ghost 4.22.4 → 4.25.1

package/core/server/web/oauth/app.js

@@ -2,7 +2,6 @@ const debug = require('@tryghost/debug')('web:oauth:app');
 const {URL} = require('url');
 const express = require('../../../shared/express');
 const urlUtils = require('../../../shared/url-utils');
-const shared = require('../shared');
 const settingsCache = require('../../../shared/settings-cache');
 const models = require('../../models');
 const auth = require('../../services/auth');
@@ -24,9 +23,6 @@ module.exports = function setupOAuthApp() {
     }
     oauthApp.use(labsMiddleware);
 
-    // send 503 json response in case of maintenance
-    oauthApp.use(shared.middleware.maintenance);
-
     /**
      * Configure the passport.authenticate middleware
      * We need to configure it on each request because clientId and secret

package/core/server/web/parent/app.js

@@ -5,7 +5,13 @@ const compress = require('compression');
 const mw = require('./middleware');
 const vhost = require('@tryghost/vhost-middleware');
 
-module.exports = function setupParentApp(options = {}) {
+/**
+ * @param {Object} options
+ * @param {Boolean} [options.start]
+ * @param {Boolean} [options.backend]
+ * @param {Boolean} [options.frontend]
+ */
+module.exports = function setupParentApp({start, frontend = true, backend = true}) {
     debug('ParentApp setup start');
     const parentApp = express('parent');
 
@@ -26,14 +32,17 @@ module.exports = function setupParentApp(options = {}) {
 
     // Mount the express apps on the parentApp
 
-    // ADMIN + API
-    const backendApp = require('./backend')();
-    parentApp.use(vhost(config.getBackendMountPath(), backendApp));
-
-    // SITE + MEMBERS
-    const frontendApp = require('./frontend')(options);
-    parentApp.use(vhost(config.getFrontendMountPath(), frontendApp));
+    if (backend) {
+        debug('Mounting bakcend: ADMIN + API');
+        const backendApp = require('./backend')();
+        parentApp.use(vhost(config.getBackendMountPath(), backendApp));
+    }
 
+    if (frontend) {
+        debug('Mounting frontend: SITE + MEMBERS');
+        const frontendApp = require('./frontend')({start});
+        parentApp.use(vhost(config.getFrontendMountPath(), frontendApp));
+    }
     debug('ParentApp setup end');
 
     return parentApp;

package/core/server/web/shared/middleware/error-handler.js

@@ -1,16 +1,10 @@
-const hbs = require('express-hbs');
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('error-handler');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
-const config = require('../../../../shared/config');
-const helpers = require('../../../../frontend/services/routing/helpers');
 const sentry = require('../../../../shared/sentry');
 
 const messages = {
-    oopsErrorTemplateHasError: 'Oops, seems there is an error in the error template.',
-    encounteredError: 'Encountered the error: ',
-    whilstTryingToRender: 'whilst trying to render an error page for the error: ',
     pageNotFound: 'Page not found',
     resourceNotFound: 'Resource not found',
     actions: {
@@ -45,36 +39,44 @@ const messages = {
     }
 };
 
-const escapeExpression = hbs.Utils.escapeExpression;
-const _private = {};
-const errorHandler = {};
+const updateStack = (err) => {
+    let stackbits = err.stack.split(/\n/g);
 
-/**
- * This is a bare minimum setup, which allows us to render the error page
- * It uses the {{asset}} helper, and nothing more
- */
-_private.createHbsEngine = () => {
-    const engine = hbs.create();
-    engine.registerHelper('asset', require('../../../../frontend/helpers/asset'));
+    // We build this up backwards, so we always insert at position 1
+
+    if (process.env.NODE_ENV === 'production' || err.statusCode === 404) {
+        // In production mode, remove the stack trace
+        stackbits.splice(1, stackbits.length - 1);
+    } else {
+        // In dev mode, clearly mark the strack trace
+        stackbits.splice(1, 0, `Stack Trace:`);
+    }
+
+    // Add in our custom cotext and help methods
 
-    return engine.express4();
+    if (err.help) {
+        stackbits.splice(1, 0, `${err.help}`);
+    }
+
+    if (err.context) {
+        stackbits.splice(1, 0, `${err.context}`);
+    }
+
+    return stackbits.join('\n');
 };
 
