S));
+    siteApp.use(mw.servePublicFile('built', 'public/cards.min.js', 'text/js', constants.ONE_YEAR_S));
 
     // Serve blog images using the storage adapter
     siteApp.use(STATIC_IMAGE_URL_PREFIX, mw.handleImageSizes, storage.getStorage('images').serve());
@@ -147,26 +147,23 @@ module.exports = function setupSiteApp(options = {}) {
     debug('Themes done');
 
     // Serve robots.txt if not found in theme
-    siteApp.use(mw.servePublicFile('robots.txt', 'text/plain', constants.ONE_HOUR_S));
+    siteApp.use(mw.servePublicFile('static', 'robots.txt', 'text/plain', constants.ONE_HOUR_S));
 
     // site map - this should probably be refactored to be an internal app
     sitemapHandler(siteApp);
     debug('Internal apps done');
 
-    // send 503 error page in case of maintenance
-    siteApp.use(shared.middlewares.maintenance);
-
     // Add in all trailing slashes & remove uppercase
     // must happen AFTER asset loading and BEFORE routing
-    siteApp.use(shared.middlewares.prettyUrls);
+    siteApp.use(shared.middleware.prettyUrls);
 
     // ### Caching
     siteApp.use(function (req, res, next) {
         // Site frontend is cacheable UNLESS request made by a member or blog is in private mode
         if (req.member || res.isPrivateBlog) {
-            return shared.middlewares.cacheControl('private')(req, res, next);
+            return shared.middleware.cacheControl('private')(req, res, next);
         } else {
-            return shared.middlewares.cacheControl('public', {maxAge: config.get('caching:frontend:maxAge')})(req, res, next);
+            return shared.middleware.cacheControl('public', {maxAge: config.get('caching:frontend:maxAge')})(req, res, next);
         }
     });
 
@@ -179,7 +176,7 @@ module.exports = function setupSiteApp(options = {}) {
     siteApp.use(SiteRouter);
 
     // ### Error handlers
-    siteApp.use(shared.middlewares.errorHandler.pageNotFound);
+    siteApp.use(shared.middleware.errorHandler.pageNotFound);
     config.get('apps:internal').forEach((appName) => {
         const app = require(path.join(config.get('paths').internalAppPath, appName));
 
@@ -187,7 +184,7 @@ module.exports = function setupSiteApp(options = {}) {
             app.setupErrorHandling(siteApp);
         }
     });
-    siteApp.use(shared.middlewares.errorHandler.handleThemeResponse);
+    siteApp.use(mw.errorHandler.handleThemeResponse);
 
     debug('Site setup end');
 

package/core/server/adapters/scheduling/SchedulingDefault.js

@@ -307,7 +307,7 @@ SchedulingDefault.prototype._pingUrl = function (object) {
                 this._pingUrl(object);
             }, this.retryTimeoutInMs);
 
-            logging.error(new errors.GhostError({
+            logging.error(new errors.InternalServerError({
                 err,
                 context: 'Retrying...',
                 level: 'normal'
@@ -316,7 +316,7 @@ SchedulingDefault.prototype._pingUrl = function (object) {
             return;
         }
 
-        logging.error(new errors.GhostError({
+        logging.error(new errors.InternalServerError({
             err,
             level: 'critical'
         }));

package/core/server/adapters/storage/LocalStorageBase.js

@@ -147,7 +147,7 @@ class LocalStorageBase extends StorageBase {
                         return next(new errors.NoPermissionError({err: err}));
                     }
 
-                    return next(new errors.GhostError({err: err}));
+                    return next(new errors.InternalServerError({err: err}));
                 }
 
                 next();
@@ -196,7 +196,7 @@ class LocalStorageBase extends StorageBase {
                         return reject(new errors.NoPermissionError({err: err}));
                     }
 
