ghost 4.22.4 → 4.25.1

package/core/server/models/member-status-event.js

@@ -11,7 +11,9 @@ const MemberStatusEvent = ghostBookshelf.Model.extend({
     customQuery(qb, options) {
         if (options.aggregateStatusCounts) {
             if (options.limit || options.filter) {
-                throw new errors.IncorrectUsageError('aggregateStatusCounts does not work when passed a filter or limit');
+                throw new errors.IncorrectUsageError({
+                    message: 'aggregateStatusCounts does not work when passed a filter or limit'
+                });
             }
             const knex = ghostBookshelf.knex;
             return qb.clear('select')
@@ -46,11 +48,11 @@ const MemberStatusEvent = ghostBookshelf.Model.extend({
         return options;
     },
     async edit() {
-        throw new errors.IncorrectUsageError('Cannot edit MemberStatusEvent');
+        throw new errors.IncorrectUsageError({message: 'Cannot edit MemberStatusEvent'});
     },
 
     async destroy() {
-        throw new errors.IncorrectUsageError('Cannot destroy MemberStatusEvent');
+        throw new errors.IncorrectUsageError({message: 'Cannot destroy MemberStatusEvent'});
     }
 });
 

package/core/server/models/member-subscribe-event.js

@@ -11,7 +11,9 @@ const MemberSubscribeEvent = ghostBookshelf.Model.extend({
     customQuery(qb, options) {
         if (options.aggregateSubscriptionDeltas) {
             if (options.limit || options.filter) {
-                throw new errors.IncorrectUsageError('aggregateSubscriptionDeltas does not work when passed a filter or limit');
+                throw new errors.IncorrectUsageError({
+                    message: 'aggregateSubscriptionDeltas does not work when passed a filter or limit'
+                });
             }
             const knex = ghostBookshelf.knex;
             return qb.clear('select')
@@ -32,11 +34,15 @@ const MemberSubscribeEvent = ghostBookshelf.Model.extend({
         return options;
     },
     async edit() {
-        throw new errors.IncorrectUsageError('Cannot edit MemberSubscribeEvent');
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot edit MemberSubscribeEvent'
+        });
     },
 
     async destroy() {
-        throw new errors.IncorrectUsageError('Cannot destroy MemberSubscribeEvent');
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot destroy MemberSubscribeEvent'
+        });
     }
 });
 

package/core/server/models/relations/authors.js

@@ -324,7 +324,7 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                             .then(() => response);
                     })
                     .catch((err) => {
-                        throw new errors.GhostError({err: err});
+                        throw new errors.InternalServerError({err: err});
                     });
             });
 

package/core/server/models/settings.js

@@ -346,7 +346,7 @@ Settings = ghostBookshelf.Model.extend({
             );
 
             if (validationErrors.length) {
-                throw new errors.ValidationError(validationErrors.join('\n'));
+                throw new errors.ValidationError({message: validationErrors.join('\n')});
             }
         },
         async labs(model) {

package/core/server/services/auth/passwordreset.js

@@ -148,7 +148,7 @@ function doReset(options, tokenParts, settingsAPI) {
             return Promise.reject(err);
         })
         .catch((err) => {
-            if (errors.utils.isIgnitionError(err)) {
+            if (errors.utils.isGhostError(err)) {
                 return Promise.reject(err);
             }
             return Promise.reject(new errors.UnauthorizedError({err: err}));

package/core/server/services/auth/setup.js

@@ -59,7 +59,7 @@ async function setupUser(userData) {
     const owner = await models.User.findOne({role: 'Owner', status: 'all'});
 
     if (!owner) {
-        throw new errors.GhostError({
+        throw new errors.InternalServerError({
             message: tpl(messages.setupUnableToRun)
         });
     }

package/core/server/services/email-analytics/jobs/index.js

@@ -12,7 +12,7 @@ module.exports = {
             !hasScheduled &&
             config.get('emailAnalytics') &&
             config.get('backgroundJobs:emailAnalytics') &&
-            !process.env.NODE_ENV.match(/^testing/)
+            !process.env.NODE_ENV.startsWith('test')
         ) {
             // Don't register email analytics job if we have no emails,
             // processor usage from many sites spinning up threads can be high.

