ghost 4.47.3 → 5.0.0

package/core/server/api/v2/oembed.js

@@ -1,186 +0,0 @@
-const errors = require('@tryghost/errors');
-const {extract, hasProvider} = require('oembed-parser');
-const Promise = require('bluebird');
-const cheerio = require('cheerio');
-const _ = require('lodash');
-const config = require('../../../shared/config');
-const tpl = require('@tryghost/tpl');
-const externalRequest = require('../../lib/request-external');
-
-const messages = {
-    unknownProvider: 'No provider found for supplied URL.'
-};
-
-const findUrlWithProvider = (url) => {
-    let provider;
-
-    // build up a list of URL variations to test against because the oembed
-    // providers list is not always up to date with scheme or www vs non-www
-    let baseUrl = url.replace(/^\/\/|^https?:\/\/(?:www\.)?/, '');
-    let testUrls = [
-        `http://${baseUrl}`,
-        `https://${baseUrl}`,
-        `http://www.${baseUrl}`,
-        `https://www.${baseUrl}`
-    ];
-
-    for (let testUrl of testUrls) {
-        provider = hasProvider(testUrl);
-        if (provider) {
-            url = testUrl;
-            break;
-        }
-    }
-
-    return {url, provider};
-};
-
-function unknownProvider(url) {
-    return Promise.reject(new errors.ValidationError({
-        message: tpl(messages.unknownProvider),
-        context: url
-    }));
-}
-
-function knownProvider(url) {
-    return extract(url, {maxwidth: 1280}).catch((err) => {
-        return Promise.reject(new errors.InternalServerError({
-            message: err.message
-        }));
-    });
-}
-
-function isIpOrLocalhost(url) {
-    try {
-        const IPV4_REGEX = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
-        const IPV6_REGEX = /:/; // fqdns will not have colons
-        const HTTP_REGEX = /^https?:/i;
-
-        const siteUrl = new URL(config.get('url'));
-        const {protocol, hostname, host} = new URL(url);
-
-        // allow requests to Ghost's own url through
-        if (siteUrl.host === host) {
-            return false;
-        }
-
-        if (!HTTP_REGEX.test(protocol) || hostname === 'localhost' || IPV4_REGEX.test(hostname) || IPV6_REGEX.test(hostname)) {
-            return true;
-        }
-
-        return false;
-    } catch (e) {
-        return true;
-    }
-}
-
-function fetchOembedData(_url) {
-    // parse the url then validate the protocol and host to make sure it's
-    // http(s) and not an IP address or localhost to avoid potential access to
-    // internal network endpoints
-    if (isIpOrLocalhost(_url)) {
-        return unknownProvider();
-    }
-
-    // check against known oembed list
-    let {url, provider} = findUrlWithProvider(_url);
-    if (provider) {
-        return knownProvider(url);
-    }
-
-    // url not in oembed list so fetch it in case it's a redirect or has a
-    // <link rel="alternate" type="application/json+oembed"> element
-    return externalRequest(url, {
-        method: 'GET',
-        timeout: 2 * 1000,
-        followRedirect: true
-    }).then((pageResponse) => {
-        // url changed after fetch, see if we were redirected to a known oembed
-        if (pageResponse.url !== url) {
-            ({url, provider} = findUrlWithProvider(pageResponse.url));
-            if (provider) {
-                return knownProvider(url);
-            }
-        }
-
-        // check for <link rel="alternate" type="application/json+oembed"> element
-        let oembedUrl;
-        try {
-            oembedUrl = cheerio('link[type="application/json+oembed"]', pageResponse.body).attr('href');
-        } catch (e) {
-            return unknownProvider(url);
-        }
-
-        if (oembedUrl) {
-            // make sure the linked url is not an ip address or localhost
-            if (isIpOrLocalhost(oembedUrl)) {
-                return unknownProvider(oembedUrl);
-            }
-
-            // fetch oembed response from embedded rel="alternate" url
-            return externalRequest(oembedUrl, {
-                method: 'GET',
-                json: true,
-                timeout: 2 * 1000,
-                followRedirect: true
-            }).then((oembedResponse) => {
-                // validate the fetched json against the oembed spec to avoid
-                // leaking non-oembed responses
-                const body = oembedResponse.body;
-                const hasRequiredFields = body.type && body.version;
-                const hasValidType = ['photo', 'video', 'link', 'rich'].includes(body.type);
-
-                if (hasRequiredFields && hasValidType) {
-                    // extract known oembed fields from the response to limit leaking of unrecognised data
-                    const knownFields = [
-                        'type',
-                        'version',
-                        'html',
-                        'url',
-                        'title',
-                        'width',
-                        'height',
-                        'author_name',
-                        'author_url',
-                        'provider_name',
-                        'provider_url',
-                        'thumbnail_url',
-                        'thumbnail_width',
-                        'thumbnail_height'
-                    ];
-                    const oembed = _.pick(body, knownFields);
-
-                    // ensure we have required data for certain types
-                    if (oembed.type === 'photo' && !oembed.url) {
-                        return;
-                    }
-                    if ((oembed.type === 'video' || oembed.type === 'rich') && (!oembed.html || !oembed.width || !oembed.height)) {
-                        return;
-                    }
-
-                    // return the extracted object, don't pass through the response body
-                    return oembed;
-                }
-            }).catch(() => {});
-        }
-    });
-}
-
-module.exports = {
-    docName: 'oembed',
-
-    read: {
-        permissions: false,
-        data: [
-            'url'
-        ],
-        options: [],
-        query({data: {url}}) {
-            return fetchOembedData(url).then((response) => {
-                return response || unknownProvider(url);
-            }).catch(() => {
-                return unknownProvider(url);
-            });
-        }
-    }
-};

