ghost 4.48.0 → 5.0.0

package/core/server/models/post.js

@@ -16,12 +16,16 @@ const mobiledocLib = require('../lib/mobiledoc');
 const relations = require('./relations');
 const urlUtils = require('../../shared/url-utils');
 const {Tag} = require('./tag');
+const {Newsletter} = require('./newsletter');
+const {BadRequestError} = require('@tryghost/errors');
 
 const messages = {
     isAlreadyPublished: 'Your post is already published, please reload your page.',
     valueCannotBeBlank: 'Value in {key} cannot be blank.',
     expectedPublishedAtInFuture: 'Date must be at least {cannotScheduleAPostBeforeInMinutes} minutes in the future.',
-    untitled: '(Untitled)'
+    untitled: '(Untitled)',
+    notEnoughPermission: 'You do not have permission to perform this action',
+    invalidNewsletter: 'The newsletter parameter doesn\'t match any active newsletter.'
 };
 
 const MOBILEDOC_REVISIONS_COUNT = 10;
@@ -78,7 +82,7 @@ Post = ghostBookshelf.Model.extend({
             type: 'post',
             tiers,
             visibility: visibility,
-            email_recipient_filter: 'none'
+            email_recipient_filter: 'all'
         };
     },
 
@@ -135,14 +139,6 @@ Post = ghostBookshelf.Model.extend({
             }
         });
 
-        // update legacy email_recipient_filter values to proper NQL
-        if (attrs.email_recipient_filter === 'free') {
-            attrs.email_recipient_filter = 'status:free';
-        }
-        if (attrs.email_recipient_filter === 'paid') {
-            attrs.email_recipient_filter = 'status:-free';
-        }
-
         return attrs;
     },
 
@@ -186,14 +182,6 @@ Post = ghostBookshelf.Model.extend({
             }
         });
 
-        // update legacy email_recipient_filter values to proper NQL
-        if (attrs.email_recipient_filter === 'free') {
-            attrs.email_recipient_filter = 'status:free';
-        }
-        if (attrs.email_recipient_filter === 'paid') {
-            attrs.email_recipient_filter = 'status:-free';
-        }
-
         // transform visibility NQL queries to special-case values where necessary
         // ensures checks against special-case values such as `{{#has visibility="paid"}}` continue working
         if (attrs.visibility && !['public', 'members', 'paid', 'tiers'].includes(attrs.visibility)) {
@@ -638,7 +626,7 @@ Post = ghostBookshelf.Model.extend({
             if (this.get('html') === null) {
                 plaintext = null;
             } else {
-                plaintext = htmlToPlaintext(this.get('html'));
+                plaintext = htmlToPlaintext.excerpt(this.get('html'));
             }
 
             // CASE: html is e.g. <p></p>
@@ -674,20 +662,30 @@ Post = ghostBookshelf.Model.extend({
             }
         }
 
-        // newsletter_id is read-only and should only be set using a query param when publishing/scheduling
-        if (options.newsletter_id
+        // newsletter_id is read-only and should only be set using the newsletter param when publishing/scheduling
+        if (options.newsletter
             && !this.get('newsletter_id')
             && this.hasChanged('status')
             && (newStatus === 'published' || newStatus === 'scheduled')) {
-            this.set('newsletter_id', options.newsletter_id);
-        }
+            // Map the passed slug to the id + validate the passed newsletter
+            ops.push(async () => {
+                const newsletter = await Newsletter.findOne({slug: options.newsletter}, {transacting: options.transacting, filter: 'status:active'});
+                if (!newsletter) {
+                    throw new BadRequestError({
+                        message: messages.invalidNewsletter
+                    });
+                }
+                this.set('newsletter_id', newsletter.id);
+            });
 
-        // email_recipient_filter is read-only and should only be set using a query param when publishing/scheduling
-        if (options.email_recipient_filter
-            && (options.email_recipient_filter !== 'none')
-            && this.hasChanged('status')
-            && (newStatus === 'published' || newStatus === 'scheduled')) {
-            this.set('email_recipient_filter', options.email_recipient_filter);
+            // If the `email_segment` isn't passed at the same time, reset it to be 100% sure that they can only be used together
+            this.set('email_recipient_filter', 'all');
+
+            // email_segment is read-only and should only be set using a query param when publishing/scheduling
+            // we can't set it if we don't pass newsletter
+            if (options.email_segment) {
+                this.set('email_recipient_filter', options.email_segment);
+            }
         }
 