package/core/server/services/mega/mega.js

@@ -131,7 +131,7 @@ const transformEmailRecipientFilter = (emailRecipientFilter, {errorProperty = 'e
     // `paid` and `free` were swapped out for NQL filters in 4.5.0, we shouldn't see them here now
     case 'paid':
     case 'free':
-        throw new errors.GhostError({
+        throw new errors.InternalServerError({
             message: tpl(messages.unexpectedFilterError, {
                 property: errorProperty,
                 value: emailRecipientFilter
@@ -140,7 +140,7 @@ const transformEmailRecipientFilter = (emailRecipientFilter, {errorProperty = 'e
     case 'all':
         return 'subscribed:true';
     case 'none':
-        throw new errors.GhostError({
+        throw new errors.InternalServerError({
             message: tpl(messages.noneFilterError, {
                 property: errorProperty
             })
@@ -352,7 +352,7 @@ async function sendEmailJob({emailModel, options}) {
             error: errorMessage
         }, {patch: true});
 
-        throw new errors.GhostError({
+        throw new errors.InternalServerError({
             err: error,
             context: tpl(messages.sendEmailRequestFailed)
         });
@@ -416,7 +416,9 @@ function partitionMembersBySegment(memberRows, segments) {
             segmentedMemberRows = memberRows.filter(member => member.status !== 'free');
             memberRows = memberRows.filter(member => member.status === 'free');
         } else {
-            throw new errors.ValidationError(tpl(messages.invalidSegment));
+            throw new errors.ValidationError({
+                message: tpl(messages.invalidSegment)
+            });
         }
 
         partitions[memberSegment] = segmentedMemberRows;

package/core/server/services/mega/template.js

@@ -157,6 +157,16 @@ blockquote {
     letter-spacing: -0.2px;
 }
 
+blockquote.kg-blockquote-alt {
+    border-left: 0 none;
+    padding-left: 50px;
+    padding-right: 50px;
+    margin-bottom: 2.5em;
+    text-align: center;
+    font-size: 1.2em;
+    color: #999999;
+}
+
 blockquote p {
     margin: 0.8em 0;
     font-size: 1em;
@@ -557,52 +567,56 @@ figure blockquote p {
     padding-bottom: 4px;
 }
 
-.kg-card-callout {
+.kg-callout-card {
     display: flex;
     margin: 0 0 1.5em 0;
     padding: 20px 28px;
     border-radius: 3px;
 }
 
-.kg-card-callout p {
+.kg-callout-card p {
     margin: 0
 }
 
-.kg-card-callout-grey {
+.kg-callout-card-grey {
     background: #eef0f2;
 }
 
-.kg-card-callout-white {
+.kg-callout-card-white {
     background: #fff;
     box-shadow: inset 0 0 0 1px #dddedf;
 }
 
-.kg-card-callout-blue {
+.kg-callout-card-blue {
     background: #E9F6FB;
 }
 
-.kg-card-callout-green {
+.kg-callout-card-green {
     background: #E8F8EA;
 }
 
-.kg-card-callout-yellow {
+.kg-callout-card-yellow {
     background: #FCF4E3;
 }
 
-.kg-card-callout-red {
+.kg-callout-card-red {
     background: #FBE9E9;
 }
 
-.kg-card-callout-pink {
+.kg-callout-card-pink {
     background: #FCEEF8;
 }
 
-.kg-card-callout-purple {
+.kg-callout-card-purple {
     background: #F2EDFC;
 }
 
-.kg-card-callout-accent {
-    background: var(--ghost-accent-color);
+.kg-callout-card-accent {
+    background: ${templateSettings.accentColor || '#15212A'};
+    color: #fff;
+}
+
+.kg-callout-card-accent a {
     color: #fff;
 }
 