package/core/server/api/v2/pages-public.js

@@ -1,78 +0,0 @@
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-const ALLOWED_INCLUDES = ['tags', 'authors'];
-
-const messages = {
-    pageNotFound: 'Page not found'
-};
-
-module.exports = {
-    docName: 'pages',
-
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'formats',
-            'absolute_urls',
-            'page',
-            'limit',
-            'order',
-            'debug'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Post.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'fields',
-            'formats',
-            'debug',
-            'absolute_urls'
-        ],
-        data: [
-            'id',
-            'slug',
-            'uuid'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Post.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        throw new errors.NotFoundError({
-                            message: tpl(messages.pageNotFound)
-                        });
-                    }
-
-                    return model;
-                });
-        }
-    }
-};

package/core/server/api/v2/pages.js

@@ -1,197 +0,0 @@
-const models = require('../../models');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const getPostServiceInstance = require('../../services/posts/posts-service');
-const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles'];
-const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];
-
-const messages = {
-    pageNotFound: 'Page not found.'
-};
-
-const postsService = getPostServiceInstance('v2');
-
-module.exports = {
-    docName: 'pages',
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'formats',
-            'limit',
-            'order',
-            'page',
-            'debug',
-            'absolute_urls'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts',
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        query(frame) {
-            return models.Post.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'fields',
-            'formats',
-            'debug',
-            'absolute_urls',
-            // NOTE: only for internal context
-            'forUpdate',
-            'transacting'
-        ],
-        data: [
-            'id',
-            'slug',
-            'uuid'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts',
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        query(frame) {
-            return models.Post.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        throw new errors.NotFoundError({
-                            message: tpl(messages.pageNotFound)
-                        });
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    add: {
-        statusCode: 201,
-        headers: {},
-        options: [
-            'include',
-            'source'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                source: {
-                    values: ['html']
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts',
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        query(frame) {
-            return models.Post.add(frame.data.pages[0], frame.options)
-                .then((model) => {
-                    if (model.get('status') !== 'published') {
-                        this.headers.cacheInvalidate = false;
-                    } else {
-                        this.headers.cacheInvalidate = true;
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    edit: {
-        headers: {},
-        options: [
-            'include',
-            'id',
-            'source',
-            // NOTE: only for internal context
-            'forUpdate',
-            'transacting'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                id: {
-                    required: true
-                },
-                source: {
-                    values: ['html']
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts',
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        async query(frame) {
-            const model = await models.Post.edit(frame.data.pages[0], frame.options);
-
-            this.headers.cacheInvalidate = postsService.handleCacheInvalidation(model);
-
-            return model;
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'include',
-            'id'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts',
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        query(frame) {
-            frame.options.require = true;
-
-            return models.Post.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Post.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.pageNotFound)
-                    }));
-                });
-        }
-    }
-};

package/core/server/api/v2/posts-public.js

@@ -1,78 +0,0 @@
-const models = require('../../models');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const allowedIncludes = ['tags', 'authors'];
-
-const messages = {
-    postNotFound: 'Post not found.'
-};
-
-module.exports = {
-    docName: 'posts',
-
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'formats',
-            'limit',
-            'order',
-            'page',
-            'debug',
-            'absolute_urls'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Post.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'fields',
-            'formats',
-            'debug',
-            'absolute_urls'
-        ],
-        data: [
-            'id',
-            'slug',
-            'uuid'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Post.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        throw new errors.NotFoundError({
-                            message: tpl(messages.postNotFound)
-                        });
-                    }
-
-                    return model;
-                });
-        }
-    }
-};