ghost 4.47.3 → 5.0.0

package/core/frontend/services/rendering/render-entry.js

@@ -13,6 +13,6 @@ module.exports = function renderEntry(req, res) {
     return function renderEntryClosure(entry) {
         // Format data 2 - 1 is in preview/entry
         // Render
-        return renderer(req, res, formatResponse.entry(entry));
+        return renderer(req, res, formatResponse.entry(entry, res.routerOptions?.context));
     };
 };

package/core/frontend/services/rendering/templates.js

@@ -82,11 +82,11 @@ _private.getEntriesTemplateHierarchy = function getEntriesTemplateHierarchy(rout
  * @param {Object} postObject
  * @returns {String[]}
  */
-_private.getEntryTemplateHierarchy = function getEntryTemplateHierarchy(postObject) {
+_private.getEntryTemplateHierarchy = function getEntryTemplateHierarchy(postObject, context) {
     const templateList = ['post'];
     let slugTemplate = 'post-' + postObject.slug;
 
-    if (postObject.page) {
+    if (context === 'page') {
         templateList.unshift('page');
         slugTemplate = 'page-' + postObject.slug;
     }
@@ -141,8 +141,14 @@ _private.pickTemplate = function pickTemplate(templateList, fallback) {
     return template;
 };
 
-_private.getTemplateForEntry = function getTemplateForEntry(postObject) {
-    const templateList = _private.getEntryTemplateHierarchy(postObject);
+/**
+ *
+ * @param {Object} entry
+ * @param {('post'|'page')} context
+ * @returns
+ */
+_private.getTemplateForEntry = function getTemplateForEntry(entry, context) {
+    const templateList = _private.getEntryTemplateHierarchy(entry, context);
     const fallback = templateList[templateList.length - 1];
     return _private.pickTemplate(templateList, fallback);
 };
@@ -184,7 +190,11 @@ module.exports.setTemplate = function setTemplate(req, res, data) {
     } else if (res.routerOptions.type === 'custom') {
         res._template = _private.pickTemplate(res.routerOptions.templates, res.routerOptions.defaultTemplate);
     } else if (res.routerOptions.type === 'entry') {
-        res._template = _private.getTemplateForEntry(data.post);
+        if (res.routerOptions?.context?.includes('page')) {
+            res._template = _private.getTemplateForEntry(data.page, 'page');
+        } else {
+            res._template = _private.getTemplateForEntry(data.post, 'post');
+        }
     } else {
         res._template = 'index';
     }

package/core/frontend/services/routing/CollectionRouter.js

@@ -140,7 +140,7 @@ class CollectionRouter extends ParentRouter {
     getRoute(options) {
         options = options || {};
 
-        return urlUtils.createUrl(this.route.value, options.absolute, options.secure);
+        return urlUtils.createUrl(this.route.value, options.absolute);
     }
 
     /**
@@ -153,7 +153,7 @@ class CollectionRouter extends ParentRouter {
             return null;
         }
 
-        return urlUtils.createUrl(urlUtils.urlJoin(this.route.value, this.rssRouter.route.value), options.absolute, options.secure);
+        return urlUtils.createUrl(urlUtils.urlJoin(this.route.value, this.rssRouter.route.value), options.absolute);
     }
 }
 

package/core/frontend/services/routing/EmailRouter.js

@@ -3,11 +3,11 @@ const urlUtils = require('../../../shared/url-utils');
 const controllers = require('./controllers');
 
 /**
- * @description Preview Router.
+ * @description Email Router.
  */
 class EmailRouter extends ParentRouter {
     constructor(RESOURCE_CONFIG) {
-        super('PreviewRouter');
+        super('EmailRouter');
 
         this.RESOURCE_CONFIG = RESOURCE_CONFIG.QUERY.email;
 

package/core/frontend/services/routing/ParentRouter.js

@@ -192,7 +192,7 @@ class ParentRouter {
     getRoute(options) {
         options = options || {};
 
-        return urlUtils.createUrl(this.route.value, options.absolute, options.secure);
+        return urlUtils.createUrl(this.route.value, options.absolute);
     }
 