@@ -890,6 +904,11 @@ figure blockquote p {
         padding-left: 15px !important;
     }
 
+    table.body blockquote.kg-blockquote-alt {
+        padding-left: 50px !important;
+        margin-bottom: 2.5em !important;
+    }
+
     table.body blockquote + * {
         margin-top: 1.5em !important;
     }

package/core/server/services/members/api.js

@@ -6,6 +6,7 @@ const mail = require('../mail');
 const models = require('../../models');
 const signinEmail = require('./emails/signin');
 const signupEmail = require('./emails/signup');
+const signupPaidEmail = require('./emails/signup-paid');
 const subscribeEmail = require('./emails/subscribe');
 const updateEmail = require('./emails/updateEmail');
 const SingleUseTokenProvider = require('./SingleUseTokenProvider');
@@ -49,6 +50,8 @@ function createApiInstance(config) {
                     return `📫 Confirm your subscription to ${siteTitle}`;
                 case 'signup':
                     return `🙌 Complete your sign up to ${siteTitle}!`;
+                case 'signup-paid':
+                    return `🙌 Thank you for signing up to ${siteTitle}!`;
                 case 'updateEmail':
                     return `📫 Confirm your email update for ${siteTitle}!`;
                 case 'signin':
@@ -93,6 +96,23 @@ function createApiInstance(config) {
                         Sent to ${email}
                         If you did not make this request, you can simply delete this message. You will not be signed up, and no account will be created for you.
                         `;
+                case 'signup-paid':
+                    return `
+                        Thank you for subscribing to ${siteTitle}!
+
+                        Tap the link below to be automatically signed in:
+
+                        ${url}
+
+                        For your security, the link will expire in 24 hours time.
+
+                        See you soon!
+
+                        ---
+
+                        Sent to ${email}
+                        Thank you for subscribing to ${siteTitle}!
+                        `;
                 case 'updateEmail':
                     return `
                             Hey there,
@@ -139,6 +159,8 @@ function createApiInstance(config) {
                     return subscribeEmail({url, email, siteTitle, accentColor, siteDomain, siteUrl});
                 case 'signup':
                     return signupEmail({url, email, siteTitle, accentColor, siteDomain, siteUrl});
+                case 'signup-paid':
+                    return signupPaidEmail({url, email, siteTitle, accentColor, siteDomain, siteUrl});
                 case 'updateEmail':
                     return updateEmail({url, email, siteTitle, accentColor, siteDomain, siteUrl});
                 case 'signin':

package/core/server/services/members/config.js

@@ -98,7 +98,7 @@ class MembersConfigProvider {
      */
     getStripeKeys(type) {
         if (type !== 'direct' && type !== 'connect') {
-            throw new errors.IncorrectUsageError(tpl(messages.incorrectKeyType));
+            throw new errors.IncorrectUsageError({message: tpl(messages.incorrectKeyType)});
         }
 
         const secretKey = this._settingsCache.get(`stripe_${type === 'connect' ? 'connect_' : ''}secret_key`);

