ghost 4.22.3 → 4.25.0

package/core/server/web/parent/app.js

@@ -4,9 +4,14 @@ const express = require('../../../shared/express');
 const compress = require('compression');
 const mw = require('./middleware');
 const vhost = require('@tryghost/vhost-middleware');
-const vhostUtils = require('./vhost-utils');
 
-module.exports = function setupParentApp(options = {}) {
+/**
+ * @param {Object} options
+ * @param {Boolean} [options.start]
+ * @param {Boolean} [options.backend]
+ * @param {Boolean} [options.frontend]
+ */
+module.exports = function setupParentApp({start, frontend = true, backend = true}) {
     debug('ParentApp setup start');
     const parentApp = express('parent');
 
@@ -27,14 +32,17 @@ module.exports = function setupParentApp(options = {}) {
 
     // Mount the express apps on the parentApp
 
-    // ADMIN + API
-    const backendApp = require('./backend')();
-    parentApp.use(vhost(vhostUtils.getBackendHostArg(), backendApp));
-
-    // SITE + MEMBERS
-    const frontendApp = require('./frontend')(options);
-    parentApp.use(vhost(vhostUtils.getFrontendHostArg(), frontendApp));
+    if (backend) {
+        debug('Mounting bakcend: ADMIN + API');
+        const backendApp = require('./backend')();
+        parentApp.use(vhost(config.getBackendMountPath(), backendApp));
+    }
 
+    if (frontend) {
+        debug('Mounting frontend: SITE + MEMBERS');
+        const frontendApp = require('./frontend')({start});
+        parentApp.use(vhost(config.getFrontendMountPath(), frontendApp));
+    }
     debug('ParentApp setup end');
 
     return parentApp;

package/core/server/web/parent/frontend.js

@@ -16,7 +16,7 @@ module.exports = (options) => {
 
     // Force SSL if blog url is set to https. The redirects handling must happen before asset and page routing,
     // otherwise we serve assets/pages with http. This can cause mixed content warnings in the admin client.
-    frontendApp.use(shared.middlewares.urlRedirects.frontendSSLRedirect);
+    frontendApp.use(shared.middleware.urlRedirects.frontendSSLRedirect);
 
     frontendApp.lazyUse('/members', require('../members'));
     frontendApp.use('/', require('../../../frontend/web')(options));

package/core/server/web/shared/index.js

@@ -1,5 +1,5 @@
 module.exports = {
-    get middlewares() {
-        return require('./middlewares');
+    get middleware() {
+        return require('./middleware');
     }
 };