-                    return reject(new errors.GhostError({
+                    return reject(new errors.InternalServerError({
                         err: err,
                         message: tpl(this.errorMessages.cannotRead, {file: options.path})
                     }));

package/core/server/api/canary/authentication.js

@@ -163,7 +163,7 @@ module.exports = {
                     options = Object.assign(options, {context: {internal: true}});
                     return auth.passwordreset.doReset(options, tokenParts, api.settings)
                         .then((params) => {
-                            web.shared.middlewares.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
+                            web.shared.middleware.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
                             return params;
                         });
                 });

package/core/server/api/canary/db.js

@@ -62,7 +62,7 @@ module.exports = {
             return Promise.resolve()
                 .then(() => exporter.doExport({include: frame.options.withRelated}))
                 .catch((err) => {
-                    return Promise.reject(new errors.GhostError({err: err}));
+                    return Promise.reject(new errors.InternalServerError({err: err}));
                 });
         }
     },
@@ -124,7 +124,7 @@ module.exports = {
                             }, {concurrency: 100});
                         })
                         .catch((err) => {
-                            throw new errors.GhostError({
+                            throw new errors.InternalServerError({
                                 err: err
                             });
                         });

package/core/server/api/canary/media.js

@@ -23,8 +23,9 @@ module.exports = {
 
     uploadThumbnail: {
         permissions: false,
-        options: [
-            'url'
+        data: [
+            'url',
+            'ref'
         ],
         async query(frame) {
             const mediaStorage = storage.getStorage('media');

package/core/server/api/canary/oembed.js

@@ -3,9 +3,24 @@ const externalRequest = require('../../lib/request-external');
 
 const OEmbed = require('../../services/oembed');
 const oembed = new OEmbed({config, externalRequest});
+
 const NFT = require('../../services/nft-oembed');
-const nft = new NFT();
+const nft = new NFT({
+    config: {
+        apiKey: config.get('opensea').privateReadOnlyApiKey
+    }
+});
+
+const Twitter = require('../../services/twitter-embed');
+const twitter = new Twitter({
+    config: {
+        bearerToken: config.get('twitter').privateReadOnlyToken
+    },
+    logging: require('@tryghost/logging')
+});
+
 oembed.registerProvider(nft);
+oembed.registerProvider(twitter);
 
 module.exports = {
     docName: 'oembed',

package/core/server/api/canary/session.js

@@ -42,7 +42,7 @@ const session = {
                 });
             });
         }).catch(async (err) => {
-            if (!errors.utils.isIgnitionError(err)) {
+            if (!errors.utils.isGhostError(err)) {
                 throw new errors.UnauthorizedError({
                     message: tpl(messages.accessDenied),
                     err

package/core/server/api/canary/slugs.js

@@ -43,7 +43,7 @@ module.exports = {
             return models.Base.Model.generateSlug(allowedTypes[frame.options.type], frame.data.name, {status: 'all'})
                 .then((slug) => {
                     if (!slug) {
-                        return Promise.reject(new errors.GhostError({
+                        return Promise.reject(new errors.InternalServerError({
                             message: tpl(messages.couldNotGenerateSlug)
                         }));
                     }

package/core/server/api/canary/utils/permissions.js

@@ -66,11 +66,11 @@ const nonePublicAuth = (apiConfig, frame) => {
             return Promise.reject(err);
         }
 
-        if (errors.utils.isIgnitionError(err)) {
+        if (errors.utils.isGhostError(err)) {
             return Promise.reject(err);
         }
 
-        return Promise.reject(new errors.GhostError({
+        return Promise.reject(new errors.InternalServerError({
             err: err
         }));
     });

package/core/server/api/canary/utils/serializers/output/config.js

@@ -1,5 +1,4 @@
 const _ = require('lodash');
-const labs = require('../../../../../../shared/labs');
 const debug = require('@tryghost/debug')('api:canary:utils:serializers:output:config');
 
 module.exports = {
@@ -18,13 +17,10 @@ module.exports = {
             'stripeDirect',
             'mailgunIsConfigured',
             'emailAnalytics',
-            'hostSettings'
+            'hostSettings',
+            'tenor'
         ];
 