package/core/server/services/members/emails/signup-paid.js

@@ -0,0 +1,168 @@
+module.exports = ({siteTitle, email, url, accentColor = '#15212A', siteDomain, siteUrl}) => `
+<!doctype html>
+   <html>
+  <head>
+    <meta name="viewport" content="width=device-width">
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+    <title>🙌 Thank you for signing up to ${siteTitle}!</title>
+    <style>
+    /* -------------------------------------
+        RESPONSIVE AND MOBILE FRIENDLY STYLES
+    ------------------------------------- */
+    @media only screen and (max-width: 620px) {
+      table[class=body] h1 {
+        font-size: 28px !important;
+        margin-bottom: 10px !important;
+      }
+      table[class=body] p,
+            table[class=body] ul,
+            table[class=body] ol,
+            table[class=body] td,
+            table[class=body] span,
+            table[class=body] a {
+        font-size: 16px !important;
+      }
+      table[class=body] .wrapper,
+            table[class=body] .article {
+        padding: 10px !important;
+      }
+      table[class=body] .content {
+        padding: 0 !important;
+      }
+      table[class=body] .container {
+        padding: 0 !important;
+        width: 100% !important;
+      }
+      table[class=body] .main {
+        border-left-width: 0 !important;
+        border-radius: 0 !important;
+        border-right-width: 0 !important;
+      }
+      table[class=body] .btn table {
+        width: 100% !important;
+      }
+      table[class=body] .btn a {
+        width: 100% !important;
+      }
+      table[class=body] .img-responsive {
+        height: auto !important;
+        max-width: 100% !important;
+        width: auto !important;
+      }
+      table[class=body] p[class=small],
+      table[class=body] a[class=small] {
+        font-size: 11px !important;
+      }
+    }
+    /* -------------------------------------
+        PRESERVE THESE STYLES IN THE HEAD
+    ------------------------------------- */
+    @media all {
+      .ExternalClass {
+        width: 100%;
+      }
+      .ExternalClass,
+            .ExternalClass p,
+            .ExternalClass span,
+            .ExternalClass font,
+            .ExternalClass td,
+            .ExternalClass div {
+        line-height: 100%;
+      }
+      .recipient-link a {
+        color: inherit !important;
+        font-family: inherit !important;
+        font-size: inherit !important;
+        font-weight: inherit !important;
+        line-height: inherit !important;
+        text-decoration: none !important;
+      }
+      #MessageViewBody a {
+        color: inherit;
+        text-decoration: none;
+        font-size: inherit;
+        font-family: inherit;
+        font-weight: inherit;
+        line-height: inherit;
+      }
+    }
+    hr {
+      border-width: 0;
+      height: 0;
+      margin-top: 34px;
+      margin-bottom: 34px;
+      border-bottom-width: 1px;
+      border-bottom-color: #EEF5F8;
+    }
+    a {
+      color: #3A464C;
+    }
+    </style>
+  </head>
+  <body class="" style="background-color: #FFFFFF; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; -webkit-font-smoothing: antialiased; font-size: 14px; line-height: 1.5em; margin: 0; padding: 0; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;">
+    <table border="0" cellpadding="0" cellspacing="0" class="body" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background-color: #FFFFFF;">
+      <tr>
+        <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">&nbsp;</td>
+        <td class="container" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; display: block; margin: 0 auto; max-width: 540px; padding: 10px; width: 540px;">
+          <div class="content" style="box-sizing: border-box; display: block; margin: 0 auto; max-width: 600px; padding: 30px 20px;">
+
+            <!-- START CENTERED WHITE CONTAINER -->
+            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">Complete signup for ${siteTitle}!</span>
+            <table class="main" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background: #ffffff; border-radius: 8px;">
+
+              <!-- START MAIN CONTENT AREA -->
+              <tr>
+                <td class="wrapper" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; box-sizing: border-box;">
+                  <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
+                    <tr>
+                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 20px; color: #15212A; font-weight: bold; line-height: 25px; margin: 0; margin-bottom: 15px;">Thank you for subscribing to ${siteTitle}</p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 25px; margin: 0; margin-bottom: 32px;">Tap the link below to be automatically signed in:</p>
+                        <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box;">
+                          <tbody>
+                            <tr>
+                              <td align="left" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; padding-bottom: 35px;">
+                                <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: auto;">
+                                  <tbody>
+                                    <tr>
+                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: ${accentColor}; border-radius: 5px; text-align: center;"> <a href="${url}" target="_blank" style="display: inline-block; color: #ffffff; background-color: ${accentColor}; border: solid 1px ${accentColor}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: ${accentColor};">Confirm signup</a> </td>
+                                    </tr>
+                                  </tbody>
+                                </table>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 25px; margin: 0; margin-bottom: 25px;">For your security, the link will expire in 24 hours time.</p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 25px; margin: 0; margin-bottom: 30px;">See you soon!</p>
+                        <hr/>
+                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; line-height: 25px; margin: 0; margin-bottom: 5px;">You can also copy & paste this URL into your browser:</p>
+                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top: 0; color: #3A464C;">${url}</p>
+                      </td>
+                    </tr>
+                  </table>
+                </td>
+              </tr>
+
+              <!-- START FOOTER -->
+              <tr>
+                <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-top: 2px;">
+                  <p class="small" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; line-height: 18px; font-size: 11px; color: #738A94; font-weight: normal; margin: 0; margin-bottom: 2px;">This message was sent from <a class="small" href="${siteUrl}" style="text-decoration: underline; color: #738A94; font-size: 11px;">${siteDomain}</a> to <a class="small" href="mailto:${email}" style="text-decoration: underline; color: #738A94; font-size: 11px;">${email}</a></p>
+                </td>
+              </tr>
+
+              <!-- END FOOTER -->
+
+            <!-- END MAIN CONTENT AREA -->
+            </table>
+
+          <!-- END CENTERED WHITE CONTAINER -->
+          </div>
+        </td>
+        <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">&nbsp;</td>
+      </tr>
+    </table>
+  </body>
+</html>
+`;
+