package/core/server/web/shared/middleware/error-handler.js

@@ -0,0 +1,224 @@
+const _ = require('lodash');
+const debug = require('@tryghost/debug')('error-handler');
+const errors = require('@tryghost/errors');
+const tpl = require('@tryghost/tpl');
+const sentry = require('../../../../shared/sentry');
+
+const messages = {
+    pageNotFound: 'Page not found',
+    resourceNotFound: 'Resource not found',
+    actions: {
+        images: {
+            upload: 'upload image'
+        }
+    },
+    userMessages: {
+        BookshelfRelationsError: 'Database error, cannot {action}.',
+        InternalServerError: 'Internal server error, cannot {action}.',
+        IncorrectUsageError: 'Incorrect usage error, cannot {action}.',
+        NotFoundError: 'Resource not found error, cannot {action}.',
+        BadRequestError: 'Request not understood error, cannot {action}.',
+        UnauthorizedError: 'Authorisation error, cannot {action}.',
+        NoPermissionError: 'Permission error, cannot {action}.',
+        ValidationError: 'Validation error, cannot {action}.',
+        UnsupportedMediaTypeError: 'Unsupported media error, cannot {action}.',
+        TooManyRequestsError: 'Too many requests error, cannot {action}.',
+        MaintenanceError: 'Server down for maintenance, cannot {action}.',
+        MethodNotAllowedError: 'Method not allowed, cannot {action}.',
+        RequestEntityTooLargeError: 'Request too large, cannot {action}.',
+        TokenRevocationError: 'Token is not available, cannot {action}.',
+        VersionMismatchError: 'Version mismatch error, cannot {action}.',
+        DataExportError: 'Error exporting content.',
+        DataImportError: 'Duplicated entry, cannot save {action}.',
+        DatabaseVersionError: 'Database version compatibility error, cannot {action}.',
+        EmailError: 'Error sending email!',
+        ThemeValidationError: 'Theme validation error, cannot {action}.',
+        HostLimitError: 'Host Limit error, cannot {action}.',
+        DisabledFeatureError: 'Theme validation error, the {{{helperName}}} helper is not available. Cannot {action}.',
+        UpdateCollisionError: 'Saving failed! Someone else is editing this post.'
+    }
+};
+
+const updateStack = (err) => {
+    let stackbits = err.stack.split(/\n/g);
+
+    // We build this up backwards, so we always insert at position 1
+
+    if (process.env.NODE_ENV === 'production' || err.statusCode === 404) {
+        // In production mode, remove the stack trace
+        stackbits.splice(1, stackbits.length - 1);
+    } else {
+        // In dev mode, clearly mark the strack trace
+        stackbits.splice(1, 0, `Stack Trace:`);
+    }
+
+    // Add in our custom cotext and help methods
+
+    if (err.help) {
+        stackbits.splice(1, 0, `${err.help}`);
+    }
+
+    if (err.context) {
+        stackbits.splice(1, 0, `${err.context}`);
+    }
+
+    return stackbits.join('\n');
+};
+
+/**
+ * Get an error ready to be shown the the user
+ */
+module.exports.prepareError = (err, req, res, next) => {
+    debug(err);
+
+    if (Array.isArray(err)) {
+        err = err[0];
+    }
+
+    if (!errors.utils.isGhostError(err)) {
+        // We need a special case for 404 errors
+        if (err.statusCode && err.statusCode === 404) {
+            err = new errors.NotFoundError({
+                err: err
+            });
+        } else if (err.stack.match(/node_modules\/handlebars\//)) {
+            // Temporary handling of theme errors from handlebars
+            // @TODO remove this when #10496 is solved properly
+            err = new errors.IncorrectUsageError({
+                err: err,
+                message: err.message,
+                statusCode: err.statusCode
+            });
+        } else {
+            err = new errors.InternalServerError({
+                err: err,
+                message: err.message,
+                statusCode: err.statusCode
+            });
+        }
+    }
+
+    // used for express logging middleware see core/server/app.js
+    req.err = err;
+
+    // alternative for res.status();
+    res.statusCode = err.statusCode;
+
+    err.stack = updateStack(err);
+
+    // never cache errors
+    res.set({
+        'Cache-Control': 'no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0'
+    });
+
+    next(err);
+};
+
+const jsonErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+    res.json({
+        errors: [{
+            message: err.message,
+            context: err.context,
+            help: err.help,
+            errorType: err.errorType,
+            errorDetails: err.errorDetails,
+            ghostErrorCode: err.ghostErrorCode
+        }]
+    });
+};
+
+const jsonErrorRendererV2 = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+    const userError = prepareUserMessage(err, req);
+
+    res.json({
+        errors: [{
+            message: userError.message || null,
+            context: userError.context || null,
+            type: err.errorType || null,
+            details: err.errorDetails || null,
+            property: err.property || null,
+            help: err.help || null,
+            code: err.code || null,
+            id: err.id || null
+        }]
+    });
+};
+
+const prepareUserMessage = (err, res) => {
+    const userError = {
+        message: err.message,
+        context: err.context
+    };
+
+    const docName = _.get(res, 'frameOptions.docName');
+    const method = _.get(res, 'frameOptions.method');
+
+    if (docName && method) {
+        let action;
+
+        const actionMap = {
+            browse: 'list',
+            read: 'read',
+            add: 'save',
+            edit: 'edit',
+            destroy: 'delete'
+        };
+
+        if (_.get(messages.actions, [docName, method])) {
+            action = tpl(messages.actions[docName][method]);
+        } else if (Object.keys(actionMap).includes(method)) {
+            let resource = docName;
+
+            if (method !== 'browse') {
+                resource = resource.replace(/s$/, '');
+            }
+
+            action = `${actionMap[method]} ${resource}`;
+        }
+
+        if (action) {
+            if (err.context) {
+                userError.context = `${err.message} ${err.context}`;
+            } else {
+                userError.context = err.message;
+            }
+
+            userError.message = tpl(messages.userMessages[err.name], {action: action});
+        }
+    }
+
+    return userError;
+};
+
+module.exports.resourceNotFound = (req, res, next) => {
+    next(new errors.NotFoundError({message: tpl(messages.resourceNotFound)}));
+};
+
+module.exports.pageNotFound = (req, res, next) => {
+    next(new errors.NotFoundError({message: tpl(messages.pageNotFound)}));
+};
+
+module.exports.handleJSONResponse = [
+    // Make sure the error can be served
+    module.exports.prepareError,
+    // Handle the error in Sentry
+    sentry.errorHandler,
+    // Render the error using JSON format
+    jsonErrorRenderer
+];
+
+module.exports.handleJSONResponseV2 = [
+    // Make sure the error can be served
+    module.exports.prepareError,
+    // Handle the error in Sentry
+    sentry.errorHandler,
+    // Render the error using JSON format
+    jsonErrorRendererV2
+];
+
+module.exports.handleHTMLResponse = [
+    // Make sure the error can be served
+    module.exports.prepareError,
+    // Handle the error in Sentry
+    sentry.errorHandler
+];