     /**

package/core/frontend/services/routing/PreviewRouter.js

@@ -9,7 +9,7 @@ class PreviewRouter extends ParentRouter {
     constructor(RESOURCE_CONFIG) {
         super('PreviewRouter');
 
-        this.RESOURCE_CONFIG = RESOURCE_CONFIG.QUERY.preview;
+        this.RESOURCE_CONFIG = RESOURCE_CONFIG.QUERY.previews;
 
         // @NOTE: hardcoded, not configureable
         this.route = {value: '/p/'};
@@ -25,8 +25,8 @@ class PreviewRouter extends ParentRouter {
         // REGISTER: prepare context
         this.router().use(this._prepareContext.bind(this));
 
-        // REGISTER: actual preview route
-        this.mountRoute(urlUtils.urlJoin(this.route.value, ':uuid', ':options?'), controllers.preview);
+        // REGISTER: actual previews route
+        this.mountRoute(urlUtils.urlJoin(this.route.value, ':uuid', ':options?'), controllers.previews);
     }
 
     /**

package/core/frontend/services/routing/{config/v4.js → config.js}

@@ -1,4 +1,3 @@
-/* eslint-disable */
 module.exports.QUERY = {
     tag: {
         controller: 'tagsPublic',
@@ -33,9 +32,9 @@ module.exports.QUERY = {
             slug: '%s'
         }
     },
-    preview: {
-        controller: 'preview',
-        resource: 'preview'
+    previews: {
+        controller: 'previews',
+        resource: 'previews'
     },
     email: {
         controller: 'emailPost',
@@ -58,4 +57,3 @@ module.exports.TAXONOMIES = {
         resource: 'authors'
     }
 };
-/* eslint-enable */

package/core/frontend/services/routing/controllers/channel.js

@@ -1,4 +1,3 @@
-const _ = require('lodash');
 const debug = require('@tryghost/debug')('services:routing:controllers:channel');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
@@ -60,15 +59,6 @@ module.exports = function channelController(req, res, next) {
                 }));
             }
 
-            // Format data 1
-            // @TODO: See renderer/secure for explanation.
-            renderer.secure(req, result.posts);
-
-            // @TODO: See renderer/secure for explanation.
-            _.each(result.data, function (data) {
-                renderer.secure(req, data);
-            });
-
             return renderer.renderEntries(req, res)(result);
         })
         .catch(renderer.handleError(next));

package/core/frontend/services/routing/controllers/collection.js

@@ -80,15 +80,6 @@ module.exports = function collectionController(req, res, next) {
                 debug(`'${post.slug}' is not owned by this collection`);
             });
 
-            // Format data 1
-            // @TODO: See renderer/secure for explanation.
-            renderer.secure(req, result.posts);
-
-            // @TODO: See renderer/secure for explanation.
-            _.each(result.data, function (data) {
-                renderer.secure(req, data);
-            });
-
             return renderer.renderEntries(req, res)(result);
         })
         .catch(renderer.handleError(next));

package/core/frontend/services/routing/controllers/email-post.js

@@ -14,7 +14,7 @@ const renderer = require('../../rendering');
 module.exports = function emailPostController(req, res, next) {
     debug('emailPostController');
 
-    const api = require('../../proxy').api[res.locals.apiVersion];
+    const api = require('../../proxy').api;
 
     const params = {
         uuid: req.params.uuid,
@@ -51,12 +51,7 @@ module.exports = function emailPostController(req, res, next) {
                 return urlUtils.redirect301(res, routerManager.getUrlByResourceId(post.id, {withSubdirectory: true}));
             }
 
-            if (res.locals.apiVersion !== 'v0.1' && res.locals.apiVersion !== 'v2') {
-                post.access = !!post.html;
-            }
-
-            // @TODO: See renderer/secure
-            renderer.secure(req, post);
+            post.access = !!post.html;
 
             return renderer.renderEntry(req, res)(post);
         })

package/core/frontend/services/routing/controllers/entry.js

@@ -40,7 +40,7 @@ module.exports = function entryController(req, res, next) {
                 }
 
                 debug('redirect. is edit url');
-                const resourceType = entry.page ? 'page' : 'post';
+                const resourceType = res.routerOptions?.context?.includes('page') ? 'page' : 'post';
 
                 return urlUtils.redirectToAdmin(302, res, `/#/editor/${resourceType}/${entry.id}`);
             }
@@ -84,8 +84,6 @@ module.exports = function entryController(req, res, next) {
                 }));
             }
 
