ghost 4.43.1 → 4.46.0

package/core/frontend/apps/amp/lib/helpers/amp_content.js

@@ -187,9 +187,8 @@ function ampContent() {
         // Use cheerio to traverse through HTML and make little clean-ups
         $ = cheerio.load(ampHTML);
 
-        // We have to remove source children in video, as source
-        // is whitelisted for audio, but causes validation
-        // errors in video, because video will be stripped out.
+        // We have to remove source children in video, as source is allowed for audio,
+        // but causes validation errors in video, because video will be stripped out.
         // @TODO: remove this, when Amperize support video transform
         $('video').children('source').remove();
         $('video').children('track').remove();

package/core/frontend/apps/amp/lib/views/amp.hbs

@@ -987,7 +987,7 @@
     <header class="page-header">
         <a href="{{@site.url}}">
             {{#if @site.icon}}
-                <amp-img class="site-icon" src="{{img_url @site.icon absolute="true"}}" width="50" height="50" layout="fixed"></amp-img>
+                <amp-img class="site-icon" src="{{img_url @site.icon absolute="true"}}" width="50" height="50" layout="fixed" alt="{{@site.title}}"></amp-img>
             {{else}}
                 {{@site.title}}
             {{/if}}
@@ -1006,7 +1006,9 @@
             </header>
             {{#if feature_image}}
             <figure class="post-image">
-                <amp-img src="{{img_url feature_image absolute="true"}}" width="600" height="340" layout="responsive"></amp-img>
+                <amp-img src="{{img_url feature_image absolute="true"}}" width="600" height="340" layout="responsive" 
+                alt="{{#if feature_image_alt}}{{feature_image_alt}}{{else}}{{title}}{{/if}}"
+                ></amp-img>
             </figure>
             {{/if}}
             <section class="post-content">
@@ -1020,7 +1022,7 @@
     {{/post}}
     <footer class="page-footer">
         {{#if @site.icon}}
-            <amp-img class="site-icon" src="{{img_url @site.icon absolute="true"}}" width="50" height="50" layout="fixed"></amp-img>
+            <amp-img class="site-icon" src="{{img_url @site.icon absolute="true"}}" width="50" height="50" layout="fixed" alt="{{@site.title}}"></amp-img>
         {{/if}}
         <h3>{{@site.title}}</h3>
         {{#if @site.description}}

package/core/frontend/helpers/get.js

@@ -80,7 +80,7 @@ function resolvePaths(globals, data, value) {
         path = path.replace(/\.\[/g, '[');
 
         if (path.charAt(0) === '@') {
-            result = jsonpath.query(globals, path.substr(1));
+            result = jsonpath.query(globals, path.slice(1));
         } else {
             // Do the query, which always returns an array of matches
             result = jsonpath.query(data, path);

package/core/frontend/services/routing/controllers/unsubscribe.js

@@ -1,11 +1,33 @@
 const debug = require('@tryghost/debug')('services:routing:controllers:unsubscribe');
 const path = require('path');
+const url = require('url');
+
+const urlUtils = require('../../../../shared/url-utils');
 const megaService = require('../../../../server/services/mega');
 const renderer = require('../../rendering');
+const labs = require('../../../../shared/labs');
 
 module.exports = async function unsubscribeController(req, res) {
     debug('unsubscribeController');
 
+    if (labs.isSet('multipleNewslettersUI')) {
+        const {query} = url.parse(req.url, true);
+
+        if (!query || !query.uuid) {
+            res.writeHead(400);
+            return res.end('Email address not found.');
+        }
+
+        const redirectUrl = new URL(urlUtils.urlFor('home', true));
+        redirectUrl.searchParams.append('uuid', query.uuid);
+        if (query.newsletter) {
+            redirectUrl.searchParams.append('newsletter', query.newsletter);
+        }
+        redirectUrl.searchParams.append('action', 'unsubscribe');
+
+        return res.redirect(302, redirectUrl.href);
+    }
+
     let data = {};
 