 /**
  * Get an error ready to be shown the the user
- *
- * @TODO: support multiple errors within one single error, see https://github.com/TryGhost/Ghost/issues/7116#issuecomment-252231809
  */
-_private.prepareError = (err, req, res, next) => {
+module.exports.prepareError = (err, req, res, next) => {
     debug(err);
 
     if (Array.isArray(err)) {
         err = err[0];
     }
 
-    if (!errors.utils.isIgnitionError(err)) {
+    if (!errors.utils.isGhostError(err)) {
         // We need a special case for 404 errors
-        // @TODO look at adding this to the GhostError class
         if (err.statusCode && err.statusCode === 404) {
             err = new errors.NotFoundError({
                 err: err
@@ -88,7 +90,7 @@ _private.prepareError = (err, req, res, next) => {
                 statusCode: err.statusCode
             });
         } else {
-            err = new errors.GhostError({
+            err = new errors.InternalServerError({
                 err: err,
                 message: err.message,
                 statusCode: err.statusCode
@@ -102,6 +104,8 @@ _private.prepareError = (err, req, res, next) => {
     // alternative for res.status();
     res.statusCode = err.statusCode;
 
+    err.stack = updateStack(err);
+
     // never cache errors
     res.set({
         'Cache-Control': 'no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0'
@@ -110,7 +114,7 @@ _private.prepareError = (err, req, res, next) => {
     next(err);
 };
 
-_private.JSONErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+const jsonErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
     res.json({
         errors: [{
             message: err.message,
@@ -123,7 +127,24 @@ _private.JSONErrorRenderer = (err, req, res, next) => { // eslint-disable-line n
     });
 };
 
-_private.prepareUserMessage = (err, res) => {
+const jsonErrorRendererV2 = (err, req, res, next) => { // eslint-disable-line no-unused-vars
+    const userError = prepareUserMessage(err, req);
+
+    res.json({
+        errors: [{
+            message: userError.message || null,
+            context: userError.context || null,
+            type: err.errorType || null,
+            details: err.errorDetails || null,
+            property: err.property || null,
+            help: err.help || null,
+            code: err.code || null,
+            id: err.id || null
+        }]
+    });
+};
+
+const prepareUserMessage = (err, res) => {
     const userError = {
         message: err.message,
         context: err.context
@@ -169,161 +190,35 @@ _private.prepareUserMessage = (err, res) => {
     return userError;
 };
 
-_private.JSONErrorRendererV2 = (err, req, res, next) => { // eslint-disable-line no-unused-vars
-    const userError = _private.prepareUserMessage(err, req);
-
-    res.json({
-        errors: [{
-            message: userError.message || null,
-            context: userError.context || null,
-            type: err.errorType || null,
-            details: err.errorDetails || null,
-            property: err.property || null,
-            help: err.help || null,
-            code: err.code || null,
-            id: err.id || null
-        }]
-    });
-};
-
-_private.ErrorFallbackMessage = err => `<h1>${tpl(messages.oopsErrorTemplateHasError)}</h1>
-     <p>${tpl(messages.encounteredError)}</p>
-     <pre>${escapeExpression(err.message || err)}</pre>
-     <br ><p>${tpl(messages.whilstTryingToRender)}</p>
-     ${err.statusCode} <pre>${escapeExpression(err.message || err)}</pre>`;
-
-_private.ThemeErrorRenderer = (err, req, res, next) => {
-    // If the error code is explicitly set to STATIC_FILE_NOT_FOUND,
-    // Skip trying to render an HTML error, and move on to the basic error renderer
-    // We do this because customised 404 templates could reference the image that's missing
-    // A better long term solution might be to do this based on extension
-    if (err.code === 'STATIC_FILE_NOT_FOUND') {
-        return next(err);
-    }
-
-    // Renderer begin
-    // Format Data
-    const data = {
-        message: err.message,
-        // @deprecated Remove in Ghost 5.0
-        code: err.statusCode,
-        statusCode: err.statusCode,
-        errorDetails: err.errorDetails || []
-    };
-
-    // Template
-    // @TODO: very dirty !!!!!!
-    helpers.templates.setTemplate(req, res);
-
-    // It can be that something went wrong with the theme or otherwise loading handlebars
-    // This ensures that no matter what res.render will work here
-    // @TODO: split the error handler for assets, admin & theme to refactor this away
-    if (_.isEmpty(req.app.engines)) {
-        res._template = 'error';
-        req.app.engine('hbs', _private.createHbsEngine());
-        req.app.set('view engine', 'hbs');
-        req.app.set('views', config.get('paths').defaultViews);
-    }
-
-    // @TODO use renderer here?!
-    // Render Call - featuring an error handler for what happens if rendering fails
-    res.render(res._template, data, (_err, html) => {
-        if (!_err) {
-            return res.send(html);
-        }
-
-        // re-attach new error e.g. error template has syntax error or misusage
-        req.err = _err;
-
-        // And then try to explain things to the user...
-        // Cheat and output the error using handlebars escapeExpression
-        return res.status(500).send(_private.ErrorFallbackMessage(_err));
-    });
-};
-
-_private.HTMLErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
-    const data = {
-        message: err.message,
-        statusCode: err.statusCode,
-        errorDetails: err.errorDetails || []
-    };
-
-    // e.g. if you serve the admin /ghost and Ghost returns a 503 because it generates the urls at the moment.
-    // This ensures that no matter what res.render will work here
-    // @TODO: put to prepare error function?
-    if (_.isEmpty(req.app.engines)) {
-        res._template = 'error';
-        req.app.engine('hbs', _private.createHbsEngine());
-        req.app.set('view engine', 'hbs');
-        req.app.set('views', config.get('paths').defaultViews);
-    }
-
-    res.render('error', data, (_err, html) => {
-        if (!_err) {
-            return res.send(html);
-        }
-
-        // re-attach new error e.g. error template has syntax error or misusage
-        req.err = _err;
-
-        // And then try to explain things to the user...
-        // Cheat and output the error using handlebars escapeExpression
-        return res.status(500).send(_private.ErrorFallbackMessage(_err));
-    });
-};
-
-_private.BasicErrorRenderer = (err, req, res, next) => { // eslint-disable-line no-unused-vars
-    return res.send(res.statusCode + ' ' + err.message);
-};
-
-errorHandler.resourceNotFound = (req, res, next) => {
-    // TODO, handle unknown resources & methods differently, so that we can also produce
-    // 405 Method Not Allowed
+module.exports.resourceNotFound = (req, res, next) => {
     next(new errors.NotFoundError({message: tpl(messages.resourceNotFound)}));
 };
 