-        if (labs.isSet('gifsCard')) {
-            keys.push('tenorApiKey');
-        }
-
         frame.response = {
             config: _.pick(data, keys)
         };

package/core/server/api/v2/authentication.js

@@ -145,7 +145,7 @@ module.exports = {
                     options = Object.assign(options, {context: {internal: true}});
                     return auth.passwordreset.doReset(options, tokenParts, api.settings)
                         .then((params) => {
-                            web.shared.middlewares.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
+                            web.shared.middleware.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
                             return params;
                         });
                 });

package/core/server/api/v2/db.js

@@ -51,7 +51,7 @@ module.exports = {
             return Promise.resolve()
                 .then(() => exporter.doExport({include: frame.options.withRelated}))
                 .catch((err) => {
-                    return Promise.reject(new errors.GhostError({err: err}));
+                    return Promise.reject(new errors.InternalServerError({err: err}));
                 });
         }
     },
@@ -107,7 +107,7 @@ module.exports = {
                             }, {concurrency: 100});
                         })
                         .catch((err) => {
-                            throw new errors.GhostError({
+                            throw new errors.InternalServerError({
                                 err: err
                             });
                         });

package/core/server/api/v2/session.js

@@ -42,7 +42,7 @@ const session = {
                 });
             });
         }).catch(async (err) => {
-            if (!errors.utils.isIgnitionError(err)) {
+            if (!errors.utils.isGhostError(err)) {
                 throw new errors.UnauthorizedError({
                     message: tpl(messages.authAccessDenied),
                     err

package/core/server/api/v2/slugs.js

@@ -40,7 +40,7 @@ module.exports = {
             return models.Base.Model.generateSlug(allowedTypes[frame.options.type], frame.data.name, {status: 'all'})
                 .then((slug) => {
                     if (!slug) {
-                        return Promise.reject(new errors.GhostError({
+                        return Promise.reject(new errors.InternalServerError({
                             message: tpl(messages.couldNotGenerateSlug)
                         }));
                     }

package/core/server/api/v2/utils/permissions.js

@@ -62,11 +62,11 @@ const nonePublicAuth = (apiConfig, frame) => {
             return Promise.reject(err);
         }
 
-        if (errors.utils.isIgnitionError(err)) {
+        if (errors.utils.isGhostError(err)) {
             return Promise.reject(err);
         }
 
-        return Promise.reject(new errors.GhostError({
+        return Promise.reject(new errors.InternalServerError({
             err: err
         }));
     });

package/core/server/api/v3/authentication.js

@@ -146,7 +146,7 @@ module.exports = {
                     options = Object.assign(options, {context: {internal: true}});
                     return auth.passwordreset.doReset(options, tokenParts, api.settings)
                         .then((params) => {
-                            web.shared.middlewares.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
+                            web.shared.middleware.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
                             return params;
                         });
                 });

package/core/server/api/v3/db.js

@@ -62,7 +62,7 @@ module.exports = {
             return Promise.resolve()
                 .then(() => exporter.doExport({include: frame.options.withRelated}))
                 .catch((err) => {
-                    return Promise.reject(new errors.GhostError({err: err}));
+                    return Promise.reject(new errors.InternalServerError({err: err}));
                 });
         }
     },
@@ -118,7 +118,7 @@ module.exports = {
                             }, {concurrency: 100});
                         })
                         .catch((err) => {
-                            throw new errors.GhostError({
+                            throw new errors.InternalServerError({
                                 err: err
                             });
                         });

package/core/server/api/v3/session.js

@@ -42,7 +42,7 @@ const session = {
                 });
             });
         }).catch(async (err) => {
-            if (!errors.utils.isIgnitionError(err)) {
+            if (!errors.utils.isGhostError(err)) {
                 throw new errors.UnauthorizedError({
                     message: tpl(messages.accessDenied),
                     err

package/core/server/api/v3/slugs.js

@@ -39,7 +39,7 @@ module.exports = {
             return models.Base.Model.generateSlug(allowedTypes[frame.options.type], frame.data.name, {status: 'all'})
                 .then((slug) => {
                     if (!slug) {
-                        return Promise.reject(new errors.GhostError({message: tpl(messages.couldNotGenerateSlug)}));
+                        return Promise.reject(new errors.InternalServerError({message: tpl(messages.couldNotGenerateSlug)}));
                     }
                     return slug;
                 });

package/core/server/api/v3/utils/permissions.js

@@ -66,11 +66,11 @@ const nonePublicAuth = (apiConfig, frame) => {
             return Promise.reject(err);
         }
 