-            renderer.secure(req, entry);
-
             return renderer.renderEntry(req, res)(entry);
         })
         .catch(renderer.handleError(next));

package/core/frontend/services/routing/controllers/index.js

@@ -11,8 +11,8 @@ module.exports = {
         return require('./rss');
     },
 
-    get preview() {
-        return require('./preview');
+    get previews() {
+        return require('./previews');
     },
 
     get email() {

package/core/frontend/services/routing/controllers/{preview.js → previews.js}

@@ -14,7 +14,7 @@ const renderer = require('../../rendering');
 module.exports = function previewController(req, res, next) {
     debug('previewController');
 
-    const api = require('../../proxy').api[res.locals.apiVersion];
+    const api = require('../../proxy').api;
 
     const params = {
         uuid: req.params.uuid,
@@ -40,7 +40,7 @@ module.exports = function previewController(req, res, next) {
                 // @TODO: we don't know which resource type it is, because it's a generic preview handler and the
                 //        preview API returns {previews: []}
                 // @TODO: figure out how to solve better
-                const resourceType = post.page ? 'page' : 'post';
+                const resourceType = post.type;
 
                 // CASE: last param of the url is /edit, redirect to admin
                 return urlUtils.redirectToAdmin(302, res, `/#/editor/${resourceType}/${post.id}`);
@@ -53,12 +53,7 @@ module.exports = function previewController(req, res, next) {
                 return urlUtils.redirect301(res, routerManager.getUrlByResourceId(post.id, {withSubdirectory: true}));
             }
 
-            if (res.locals.apiVersion !== 'v0.1' && res.locals.apiVersion !== 'v2') {
-                post.access = !!post.html;
-            }
-
-            // @TODO: See renderer/secure
-            renderer.secure(req, post);
+            post.access = !!post.html;
 
             return renderer.renderEntry(req, res)(post);
         })

package/core/frontend/services/routing/controllers/static.js

@@ -4,7 +4,7 @@ const debug = require('@tryghost/debug')('services:routing:controllers:static');
 const renderer = require('../../rendering');
 
 function processQuery(query, locals) {
-    const api = require('../../proxy').api[locals.apiVersion];
+    const api = require('../../proxy').api;
     query = _.cloneDeep(query);
 
     // CASE: If you define a single data key for a static route (e.g. data: page.team), this static route will represent
@@ -60,11 +60,6 @@ module.exports = function staticController(req, res, next) {
                 });
             }
 
-            // @TODO: See renderer/secure for more context.
-            _.each(response.data, function (data) {
-                renderer.secure(req, data);
-            });
-
             renderer.renderer(req, res, renderer.formatResponse.entries(response));
         })
         .catch(renderer.handleError(next));

package/core/frontend/services/routing/router-manager.js

@@ -1,4 +1,4 @@
-const debug = require('@tryghost/debug')('routing');
+const debug = require('@tryghost/debug')('frontend:routing');
 const _ = require('lodash');
 const StaticRoutesRouter = require('./StaticRoutesRouter');
 const StaticPagesRouter = require('./StaticPagesRouter');
@@ -13,10 +13,12 @@ const UnsubscribeRouter = require('./UnsubscribeRouter');
 const events = require('../../../server/lib/common/events');
 
 class RouterManager {
-    constructor({registry, defaultApiVersion = 'v4'}) {
+    constructor({registry}) {
         this.registry = registry;
-        this.defaultApiVersion = defaultApiVersion;
         this.siteRouter = null;
+        /**
+         * @type {URLService}
+         */
         this.urlService = null;
     }
 