     try {

package/core/frontend/web/middleware/cors.js

@@ -0,0 +1,56 @@
+const {URL} = require('url');
+const cors = require('cors');
+const errors = require('@tryghost/errors');
+const config = require('../../../shared/config');
+
+/**
+ * Dynamically configures the expressjs/cors middleware
+ *
+ * @param {import('express').Request} req
+ * @param {Function} callback
+ */
+function corsOptionsDelegate(req, callback) {
+    const origin = req.header('Origin');
+    const corsOptions = {
+        origin: false, // disallow cross-origin requests by default
+        credentials: true // required to allow admin-client to login to private sites
+    };
+
+    if (!origin || origin === 'null') {
+        return callback(null, corsOptions);
+    }
+
+    let originUrl;
+    try {
+        originUrl = new URL(origin);
+    } catch (err) {
+        return callback(new errors.BadRequestError({err}));
+    }
+
+    // originUrl will definitely exist here because according to WHATWG URL spec
+    // The class constructor will either throw a TypeError or return a URL object
+    // https://url.spec.whatwg.org/#url-class
+
+    // allow all localhost and 127.0.0.1 requests no matter the port
+    if (originUrl.hostname === 'localhost' || originUrl.hostname === '127.0.0.1') {
+        corsOptions.origin = true;
+    }
+
+    // allow the configured host through on any protocol
+    const siteUrl = new URL(config.get('url'));
+    if (originUrl.host === siteUrl.host) {
+        corsOptions.origin = true;
+    }
+
+    // allow the configured admin:url host through on any protocol
+    if (config.get('admin:url')) {
+        const adminUrl = new URL(config.get('admin:url'));
+        if (originUrl.host === adminUrl.host) {
+            corsOptions.origin = true;
+        }
+    }
+
+    callback(null, corsOptions);
+}
+
+module.exports = cors(corsOptionsDelegate);

package/core/frontend/web/middleware/index.js

@@ -1,4 +1,5 @@
 module.exports = {
+    cors: require('./cors'),
     errorHandler: require('./error-handler'),
     handleImageSizes: require('./handle-image-sizes'),
     redirectGhostToAdmin: require('./redirect-ghost-to-admin'),

package/core/frontend/web/middleware/static-theme.js

@@ -4,18 +4,18 @@ const constants = require('@tryghost/constants');
 const themeEngine = require('../../services/theme-engine');
 const express = require('../../../shared/express');
 
-function isBlackListedFileType(file) {
-    const blackListedFileTypes = ['.hbs', '.md', '.json'];
+function isDeniedFile(file) {
+    const deniedFileTypes = ['.hbs', '.md', '.json'];
     const ext = path.extname(file);
 
-    return blackListedFileTypes.includes(ext);
+    return deniedFileTypes.includes(ext);
 }
 
-function isWhiteListedFile(file) {
-    const whiteListedFiles = ['manifest.json'];
+function isAllowedFile(file) {
+    const allowedFiles = ['manifest.json'];
     const base = path.basename(file);
 
-    return whiteListedFiles.includes(base);
+    return allowedFiles.includes(base);
 }
 
 function forwardToExpressStatic(req, res, next) {
@@ -31,8 +31,8 @@ function forwardToExpressStatic(req, res, next) {
 }
 
 function staticTheme() {
-    return function blackListStatic(req, res, next) {
-        if (!isWhiteListedFile(req.path) && isBlackListedFileType(req.path)) {
+    return function denyStatic(req, res, next) {
+        if (!isAllowedFile(req.path) && isDeniedFile(req.path)) {
             return next();
         }
 

package/core/frontend/web/site.js

@@ -1,9 +1,6 @@
 const debug = require('@tryghost/debug')('frontend');
 const path = require('path');
 const express = require('../../shared/express');
-const cors = require('cors');
-const {URL} = require('url');
-const errors = require('@tryghost/errors');
 const DomainEvents = require('@tryghost/domain-events');
 const {MemberPageViewEvent} = require('@tryghost/member-events');
 
@@ -31,50 +28,6 @@ const STATIC_FILES_URL_PREFIX = `/${constants.STATIC_FILES_URL_PREFIX}`;
 
 let router;
 