package/core/server/services/members/service.js

@@ -159,12 +159,16 @@ const membersService = {
             }
 
             if (stripeService.api.configured && stripeService.api.mode === 'live') {
-                throw new errors.IncorrectUsageError(tpl(messages.noLiveKeysInDevelopment));
+                throw new errors.IncorrectUsageError({
+                    message: tpl(messages.noLiveKeysInDevelopment)
+                });
             }
         } else {
             const siteUrl = urlUtils.getSiteUrl();
             if (!/^https/.test(siteUrl) && stripeService.api.configured) {
-                throw new errors.IncorrectUsageError(tpl(messages.sslRequiredForStripe));
+                throw new errors.IncorrectUsageError({
+                    message: tpl(messages.sslRequiredForStripe)
+                });
             }
         }
         if (!membersApi) {

package/core/server/services/members/stripe-connect.js

@@ -63,7 +63,7 @@ async function getStripeConnectTokenData(encodedData, getSessionProp) {
     const state = await getSessionProp(STATE_PROP);
 
     if (state !== data.s) {
-        throw new errors.NoPermissionError(tpl(messages.incorrectState));
+        throw new errors.NoPermissionError({message: tpl(messages.incorrectState)});
     }
 
     return {
@@ -81,7 +81,9 @@ function checkCanConnect() {
     const siteUrlUsingSSL = /^https/.test(siteUrl);
     const cannotConnectToStripe = productionMode && !siteUrlUsingSSL;
     if (cannotConnectToStripe) {
-        throw new errors.BadRequestError('Cannot connect to stripe unless site is using https://');
+        throw new errors.BadRequestError({
+            message: 'Cannot connect to stripe unless site is using https://'
+        });
     }
 }
 

package/core/server/services/nft-oembed.js

@@ -35,8 +35,13 @@ class NFTOEmbedProvider {
         if (!match) {
             return null;
         }
+        const headers = {};
+        if (this.dependencies.config.apiKey) {
+            headers['X-API-KEY'] = this.dependencies.config.apiKey;
+        }
         const result = await externalRequest(`https://api.opensea.io/api/v1/asset/${transaction}/${asset}/?format=json`, {
-            json: true
+            json: true,
+            headers
         });
         return {
             version: '1.0',

package/core/server/services/oembed.js

@@ -1,6 +1,7 @@
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const logging = require('@tryghost/logging');
+const sentry = require('../../shared/sentry');
 const {extract, hasProvider} = require('oembed-parser');
 const cheerio = require('cheerio');
 const _ = require('lodash');
@@ -63,6 +64,7 @@ class OEmbed {
      */
     constructor({config, externalRequest}) {
         this.config = config;
+
         /** @type {IExternalRequest} */
         this.externalRequest = async (url, requestConfig) => {
             if (this.isIpOrLocalhost(url)) {
@@ -74,6 +76,7 @@ class OEmbed {
             }
             return response;
         };
+
         /** @type {ICustomProvider[]} */
         this.customProviders = [];
     }
@@ -108,27 +111,6 @@ class OEmbed {
         }
     }
 