@@ -52,24 +54,20 @@ class RouterManager {
     }
 
     /**
-     * @description The `init` function will return the wrapped parent express router and will start creating all
-     *              routers if you pass the option "start: true".
+     * The `init` function will return the wrapped parent express router and will start creating all
+     * routers if you pass the option "start: true".
      *
      * CASES:
      *   - if Ghost starts, it will first init the site app with the wrapper router and then call `start`
      *     separately, because it could be that your blog goes into maintenance mode
      *   - if you change your route settings, we will re-initialize routing
      *
-     * @param {Object} options
-     * @param {Boolean} [options.start] - flag controlling if the frontend Routes should be reinitialized
-     * @param {String} options.apiVersion - API version frontend Routes should communicate through
-     * @param {Object} options.routerSettings - JSON configuration to build frontend Routes
-     * @param {Object} options.urlService - service providing resource URL utility functions such as owns, getUrlByResourceId, and getResourceById
-     * @returns {ExpressRouter}
+     * @param {RouterConfig} options
+     * @returns {import('express').Router}
      */
-    init({start = false, routerSettings, apiVersion, urlService}) {
+    init({routeSettings, urlService}) {
         this.urlService = urlService;
-        debug('routing init', start, apiVersion, routerSettings);
+        debug('routing init', routeSettings);
 
         this.registry.resetAllRouters();
         this.registry.resetAllRoutes();
@@ -81,9 +79,8 @@ class RouterManager {
         this.siteRouter = new ParentRouter('SiteRouter');
         this.registry.setRouter('siteRouter', this.siteRouter);
 
-        if (start) {
-            apiVersion = apiVersion || this.defaultApiVersion;
-            this.start(apiVersion, routerSettings);
+        if (routeSettings) {
+            this.start(routeSettings);
         }
 
         return this.siteRouter.router();
@@ -102,12 +99,11 @@ class RouterManager {
      * 5. Static Pages: Weaker than collections, because we first try to find a post slug and fallback to lookup a static page.
      * 6. Internal Apps: Weakest
      *
-     * @param {string} apiVersion
      * @param {object} routerSettings
      */
-    start(apiVersion, routerSettings) {
-        debug('routing start', apiVersion, routerSettings);
-        const RESOURCE_CONFIG = require(`./config/${apiVersion}`);
+    start(routerSettings) {
+        debug('routing start', routerSettings);
+        const RESOURCE_CONFIG = require(`./config`);
 
         const unsubscribeRouter = new UnsubscribeRouter();
         this.siteRouter.mountRouter(unsubscribeRouter.router());
@@ -190,3 +186,25 @@ class RouterManager {
 }
 
 module.exports = RouterManager;
+
+/**
+ * @typedef {Object} RouterConfig
+ * @property {RouteSettings} [routeSettings] - JSON config representing routes
+ * @property {URLService} urlService - service providing resource URL utility functions such as owns, getUrlByResourceId, and getResourceById
+ */
+
+/**
+ * @typedef {Object} RouteSettings
+ * @property {Object} routes
+ * @property {Object} collections
+ * @property {Object} taxonomies
+ */
+
+/**
+ * @typedef {Object} URLService
+ * @property {Function} owns
+ * @property {Function} getUrlByResourceId
+ * @property {Function} getResourceById
+ * @property {Function} onRouterAddedType
+ * @property {Function} onRouterUpdated
+ */

package/core/frontend/services/rss/generate-feed.js

@@ -17,10 +17,10 @@ const generateTags = function generateTags(data) {
     return [];
 };
 
-const generateItem = function generateItem(post, secure) {
+const generateItem = function generateItem(post) {
     const cheerio = require('cheerio');
 
-    const itemUrl = routerManager.getUrlByResourceId(post.id, {secure, absolute: true});
+    const itemUrl = routerManager.getUrlByResourceId(post.id, {absolute: true});
     const htmlContent = cheerio.load(post.html || '');
     const item = {
         title: post.title,
@@ -35,7 +35,7 @@ const generateItem = function generateItem(post, secure) {
     };
 
     if (post.feature_image) {
-        const imageUrl = urlUtils.urlFor('image', {image: post.feature_image, secure}, true);
+        const imageUrl = urlUtils.urlFor('image', {image: post.feature_image}, true);
 