-const corsOptionsDelegate = function corsOptionsDelegate(req, callback) {
-    const origin = req.header('Origin');
-    const corsOptions = {
-        origin: false, // disallow cross-origin requests by default
-        credentials: true // required to allow admin-client to login to private sites
-    };
-
-    if (!origin || origin === 'null') {
-        return callback(null, corsOptions);
-    }
-
-    let originUrl;
-    try {
-        originUrl = new URL(origin);
-    } catch (err) {
-        return callback(new errors.BadRequestError({err}));
-    }
-
-    // originUrl will definitely exist here because according to WHATWG URL spec
-    // The class constructor will either throw a TypeError or return a URL object
-    // https://url.spec.whatwg.org/#url-class
-
-    // allow all localhost and 127.0.0.1 requests no matter the port
-    if (originUrl.hostname === 'localhost' || originUrl.hostname === '127.0.0.1') {
-        corsOptions.origin = true;
-    }
-
-    // allow the configured host through on any protocol
-    const siteUrl = new URL(config.get('url'));
-    if (originUrl.host === siteUrl.host) {
-        corsOptions.origin = true;
-    }
-
-    // allow the configured admin:url host through on any protocol
-    if (config.get('admin:url')) {
-        const adminUrl = new URL(config.get('admin:url'));
-        if (originUrl.host === adminUrl.host) {
-            corsOptions.origin = true;
-        }
-    }
-
-    callback(null, corsOptions);
-};
-
 function SiteRouter(req, res, next) {
     router(req, res, next);
 }
@@ -89,7 +42,7 @@ module.exports = function setupSiteApp(options = {}) {
     siteApp.set('view engine', 'hbs');
 
     // enable CORS headers (allows admin client to hit front-end when configured on separate URLs)
-    siteApp.use(cors(corsOptionsDelegate));
+    siteApp.use(mw.cors);
 
     siteApp.use(offersService.middleware);
 

package/core/server/api/canary/authentication.js

@@ -51,14 +51,14 @@ module.exports = {
                 })
                 .then((data) => {
                     try {
-                        return auth.setup.doFixtures(data, api.products);
+                        return auth.setup.doFixtures(data);
                     } catch (e) {
                         return data;
                     }
                 })
                 .then((data) => {
                     try {
-                        return auth.setup.doProduct(data, api.products);
+                        return auth.setup.doProductAndNewsletter(data, api);
                     } catch (e) {
                         return data;
                     }

package/core/server/api/canary/members.js

@@ -366,6 +366,9 @@ module.exports = {
             if (labsService.isSet('multipleProducts')) {
                 frame.options.withRelated.push('products');
             }
+            if (labsService.isSet('multipleNewsletters')) {
+                frame.options.withRelated.push('newsletters');
+            }
             const page = await membersService.api.members.list(frame.options);
 
             return page;

package/core/server/api/canary/newsletters.js

@@ -1,45 +1,127 @@
 const models = require('../../models');
+const tpl = require('@tryghost/tpl');
+const errors = require('@tryghost/errors');
+const allowedIncludes = ['count.posts', 'count.members'];
+
+const messages = {
+    newsletterNotFound: 'Newsletter not found.'
+};
+const newslettersService = require('../../services/newsletters');
 
 module.exports = {
     docName: 'newsletters',
 
     browse: {
         options: [
+            'include',
             'filter',
             'fields',
             'limit',
             'order',
             'page'
         ],
+        validation: {
+            options: {
+                include: {
+                    values: allowedIncludes
+                }
+            }
+        },
         permissions: true,
         query(frame) {
             return models.Newsletter.findPage(frame.options);
         }
     },
 
+    read: {
+        options: [
+            'include',
+            'fields',
+            'debug',
+            // NOTE: only for internal context
+            'forUpdate',
+            'transacting'
+        ],
+        data: [
+            'id',
+            'slug',
+            'uuid'
+        ],
+        validation: {
+            options: {
+                include: {
+                    values: allowedIncludes
+                }
+            }
+        },
+        permissions: true,
+        async query(frame) {
+            const newsletter = models.Newsletter.findOne(frame.data, frame.options);
+
+            if (!newsletter) {
+                throw new errors.NotFoundError({
+                    message: tpl(messages.newsletterNotFound)
+                });
+            }
+            return newsletter;
+        }
+    },
+
     add: {
         statusCode: 201,
+        headers: {
+            cacheInvalidate: true
+        },
+        options: [
+            'include',
+            'opt_in_existing'
+        ],
+        validation: {
+            options: {
+                include: {
+                    values: allowedIncludes
+                }
+            }
+        },
         permissions: true,
         async query(frame) {
-            return models.Newsletter.add(frame.data.newsletters[0], frame.options);
+            return newslettersService.add(frame.data.newsletters[0], frame.options);
         }
     },
 
     edit: {
-        headers: {},
+        headers: {
+            cacheInvalidate: true
+        },
         options: [
-            'id'
+            'id',
+            'include'
         ],
         validation: {
             options: {
                 id: {
                     required: true
+                },
+                include: {
+                    values: allowedIncludes
                 }
             }
         },
         permissions: true,
         async query(frame) {
-            return models.Newsletter.edit(frame.data.newsletters[0], frame.options);
+            return newslettersService.edit(frame.data.newsletters[0], frame.options);
+        }
+    },
+
+    verifyPropertyUpdate: {
+        permissions: {
+            method: 'edit'
+        },
+        data: [
+            'token'
+        ],
+        async query(frame) {
+            return newslettersService.verifyPropertyUpdate(frame.data.token);
         }
     }
 };