-        if (errors.utils.isIgnitionError(err)) {
+        if (errors.utils.isGhostError(err)) {
             return Promise.reject(err);
         }
 
-        return Promise.reject(new errors.GhostError({
+        return Promise.reject(new errors.InternalServerError({
             err: err
         }));
     });

package/core/server/data/db/connection.js

@@ -17,6 +17,13 @@ function configure(dbConfig) {
         dbConfig.pool = {
             afterCreate(conn, cb) {
                 conn.run('PRAGMA foreign_keys = ON', cb);
+
+                // These two are meant to improve performance at the cost of reliability
+                // Should be safe for tests. We add them here and leave them on
+                if (config.get('env').startsWith('testing')) {
+                    conn.run('PRAGMA synchronous = OFF;');
+                    conn.run('PRAGMA journal_mode = TRUNCATE;');
+                }
             }
         };
 

package/core/server/data/db/state-manager.js

@@ -59,8 +59,8 @@ class DatabaseStateManager {
 
             // CASE: database connection errors, unknown cases
             let errorToThrow = error;
-            if (!errors.utils.isIgnitionError(errorToThrow)) {
-                errorToThrow = new errors.GhostError({message: errorToThrow.message, err: errorToThrow});
+            if (!errors.utils.isGhostError(errorToThrow)) {
+                errorToThrow = new errors.InternalServerError({message: errorToThrow.message, err: errorToThrow});
             }
 
             throw errorToThrow;
@@ -94,8 +94,8 @@ class DatabaseStateManager {
             }
         } catch (error) {
             let errorToThrow = error;
-            if (!errors.utils.isIgnitionError(error)) {
-                errorToThrow = new errors.GhostError({message: errorToThrow.message, err: errorToThrow});
+            if (!errors.utils.isGhostError(error)) {
+                errorToThrow = new errors.InternalServerError({message: errorToThrow.message, err: errorToThrow});
             }
 
             throw errorToThrow;

package/core/server/data/exporter/export-filename.js

@@ -26,7 +26,7 @@ const exportFileName = async function exportFileName(options) {
 
         return title + 'ghost.' + datetime + '.json';
     } catch (err) {
-        logging.error(new errors.GhostError({err: err}));
+        logging.error(new errors.InternalServerError({err: err}));
         return 'ghost.' + datetime + '.json';
     }
 };

package/core/server/data/importer/handlers/json.js

@@ -30,7 +30,7 @@ JSONHandler = {
                 // if importData follows JSON-API format `{ db: [exportedData] }`
                 if (_.keys(importData).length === 1) {
                     if (!importData.db || !Array.isArray(importData.db)) {
-                        throw new errors.GhostError({
+                        throw new errors.InternalServerError({
                             message: tpl(messages.invalidJsonFormat)
                         });
                     }

package/core/server/data/importer/import-manager.js

@@ -121,7 +121,7 @@ class ImportManager {
 
         fs.remove(self.fileToDelete, function (err) {
             if (err) {
-                logging.error(new errors.GhostError({
+                logging.error(new errors.InternalServerError({
                     err: err,
                     context: tpl(messages.couldNotCleanUpFile.error),
                     help: tpl(messages.couldNotCleanUpFile.context)

package/core/server/data/importer/importers/data/base.js

@@ -145,7 +145,7 @@ class Base {
                     });
                 }
             } else {
-                if (!errors.utils.isIgnitionError(err)) {
+                if (!errors.utils.isGhostError(err)) {
                     err = new errors.DataImportError({
                         message: err.message,
                         context: JSON.stringify(obj),

package/core/server/data/importer/importers/data/data-importer.js

@@ -112,7 +112,7 @@ DataImporter = {
                 });
             });
 