         // Add a media content tag
         item.custom_elements.push({
@@ -67,17 +67,15 @@ const generateItem = function generateItem(post, secure) {
  * Data is an object which contains the res.locals + results from fetching a collection, but without related data.
  *
  * @param {string} baseUrl
- * @param {{title, description, safeVersion, secure, posts}} data
+ * @param {{title, description, safeVersion, posts}} data
  */
 const generateFeed = function generateFeed(baseUrl, data) {
-    const {secure} = data;
-
     const feed = new RSS({
         title: data.title,
         description: data.description,
         generator: 'Ghost ' + data.safeVersion,
-        feed_url: urlUtils.urlFor({relativeUrl: baseUrl, secure}, true),
-        site_url: urlUtils.urlFor('home', {secure}, true),
+        feed_url: urlUtils.urlFor({relativeUrl: baseUrl}, true),
+        site_url: urlUtils.urlFor('home', true),
         image_url: urlUtils.urlFor({relativeUrl: 'favicon.png'}, true),
         ttl: '60',
         custom_namespaces: {
@@ -88,7 +86,7 @@ const generateFeed = function generateFeed(baseUrl, data) {
 
     return data.posts.reduce((feedPromise, post) => {
         return feedPromise.then(() => {
-            const item = generateItem(post, secure);
+            const item = generateItem(post);
             return feed.item(item);
         });
     }, Promise.resolve()).then(() => {

package/core/frontend/services/theme-engine/active.js

@@ -15,7 +15,6 @@ const join = require('path').join;
 
 const _ = require('lodash');
 const themeConfig = require('./config');
-const themeEngines = require('./engines');
 const config = require('../../../shared/config');
 const engine = require('./engine');
 const themeI18n = require('./i18n');
@@ -53,9 +52,6 @@ class ActiveTheme {
         // Create a theme config object
         this._config = themeConfig.create(this._packageInfo);
 
-        // Create a theme engines object
-        this._engines = themeEngines.create(this._packageInfo);
-
         this.initI18n();
     }
 
@@ -95,10 +91,6 @@ class ActiveTheme {
         return this._config[key];
     }
 
-    engine(key) {
-        return this._engines[key];
-    }
-
     /**
      *
      * @param {object} options

package/core/frontend/services/theme-engine/config/defaults.json

@@ -1,6 +1,4 @@
 {
     "posts_per_page": 5,
-    "card_assets": {
-        "exclude": ["bookmark", "gallery"]
-    }
+    "card_assets": true
 }

package/core/frontend/services/theme-engine/middleware/index.js

@@ -1,6 +1,5 @@
 module.exports = [
     require('./ensure-active-theme'),
     require('./update-global-template-options'),
-    require('./update-local-template-data'),
     require('./update-local-template-options')
 ];

package/core/frontend/services/theme-engine/middleware/update-global-template-options.js

@@ -1,64 +1,10 @@
 const hbs = require('../engine');
 const urlUtils = require('../../../../shared/url-utils');
-const {api} = require('../../proxy');
 const settingsCache = require('../../../../shared/settings-cache');
 const customThemeSettingsCache = require('../../../../shared/custom-theme-settings-cache');
 const labs = require('../../../../shared/labs');
 const activeTheme = require('../active');
 
-function calculateLegacyPriceData(products) {
-    const defaultPrice = {
-        amount: 0,
-        currency: 'usd',
-        interval: 'year',
-        nickname: ''
-    };
-
-    function makePriceObject(price) {
-        const numberAmount = 0 + price.amount;
-        const dollarAmount = numberAmount ? Math.round(numberAmount / 100) : 0;
-        return {
-            valueOf() {
-                return dollarAmount;
-            },
-            amount: numberAmount,
-            currency: price.currency,
-            nickname: price.name,
-            interval: price.interval
-        };
-    }
-
-    const defaultProduct = products.find((product) => {
-        return product.type === 'paid';
-    }) || {};
-
-    const monthlyPrice = makePriceObject(defaultProduct.monthly_price || defaultPrice);
-
-    const yearlyPrice = makePriceObject(defaultProduct.yearly_price || defaultPrice);
-
-    const priceData = {
-        monthly: monthlyPrice,
-        yearly: yearlyPrice,
-        currency: monthlyPrice ? monthlyPrice.currency : defaultPrice.currency
-    };
-
-    return priceData;
-}
-
-async function getProductAndPricesData() {
-    try {
-        const page = await api.canary.productsPublic.browse({
-            include: ['monthly_price', 'yearly_price', 'benefits'],
-            limit: 'all',
-            filter: 'active:true'
-        });
-
-        return page.products;
-    } catch (err) {
-        return [];
-    }
-}
-
 function getSiteData() {
     let siteData = settingsCache.getPublic();
 