-errorHandler.pageNotFound = (req, res, next) => {
+module.exports.pageNotFound = (req, res, next) => {
     next(new errors.NotFoundError({message: tpl(messages.pageNotFound)}));
 };
 
-errorHandler.handleJSONResponse = [
+module.exports.handleJSONResponse = [
     // Make sure the error can be served
-    _private.prepareError,
+    module.exports.prepareError,
     // Handle the error in Sentry
     sentry.errorHandler,
     // Render the error using JSON format
-    _private.JSONErrorRenderer
+    jsonErrorRenderer
 ];
 
-errorHandler.handleJSONResponseV2 = [
+module.exports.handleJSONResponseV2 = [
     // Make sure the error can be served
-    _private.prepareError,
+    module.exports.prepareError,
     // Handle the error in Sentry
     sentry.errorHandler,
     // Render the error using JSON format
-    _private.JSONErrorRendererV2
+    jsonErrorRendererV2
 ];
 
-errorHandler.handleHTMLResponse = [
+module.exports.handleHTMLResponse = [
     // Make sure the error can be served
-    _private.prepareError,
+    module.exports.prepareError,
     // Handle the error in Sentry
-    sentry.errorHandler,
-    // Render the error using HTML format
-    _private.HTMLErrorRenderer,
-    // Fall back to basic if HTML is not explicitly accepted
-    _private.BasicErrorRenderer
+    sentry.errorHandler
 ];
-
-errorHandler.handleThemeResponse = [
-    // Make sure the error can be served
-    _private.prepareError,
-    // Handle the error in Sentry
-    sentry.errorHandler,
-    // Render the error using theme template
-    _private.ThemeErrorRenderer,
-    // Fall back to basic if HTML is not explicitly accepted
-    _private.BasicErrorRenderer
-];
-
-module.exports = errorHandler;

package/core/server/web/shared/middleware/index.js

@@ -15,10 +15,6 @@ module.exports = {
         return require('./error-handler');
     },
 
-    get maintenance() {
-        return require('./maintenance');
-    },
-
     get prettyUrls() {
         return require('./pretty-urls');
     },

package/core/shared/config/defaults.json

@@ -131,7 +131,13 @@
         "version": "1.12"
     },
     "tenor": {
-        "apiKey": null,
+        "publicReadOnlyApiKey": null,
         "contentFilter": "off"
+    },
+    "opensea": {
+        "privateReadOnlyApiKey": null
+    },
+    "twitter": {
+        "privateReadOnlyToken": null
     }
 }

package/core/shared/labs.js

@@ -15,7 +15,8 @@ const messages = {
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
 const GA_FEATURES = [
-    'customThemeSettings'
+    'customThemeSettings',
+    'nftCard'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -33,11 +34,14 @@ const ALPHA_FEATURES = [
     'mediaAPI',
     'filesAPI',
     'membersAutoLogin',
-    'buttonCard',
     'calloutCard',
-    'nftCard',
     'accordionCard',
-    'gifsCard'
+    'fileCard',
+    'audioCard',
+    'videoCard',
+    'productCard',
+    'quoteStyles',
+    'beforeAfterCard'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];
@@ -47,7 +51,7 @@ module.exports.getAll = () => {
     const labs = _.cloneDeep(settingsCache.get('labs')) || {};
 