package/core/server/web/shared/{middlewares → middleware}/index.js

@@ -15,10 +15,6 @@ module.exports = {
         return require('./error-handler');
     },
 
-    get maintenance() {
-        return require('./maintenance');
-    },
-
     get prettyUrls() {
         return require('./pretty-urls');
     },

package/core/shared/config/defaults.json

@@ -15,7 +15,9 @@
     "privacy": false,
     "useMinFiles": true,
     "paths": {
-        "contentPath": "content/"
+        "contentPath": "content/",
+        "fixtures": "core/server/data/schema/fixtures/fixtures",
+        "assetSrc": "core/frontend/src"
     },
     "adapters": {
         "sso": {
@@ -127,5 +129,15 @@
     "portal": {
         "url": "https://unpkg.com/@tryghost/portal@~1.12.0/umd/portal.min.js",
         "version": "1.12"
+    },
+    "tenor": {
+        "publicReadOnlyApiKey": null,
+        "contentFilter": "off"
+    },
+    "opensea": {
+        "privateReadOnlyApiKey": null
+    },
+    "twitter": {
+        "privateReadOnlyToken": null
     }
 }

package/core/shared/config/helpers.js

@@ -1,4 +1,42 @@
 const path = require('path');
+const escapeRegExp = require('lodash/escapeRegExp');
+const {URL} = require('url');
+
+const DEFAULT_HOST_ARG = /.*/;
+
+const getHostInfo = (config) => {
+    const frontendHost = new URL(config.getSiteUrl()).hostname;
+
+    const backendHost = config.getAdminUrl() ? (new URL(config.getAdminUrl()).hostname) : '';
+    const hasSeparateBackendHost = backendHost && backendHost !== frontendHost;
+
+    return {
+        backendHost,
+        hasSeparateBackendHost
+    };
+};
+
+/**
+ *
+ * @returns {string|RegExp}
+ */
+const getBackendMountPath = function getFrontendMountPath() {
+    const {backendHost, hasSeparateBackendHost} = getHostInfo(this);
+
+    // with a separate admin url only serve on that host, otherwise serve on all hosts
+    return (hasSeparateBackendHost) && backendHost ? backendHost : DEFAULT_HOST_ARG;
+};
+
+/**
+ *
+ * @returns {string|RegExp}
+ */
+const getFrontendMountPath = function getFrontendMountPath() {
+    const {backendHost, hasSeparateBackendHost} = getHostInfo(this);
+
+    // with a separate admin url we adjust the frontend vhost to exclude requests to that host, otherwise serve on all hosts
+    return (hasSeparateBackendHost && backendHost) ? new RegExp(`^(?!${escapeRegExp(backendHost)}).*`) : DEFAULT_HOST_ARG;
+};
 