@@ -85,29 +31,14 @@ async function updateGlobalTemplateOptions(req, res, next) {
         image_sizes: activeTheme.get().config('image_sizes')
     };
     const themeSettingsData = customThemeSettingsCache.getAll();
-    const productData = await getProductAndPricesData();
-    const priceData = calculateLegacyPriceData(productData);
-
-    let products = null;
-    let product = null;
-    if (productData.length === 1) {
-        product = productData[0];
-    } else {
-        products = productData;
-    }
 
     // @TODO: only do this if something changed?
-    // @TODO: remove blog in a major where we are happy to break more themes
     {
         hbs.updateTemplateOptions({
             data: {
-                blog: siteData,
                 site: siteData,
                 labs: labsData,
                 config: themeData,
-                price: priceData,
-                product,
-                products,
                 custom: themeSettingsData
             }
         });

package/core/frontend/services/theme-engine/middleware/update-local-template-options.js

@@ -9,7 +9,7 @@ function updateLocalTemplateOptions(req, res, next) {
 
     // adjust @site.url for http/https based on the incoming request
     const siteData = {
-        url: urlUtils.urlFor('home', {secure: req.secure, trailingSlash: false}, true)
+        url: urlUtils.urlFor('home', {trailingSlash: false}, true)
     };
 
     // @TODO: it would be nicer if this was proper middleware somehow...
@@ -34,17 +34,14 @@ function updateLocalTemplateOptions(req, res, next) {
             });
         }),
         paid: req.member.status !== 'free',
-        status: req.member.status,
-        products: req.member.products
+        status: req.member.status
     } : null;
 
     hbs.updateLocalTemplateOptions(res.locals, _.merge({}, localTemplateOptions, {
         data: {
             member: member,
             site: siteData,
-            custom: customData,
-            // @deprecated: a gscan warning for @blog was added before 3.0 which replaced it with @site
-            blog: siteData
+            custom: customData
         }
     }));
 

package/core/frontend/web/middleware/static-theme.js

@@ -5,17 +5,24 @@ const themeEngine = require('../../services/theme-engine');
 const express = require('../../../shared/express');
 
 function isDeniedFile(file) {
-    const deniedFileTypes = ['.hbs', '.md', '.json'];
+    const deniedFileTypes = ['.hbs', '.md', '.json', '.lock', '.log'];
+    const deniedFiles = ['gulpfile.js', 'gruntfile.js'];
+
     const ext = path.extname(file);
+    const base = path.basename(file);
 
-    return deniedFileTypes.includes(ext);
+    return deniedFiles.includes(base) || deniedFileTypes.includes(ext);
 }
 
 function isAllowedFile(file) {
     const allowedFiles = ['manifest.json'];
+    const allowedPath = '/assets/';
+    const alwaysDeny = ['.hbs'];
+
+    const ext = path.extname(file);
     const base = path.basename(file);
 
-    return allowedFiles.includes(base);
+    return allowedFiles.includes(base) || (file.startsWith(allowedPath) && !alwaysDeny.includes(ext));
 }
 
 function forwardToExpressStatic(req, res, next) {
@@ -25,14 +32,15 @@ function forwardToExpressStatic(req, res, next) {
 
     const configMaxAge = config.get('caching:theme:maxAge');
 
-    express.static(themeEngine.getActive().path,
-        {maxAge: (configMaxAge || configMaxAge === 0) ? configMaxAge : constants.ONE_YEAR_MS}
+    express.static(themeEngine.getActive().path, {
+        maxAge: (configMaxAge || configMaxAge === 0) ? configMaxAge : constants.ONE_YEAR_MS
+    }
     )(req, res, next);
 }
 
 function staticTheme() {
     return function denyStatic(req, res, next) {
-        if (!isAllowedFile(req.path) && isDeniedFile(req.path)) {
+        if (!isAllowedFile(req.path.toLowerCase()) && isDeniedFile(req.path.toLowerCase())) {
             return next();
         }