-    /**
-     * @param {string} url
-     */
-    errorHandler(url) {
-        /**
-         * @param {Error|errors.GhostError} err
-         */
-        return async (err) => {
-            // allow specific validation errors through for better error messages
-            if (errors.utils.isIgnitionError(err) && err.errorType === 'ValidationError') {
-                throw err;
-            }
-
-            // log the real error because we're going to throw a generic "Unknown provider" error
-            logging.error(new errors.GhostError({err}));
-
-            // default to unknown provider to avoid leaking any app specifics
-            return this.unknownProvider(url);
-        };
-    }
-
     async fetchBookmarkData(url) {
         const metascraper = require('metascraper')([
             require('metascraper-url')(),
@@ -147,7 +129,14 @@ class OEmbed {
         const response = await this.externalRequest(url, {cookieJar});
 
         const html = response.body;
-        scraperResponse = await metascraper({html, url});
+        try {
+            scraperResponse = await metascraper({html, url});
+        } catch (err) {
+            // Log to avoid being blind to errors happenning in metascraper
+            sentry.captureException(err);
+            logging.error(err);
+            return this.unknownProvider(url);
+        }
 
         const metadata = Object.assign({}, scraperResponse, {
             thumbnail: scraperResponse.image,
@@ -300,10 +289,13 @@ class OEmbed {
      * @returns {Promise<Object>}
      */
     async fetchOembedDataFromUrl(url, type) {
-        let data;
-
         try {
             const urlObject = new URL(url);
+
+            // Trimming solves the difference of url validation between `new URL(url)`
+            // and metascraper.
+            url = url.trim();
+
             for (const provider of this.customProviders) {
                 if (await provider.canSupportRequest(urlObject)) {
                     const result = await provider.getOEmbedData(urlObject, this.externalRequest);
@@ -313,23 +305,39 @@ class OEmbed {
                 }
             }
 
+            // fetch only bookmark when explicitly requested
             if (type === 'bookmark') {
                 return this.fetchBookmarkData(url);
             }
 
-            data = await this.fetchOembedData(url);
+            // attempt to fetch oembed
+            let data = await this.fetchOembedData(url);
 
+            // fallback to bookmark when we can't get oembed
             if (!data && !type) {
                 data = await this.fetchBookmarkData(url);
             }
 
+            // couldn't get anything, throw a validation error
             if (!data) {
-                data = await this.unknownProvider(url);
+                return this.unknownProvider(url);
             }
 
             return data;
-        } catch (e) {
-            return this.errorHandler(url);
+        } catch (err) {
+            // allow specific validation errors through for better error messages
+            if (errors.utils.isGhostError(err) && err.errorType === 'ValidationError') {
+                throw err;
+            }
+
+            // log the real error because we're going to throw a generic "Unknown provider" error
+            logging.error(new errors.InternalServerError({
+                message: 'Encountered error when fetching oembed',
+                err
+            }));
+
+            // default to unknown provider to avoid leaking any app specifics
+            return this.unknownProvider(url);
         }
     }
 }

package/core/server/services/permissions/can-this.js

@@ -128,7 +128,7 @@ CanThisResult.prototype.beginCheck = function (context) {
     context = parseContext(context);
 
     if (actionsMap.empty()) {
-        throw new errors.GhostError({message: tpl(messages.noActionsMapFoundError)});
+        throw new errors.InternalServerError({message: tpl(messages.noActionsMapFoundError)});
     }
 
     // Kick off loading of user permissions if necessary