     ALPHA_FEATURES.forEach((alphaKey) => {
-        if (labs[alphaKey] && !(config.get('enableDeveloperExperiments') || process.env.NODE_ENV.match(/^testing/))) {
+        if (labs[alphaKey] && !(config.get('enableDeveloperExperiments') || process.env.NODE_ENV.startsWith('test'))) {
             delete labs[alphaKey];
         }
     });
@@ -102,6 +106,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
     });
     errDetails.help = tpl(options.errorHelp || messages.errorHelp, {url: options.helpUrl});
 
+    // eslint-disable-next-line no-restricted-syntax
     logging.error(new errors.DisabledFeatureError(errDetails));
 
     const {SafeString} = require('express-hbs');

package/core/shared/sentry.js

@@ -18,7 +18,7 @@ if (sentryConfig && !sentryConfig.disabled) {
             shouldHandleError(error) {
                 // Sometimes non-Ghost issues will come into here but they won't
                 // have a statusCode so we should always handle them
-                if (!errors.utils.isIgnitionError(error)) {
+                if (!errors.utils.isGhostError(error)) {
                     return true;
                 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "4.22.4",
+  "version": "4.25.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -55,56 +55,57 @@
   "dependencies": {
     "@nexes/nql": "0.6.0",
     "@sentry/node": "6.15.0",
-    "@tryghost/adapter-manager": "0.2.18",
+    "@tryghost/adapter-manager": "0.2.24",
     "@tryghost/admin-api-schema": "2.6.1",
-    "@tryghost/bookshelf-plugins": "0.3.4",
-    "@tryghost/bootstrap-socket": "0.2.13",
+    "@tryghost/bookshelf-plugins": "0.3.5",
+    "@tryghost/bootstrap-socket": "0.2.14",
     "@tryghost/color-utils": "0.1.5",
     "@tryghost/config-url-helpers": "0.1.3",
     "@tryghost/constants": "1.0.0",
     "@tryghost/custom-theme-settings-service": "0.3.1",
     "@tryghost/debug": "0.1.9",
-    "@tryghost/email-analytics-provider-mailgun": "1.0.5",
-    "@tryghost/email-analytics-service": "1.0.4",
-    "@tryghost/errors": "0.2.17",
-    "@tryghost/express-dynamic-redirects": "0.2.1",
+    "@tryghost/email-analytics-provider-mailgun": "1.0.6",
+    "@tryghost/email-analytics-service": "1.0.5",
+    "@tryghost/errors": "1.0.4",
+    "@tryghost/express-dynamic-redirects": "0.2.2",
     "@tryghost/helpers": "1.1.54",
-    "@tryghost/image-transform": "1.0.18",
-    "@tryghost/job-manager": "0.8.12",
+    "@tryghost/image-transform": "1.0.24",
+    "@tryghost/job-manager": "0.8.16",
     "@tryghost/kg-card-factory": "3.1.0",
     "@tryghost/kg-default-atoms": "3.1.0",
-    "@tryghost/kg-default-cards": "5.8.3",
+    "@tryghost/kg-default-cards": "5.9.2",
     "@tryghost/kg-markdown-html-renderer": "5.1.0",
-    "@tryghost/kg-mobiledoc-html-renderer": "5.2.0",
-    "@tryghost/limit-service": "1.0.0",
-    "@tryghost/logging": "1.0.1",
+    "@tryghost/kg-mobiledoc-html-renderer": "5.3.0",
+    "@tryghost/limit-service": "1.0.6",
+    "@tryghost/logging": "1.0.2",
     "@tryghost/magic-link": "1.0.14",
-    "@tryghost/members-api": "2.7.4",
-    "@tryghost/members-csv": "1.1.8",
-    "@tryghost/members-importer": "0.3.4",
-    "@tryghost/members-offers": "0.10.2",
-    "@tryghost/members-ssr": "1.0.15",
+    "@tryghost/members-api": "2.8.4",
+    "@tryghost/members-csv": "1.2.0",
+    "@tryghost/members-importer": "0.3.5",
+    "@tryghost/members-offers": "0.10.3",
+    "@tryghost/members-ssr": "1.0.16",