package/core/server/api/canary/posts.js

@@ -129,6 +129,7 @@ module.exports = {
             'formats',
             'source',
             'email_recipient_filter',
+            'newsletter_id',
             'send_email_when_published',
             'force_rerender',
             // NOTE: only for internal context

package/core/server/api/canary/stats.js

@@ -8,7 +8,7 @@ module.exports = {
             method: 'browse'
         },
         async query() {
-            return await statsService.members.getCountHistory();
+            return await statsService.getMemberCountHistory();
         }
     },
     mrr: {
@@ -17,7 +17,16 @@ module.exports = {
             method: 'browse'
         },
         async query() {
-            return await statsService.mrr.getHistory();
+            return await statsService.getMRRHistory();
+        }
+    },
+    subscriptions: {
+        permissions: {
+            docName: 'members',
+            method: 'browse'
+        },
+        async query() {
+            return await statsService.getSubscriptionCountHistory();
         }
     }
 };

package/core/server/api/canary/utils/serializers/input/members.js

@@ -1,5 +1,7 @@
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:canary:utils:serializers:input:members');
+const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
+const labsService = require('../../../../../../shared/labs');
 
 function defaultRelations(frame) {
     if (frame.options.withRelated) {
@@ -17,6 +19,26 @@ module.exports = {
     browse(apiConfig, frame) {
         debug('browse');
         defaultRelations(frame);
+
+        if (!frame.options.order) {
+            frame.options.autoOrder = 'created_at DESC, id DESC';
+        }
+
+        if (labsService.isSet('multipleNewsletters')) {
+            frame.options.mongoTransformer = mapNQLKeyValues({
+                key: {
+                    from: 'subscribed',
+                    to: 'newsletters.status'
+                },
+                values: [{
+                    from: true,
+                    to: 'active'
+                }, {
+                    from: false,
+                    to: {$ne: 'active'}
+                }]
+            });
+        }
     },
 
     read() {

package/core/server/api/canary/utils/serializers/output/mappers/pages.js

@@ -6,6 +6,7 @@ module.exports = async (model, frame, options) => {
     delete jsonModel.email_subject;
     delete jsonModel.email_recipient_filter;
     delete jsonModel.email_only;
+    delete jsonModel.newsletter_id;
 
     return jsonModel;
 };

package/core/server/api/canary/utils/serializers/output/mappers/posts.js

@@ -57,6 +57,8 @@ module.exports = async (model, frame, options = {}) => {
         }
         date.forPost(jsonModel);
         gating.forPost(jsonModel, frame);
+
+        delete jsonModel.newsletter_id;
     }
 
     // Transforms post/page metadata to flat structure

package/core/server/api/canary/utils/serializers/output/members.js

@@ -132,8 +132,19 @@ function serializeMember(member, options) {
         serialized.products = json.products;
     }
 
-    if (json.newsletters && labsService.isSet('multipleNewsletters')) {
-        serialized.newsletters = json.newsletters;
+    if (labsService.isSet('multipleNewsletters')) {
+        if (json.newsletters) {
+            serialized.newsletters = json.newsletters
+                .filter(newsletter => newsletter.status === 'active')
+                .sort((a, b) => {
+                    return a.sort_order - b.sort_order;
+                });
+        }
+        // override the `subscribed` param to mean "subscribed to any active newsletter"
+        serialized.subscribed = false;
+        if (serialized.newsletters.length > 0) {
+            serialized.subscribed = true;
+        }
     }
 
     return serialized;

package/core/server/api/shared/http.js

@@ -83,7 +83,7 @@ const http = (apiImpl) => {
 
             // CASE: generate headers based on the api ctrl configuration
             if (req && req.headers && req.headers['accept-version'] && res.locals) {
-                headers['content-version'] = `v${res.locals.safeVersion}`;
+                headers['Content-Version'] = `v${res.locals.safeVersion}`;
             }
             res.set(headers);
 

package/core/server/api/v2/utils/serializers/output/utils/mapper.js

@@ -48,6 +48,8 @@ const mapPost = (model, frame) => {
         }
         date.forPost(jsonModel);
         gating.forPost(jsonModel, frame);
+
+        delete jsonModel.newsletter_id;
     }
 