 /**
  * @callback isPrivacyDisabledFn
@@ -46,6 +84,8 @@ const getContentPath = function getContentPath(type) {
         return path.join(this.get('paths:contentPath'), 'data/');
     case 'settings':
         return path.join(this.get('paths:contentPath'), 'settings/');
+    case 'public':
+        return path.join(this.get('paths:contentPath'), 'public/');
     default:
         // new Error is allowed here, as we do not want config to depend on @tryghost/error
         // @TODO: revisit this decision when @tryghost/error is no longer dependent on all of ghost-ignition
@@ -62,4 +102,6 @@ const getContentPath = function getContentPath(type) {
 module.exports.bindAll = (nconf) => {
     nconf.isPrivacyDisabled = isPrivacyDisabled.bind(nconf);
     nconf.getContentPath = getContentPath.bind(nconf);
+    nconf.getBackendMountPath = getBackendMountPath.bind(nconf);
+    nconf.getFrontendMountPath = getFrontendMountPath.bind(nconf);
 };

package/core/shared/config/loader.js

@@ -41,8 +41,8 @@ function loadNconf(options) {
     // ## Config Methods
 
     // Expose dynamic utility methods
-    helpers.bindAll(nconf);
     urlHelpers.bindAll(nconf);
+    helpers.bindAll(nconf);
 
     // ## Sanitization
 

package/core/shared/labs.js

@@ -15,7 +15,8 @@ const messages = {
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
 const GA_FEATURES = [
-    'customThemeSettings'
+    'customThemeSettings',
+    'nftCard'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -33,11 +34,13 @@ const ALPHA_FEATURES = [
     'mediaAPI',
     'filesAPI',
     'membersAutoLogin',
-    'buttonCard',
     'calloutCard',
-    'nftCard',
     'accordionCard',
-    'gifsCard'
+    'fileCard',
+    'audioCard',
+    'videoCard',
+    'productCard',
+    'quoteStyles'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];
@@ -47,7 +50,7 @@ module.exports.getAll = () => {
     const labs = _.cloneDeep(settingsCache.get('labs')) || {};
 
     ALPHA_FEATURES.forEach((alphaKey) => {
-        if (labs[alphaKey] && !(config.get('enableDeveloperExperiments') || process.env.NODE_ENV.match(/^testing/))) {
+        if (labs[alphaKey] && !(config.get('enableDeveloperExperiments') || process.env.NODE_ENV.startsWith('test'))) {
             delete labs[alphaKey];
         }
     });
@@ -102,6 +105,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
     });
     errDetails.help = tpl(options.errorHelp || messages.errorHelp, {url: options.helpUrl});
 
+    // eslint-disable-next-line no-restricted-syntax
     logging.error(new errors.DisabledFeatureError(errDetails));
 
     const {SafeString} = require('express-hbs');

package/core/shared/sentry.js

@@ -18,7 +18,7 @@ if (sentryConfig && !sentryConfig.disabled) {
             shouldHandleError(error) {
                 // Sometimes non-Ghost issues will come into here but they won't
                 // have a statusCode so we should always handle them
-                if (!errors.utils.isIgnitionError(error)) {
+                if (!errors.utils.isGhostError(error)) {
                     return true;
                 }
 

package/loggingrc.js

@@ -1,25 +1,24 @@
 const config = require('./core/shared/config');
 const ghostVersion = require('@tryghost/version');
 
-module.exports = {
-    name: config.get('logging:name'),
-    env: config.get('env'),
-    path: config.get('logging:path') || config.getContentPath('logs'),
+// Config for logging
+const loggingConfig = config.get('logging') || {};
+
+if (!loggingConfig.path) {
+    loggingConfig.path = config.getContentPath('logs');
+}
+
+// Additional values used by logging
+loggingConfig.env = config.get('env');
+loggingConfig.domain = config.get('url');
+
+// Config for metrics
+loggingConfig.metrics = config.get('logging:metrics') || {};
+loggingConfig.metrics.metadata = {
+    // Undefined if unavailable
+    siteId: config.get('hostSettings:siteId'),
     domain: config.get('url'),
-    mode: config.get('logging:mode'),
-    level: config.get('logging:level'),
-    transports: config.get('logging:transports'),
-    metrics: {
-        transports: config.get('logging:metrics:transports'),
-        metadata: {
-            // Undefined if unavailable
-            siteId: config.get('hostSettings:siteId'),
-            domain: config.get('url'),
-            version: ghostVersion.safe
-        }
-    },
-    gelf: config.get('logging:gelf'),
-    loggly: config.get('logging:loggly'),
-    elasticsearch: config.get('logging:elasticsearch'),
-    rotation: config.get('logging:rotation')
+    version: ghostVersion.safe
 };
+
+module.exports = loggingConfig;