-            sequence(ops)
+            return sequence(ops)
                 .then(function () {
                     results.forEach(function (promise) {
                         if (!promise.isFulfilled()) {
@@ -121,9 +121,9 @@ DataImporter = {
                     });
 
                     if (errors.length === 0) {
-                        transacting.commit();
+                        return;
                     } else {
-                        transacting.rollback(errors);
+                        throw errors;
                     }
                 });
         }).then(function () {

package/core/server/data/migrations/init/2-create-fixtures.js

@@ -1,26 +1,9 @@
-const Promise = require('bluebird');
-const _ = require('lodash');
-const fixtures = require('../../schema/fixtures');
-const logging = require('@tryghost/logging');
+const {fixtureManager} = require('../../schema/fixtures');
 
 module.exports.config = {
     transaction: true
 };
 
-module.exports.up = async (options) => {
-    const localOptions = _.merge({
-        context: {internal: true},
-        migrating: true
-    }, options);
-
-    await Promise.mapSeries(fixtures.models, async (model) => {
-        logging.info('Model: ' + model.name);
-
-        await fixtures.utils.addFixturesForModel(model, localOptions);
-    });
-
-    await Promise.mapSeries(fixtures.relations, async (relation) => {
-        logging.info('Relation: ' + relation.from.model + ' to ' + relation.to.model);
-        await fixtures.utils.addFixturesForRelation(relation, localOptions);
-    });
+module.exports.up = async function insertFixtures(options) {
+    return await fixtureManager.addAllFixtures(options);
 };

package/core/server/data/migrations/utils.js

@@ -143,7 +143,7 @@ function addPermissionToRole(config) {
             }).first();
 
             if (!permission) {
-                throw new errors.GhostError({
+                throw new errors.InternalServerError({
                     message: tpl(messages.permissionRoleActionError, {
                         action: 'add',
                         permission: config.permission,
@@ -158,7 +158,7 @@ function addPermissionToRole(config) {
             }).first();
 
             if (!role) {
-                throw new errors.GhostError({
+                throw new errors.InternalServerError({
                     message: tpl(messages.permissionRoleActionError, {
                         action: 'add',
                         permission: config.permission,

package/core/server/data/migrations/versions/1.21/1-add-contributor-role.js

@@ -1,19 +1,19 @@
 const merge = require('lodash/merge');
-const utils = require('../../../schema/fixtures/utils');
+const {fixtureManager} = require('../../../schema/fixtures');
 const models = require('../../../../models');
 const permissions = require('../../../../services/permissions');
 const logging = require('@tryghost/logging');
 const _private = {};
 
 _private.addRole = function addRole(options) {
-    const contributorRole = utils.findModelFixtureEntry('Role', {name: 'Contributor'});
+    const contributorRole = fixtureManager.findModelFixtureEntry('Role', {name: 'Contributor'});
     const message = 'Adding "Contributor" role to roles table';
 
     return models.Role.findOne({name: contributorRole.name}, options)
         .then((role) => {
             if (!role) {
                 logging.info(message);
-                return utils.addFixturesForModel({name: 'Role', entries: [contributorRole]}, options);
+                return fixtureManager.addFixturesForModel({name: 'Role', entries: [contributorRole]}, options);
             }
 
             logging.warn(message);
@@ -22,10 +22,10 @@ _private.addRole = function addRole(options) {
 };
 
 _private.addContributorPermissions = function getPermissions(options) {
-    const relations = utils.findRelationFixture('Role', 'Permission');
+    const relations = fixtureManager.findRelationFixture('Role', 'Permission');
     const message = 'Adding permissions_roles fixtures for the contributor role';
 
-    return utils.addFixturesForRelation({
+    return fixtureManager.addFixturesForRelation({
         from: relations.from,
         to: relations.to,
         entries: {