     // Transforms post/page metadata to flat structure

package/core/server/api/v3/utils/serializers/output/utils/mapper.js

@@ -45,6 +45,8 @@ const mapPost = (model, frame) => {
         }
         date.forPost(jsonModel);
         gating.forPost(jsonModel, frame);
+
+        delete jsonModel.newsletter_id;
     }
 
     if (typeof jsonModel.email_recipient_filter === 'undefined') {
@@ -100,6 +102,7 @@ const mapPage = (model, frame) => {
     delete jsonModel.email_subject;
     delete jsonModel.send_email_when_published;
     delete jsonModel.email_recipient_filter;
+    delete jsonModel.newsletter_id;
 
     return jsonModel;
 };

package/core/server/data/importer/importers/data/settings.js

@@ -80,9 +80,6 @@ class SettingsImporter extends BaseImporter {
         };
     }
 
-    /**
-     * - 'core' and 'theme' are blacklisted
-     */
     beforeImport() {
         debug('beforeImport');
 

package/core/server/data/migrations/utils.js

@@ -440,6 +440,44 @@ function createDropColumnMigration(table, column, columnDefinition) {
     );
 }
 
+/**
+ * @param {string} table
+ * @param {string} column
+ *
+ * @returns {Migration}
+ */
+function createSetNullableMigration(table, column) {
+    return createNonTransactionalMigration(
+        async function up(knex) {
+            logging.info(`Setting nullable: ${table}.${column}`);
+            await commands.setNullable(table, column, knex);
+        },
+        async function down(knex) {
+            logging.info(`Dropping nullable:  ${table}.${column}`);
+            await commands.dropNullable(table, column, knex);
+        }
+    );
+}
+
+/**
+ * @param {string} table
+ * @param {string} column
+ *
+ * @returns {Migration}
+ */
+function createDropNullableMigration(table, column) {
+    return createNonTransactionalMigration(
+        async function up(knex) {
+            logging.info(`Dropping nullable: ${table}.${column}`);
+            await commands.dropNullable(table, column, knex);
+        },
+        async function down(knex) {
+            logging.info(`Setting nullable: ${table}.${column}`);
+            await commands.setNullable(table, column, knex);
+        }
+    );
+}
+
 /**
  * Creates a migration which will insert a new setting in settings table
  * @param {object} settingSpec - setting key, value, group and type
@@ -505,6 +543,8 @@ module.exports = {
     combineNonTransactionalMigrations,
     createAddColumnMigration,
     createDropColumnMigration,
+    createSetNullableMigration,
+    createDropNullableMigration,
     meta: {
         MIGRATION_USER
     }

package/core/server/data/migrations/versions/4.43/2022-03-28-19-26-recreate-newsletter-table.js

@@ -7,8 +7,8 @@ module.exports = recreateTable('newsletters', {
     slug: {type: 'string', maxlength: 191, nullable: false, unique: true},
     sender_name: {type: 'string', maxlength: 191, nullable: false},
     sender_email: {type: 'string', maxlength: 191, nullable: true},
-    sender_reply_to: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'newsletter', validations: {isIn: ['newsletter', 'support']}},
-    status: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'active'},
+    sender_reply_to: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'newsletter', validations: {isIn: [['newsletter', 'support']]}},
+    status: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'active', validations: {isIn: [['active', 'archived']]}},
     visibility: {
         type: 'string',
         maxlength: 50,
@@ -20,10 +20,10 @@ module.exports = recreateTable('newsletters', {
     header_image: {type: 'string', maxlength: 2000, nullable: true},
     show_header_icon: {type: 'bool', nullable: false, defaultTo: true},
     show_header_title: {type: 'bool', nullable: false, defaultTo: true},
-    title_font_category: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'sans_serif', validations: {isIn: ['serif', 'sans_serif']}},
-    title_alignment: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'center', validations: {isIn: ['center', 'left']}},
+    title_font_category: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'sans_serif', validations: {isIn: [['serif', 'sans_serif']]}},
+    title_alignment: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'center', validations: {isIn: [['center', 'left']]}},
     show_feature_image: {type: 'bool', nullable: false, defaultTo: true},
-    body_font_category: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'sans_serif', validations: {isIn: ['serif', 'sans_serif']}},
+    body_font_category: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'sans_serif', validations: {isIn: [['serif', 'sans_serif']]}},
     footer_content: {type: 'text', maxlength: 1000000000, nullable: true},
     show_badge: {type: 'bool', nullable: false, defaultTo: true}
 });