     "@tryghost/metrics": "1.0.1",
-    "@tryghost/minifier": "0.1.1",
+    "@tryghost/minifier": "0.1.7",
     "@tryghost/mw-session-from-token": "0.1.26",
-    "@tryghost/nodemailer": "0.3.7",
-    "@tryghost/package-json": "1.0.6",
+    "@tryghost/nodemailer": "0.3.8",
+    "@tryghost/package-json": "1.0.12",
     "@tryghost/promise": "0.1.13",
-    "@tryghost/request": "0.1.9",
+    "@tryghost/request": "0.1.10",
     "@tryghost/root-utils": "0.3.7",
     "@tryghost/security": "0.2.13",
-    "@tryghost/session-service": "0.1.28",
+    "@tryghost/session-service": "0.1.34",
+    "@tryghost/settings-path-manager": "0.1.2",
     "@tryghost/social-urls": "0.1.27",
     "@tryghost/string": "0.1.21",
     "@tryghost/tpl": "0.1.8",
     "@tryghost/update-check-service": "0.2.5",
     "@tryghost/url-utils": "2.0.4",
-    "@tryghost/validator": "0.1.8",
+    "@tryghost/validator": "0.1.9",
     "@tryghost/version": "0.1.7",
     "@tryghost/vhost-middleware": "1.0.19",
     "@tryghost/zip": "1.1.18",
     "amperize": "0.6.1",
-    "analytics-node": "5.1.2",
+    "analytics-node": "6.0.0",
     "bluebird": "3.7.2",
     "body-parser": "1.19.0",
     "bookshelf": "1.2.0",
@@ -129,7 +130,7 @@
     "ghost-storage-base": "1.0.0",
     "glob": "7.2.0",
     "got": "9.6.0",
-    "gscan": "4.11.0",
+    "gscan": "4.15.2",
     "html-to-text": "5.1.1",
     "image-size": "1.0.0",
     "intl": "1.2.5",
@@ -144,28 +145,28 @@
     "lodash": "4.17.21",
     "luxon": "2.1.1",
     "mailgun-js": "0.22.0",
-    "metascraper": "5.25.1",
-    "metascraper-author": "5.25.1",
-    "metascraper-description": "5.25.1",
-    "metascraper-image": "5.25.1",
-    "metascraper-logo": "5.25.1",
-    "metascraper-logo-favicon": "5.25.1",
-    "metascraper-publisher": "5.25.1",
-    "metascraper-title": "5.25.1",
-    "metascraper-url": "5.25.1",
+    "metascraper": "5.25.4",
+    "metascraper-author": "5.25.4",
+    "metascraper-description": "5.25.4",
+    "metascraper-image": "5.25.4",
+    "metascraper-logo": "5.25.4",
+    "metascraper-logo-favicon": "5.25.4",
+    "metascraper-publisher": "5.25.4",
+    "metascraper-title": "5.25.4",
+    "metascraper-url": "5.25.4",
     "moment": "2.24.0",
     "moment-timezone": "0.5.23",
     "multer": "1.4.3",
     "mysql": "2.18.1",
     "nconf": "0.11.3",
     "node-jose": "2.0.0",
-    "oembed-parser": "1.5.2",
+    "oembed-parser": "1.4.9",
     "passport": "0.5.0",
     "passport-google-oauth": "2.0.0",
     "path-match": "1.2.4",
     "probe-image-size": "5.0.0",
     "rss": "1.2.2",
-    "sanitize-html": "2.5.3",
+    "sanitize-html": "2.6.0",
     "semver": "7.3.5",
     "stoppable": "1.1.0",
     "tough-cookie": "4.0.0",
@@ -173,16 +174,16 @@
     "xml": "1.0.1"
   },
   "optionalDependencies": {
-    "@tryghost/html-to-mobiledoc": "1.3.2",
+    "@tryghost/html-to-mobiledoc": "1.4.1",
     "sqlite3": "5.0.2"
   },
   "devDependencies": {
     "@lodder/grunt-postcss": "3.1.1",
     "c8": "7.10.0",
     "coffeescript": "2.6.1",
-    "cssnano": "5.0.11",
+    "cssnano": "5.0.12",
     "eslint": "7.32.0",
-    "eslint-plugin-ghost": "2.7.0",
+    "eslint-plugin-ghost": "2.11.0",
     "grunt": "1.4.1",
     "grunt-bg-shell": "2.3.3",
     "grunt-contrib-clean": "2.0.0",
@@ -200,7 +201,7 @@
     "mock-knex": "0.4.10",
     "nock": "13.2.1",
     "papaparse": "5.3.1",
-    "postcss": "8.3.11",
+    "postcss": "8.4.4",
     "rewire": "5.0.0",
     "should": "13.2.3",
     "sinon": "11.1.2",