         // ensure draft posts have the email_recipient_filter reset unless an email has already been sent
@@ -695,7 +693,7 @@ Post = ghostBookshelf.Model.extend({
             ops.push(function ensureSendEmailWhenPublishedIsUnchanged() {
                 return self.related('email').fetch({transacting: options.transacting}).then((email) => {
                     if (!email) {
-                        self.set('email_recipient_filter', 'none');
+                        self.set('email_recipient_filter', 'all');
                         self.set('newsletter_id', null);
                     }
                 });
@@ -862,7 +860,7 @@ Post = ghostBookshelf.Model.extend({
      *            This is protected by the fn `permittedOptions`.
      */
     defaultColumnsToFetch: function defaultColumnsToFetch() {
-        return ['id', 'published_at', 'slug', 'author_id'];
+        return ['id', 'published_at', 'slug'];
     },
     /**
      * If the `formats` option is not used, we return `html` be default.
@@ -1029,7 +1027,7 @@ Post = ghostBookshelf.Model.extend({
             findPage: ['status'],
             findAll: ['columns', 'filter'],
             destroy: ['destroyAll', 'destroyBy'],
-            edit: ['filter', 'email_recipient_filter', 'force_rerender', 'newsletter_id']
+            edit: ['filter', 'email_segment', 'force_rerender', 'newsletter']
         };
 
         // The post model additionally supports having a formats option

package/core/server/models/relations/authors.js

@@ -17,13 +17,7 @@ const messages = {
  * We fetch the `authors` relations when you either request `withRelated=['authors']` or `withRelated=['author`].
  * The old `author` relation was removed, but we still have to support this case.
  *
- * # CASE 2
- * We fetch when editing a post.
- * Imagine you change `author_id` and you have 3 existing `posts_authors`.
- * We now need to set `author_id` as primary author `post.authors[0]`.
- * Furthermore, we now longer have a `author` relationship.
- *
- * # CASE 3:
+ * # CASE 2:
  * If you request `include=author`, we have to fill this object with `post.authors[0]`.
  * Otherwise we can't return `post.author = User`.
  *
@@ -85,19 +79,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             return proto.onFetchingCollection.call(this, collection, attrs, options);
         },
 
-        // NOTE: sending `post.author = {}` was always ignored [unsupported]
         onCreating: function onCreating(model, attrs, options) {
-            if (!model.get('author_id')) {
-                if (model.get('authors')) {
-                    model.set('author_id', model.get('authors')[0].id);
-                } else {
-                    model.set('author_id', this.contextUser(options));
-                }
-            }
-
             if (!model.get('authors')) {
                 model.set('authors', [{
-                    id: model.get('author_id')
+                    id: this.contextUser(options)
                 }]);
             }
 
@@ -141,44 +126,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             }
 
             ops.push(() => {
-                // CASE: `post.author_id` has changed
-                if (model.hasChanged('author_id')) {
-                    // CASE: you don't send `post.authors`
-                    // SOLUTION: we have to update the primary author
-                    if (!model.get('authors')) {
-                        let existingAuthors = model.related('authors').toJSON();
-
-                        // CASE: override primary author
-                        existingAuthors[0] = {
-                            id: model.get('author_id')
-                        };
-
-                        model.set('authors', existingAuthors);
-                    } else {
-                        // CASE: you send `post.authors` next to `post.author_id`
-                        if (model.get('authors')[0].id !== model.get('author_id')) {
-                            model.set('author_id', model.get('authors')[0].id);
-                        }
-                    }
-                }
-
-                // CASE: if you change `post.author_id`, we have to update the primary author
-                // CASE: if the `author_id` has change and you pass `posts.authors`, we already check above that
-                //       the primary author id must be equal
-                if (model.hasChanged('author_id') && !model.get('authors')) {
-                    let existingAuthors = model.related('authors').toJSON();
-
-                    // CASE: override primary author
-                    existingAuthors[0] = {
-                        id: model.get('author_id')
-                    };
-
-                    model.set('authors', existingAuthors);
-                } else if (model.get('authors') && model.get('authors').length) {
-                    // ensure we update the primary author id
-                    model.set('author_id', model.get('authors')[0].id);
-                }
-
                 return proto.onSaving.call(this, model, attrs, options);
             });
 
@@ -207,14 +154,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                 }
 
                 attrs.author = attrs.authors[0];
-                delete attrs.author_id;
-            } else {
-                // CASE: we return `post.author=id` with or without requested columns.
-                // @NOTE: this serialization should be moved into api layer, it's not being moved as it's deprecated
-                if (!options.columns || (options.columns && options.columns.indexOf('author') !== -1)) {
-                    attrs.author = attrs.author_id;
-                    delete attrs.author_id;
-                }
             }
 
             // CASE: `posts.authors` was not requested, but fetched in specific cases (see top)
@@ -294,12 +233,14 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
     }, {
         /**
-         * ### destroyByAuthor
-         * @param  {[type]} options has context and id. Context is the user doing the destroy, id is the user to destroy
+         * ### reassignByAuthor
+         * @param  {Object} unfilteredOptions has context and id. Context is the user doing the destroy, id is the user to destroy
+         * @param {string} unfilteredOptions.id
+         * @param {Object} unfilteredOptions.context
+         * @param {Object} unfilteredOptions.transacting
          */
-        destroyByAuthor: function destroyByAuthor(unfilteredOptions) {
-            let options = this.filterOptions(unfilteredOptions, 'destroyByAuthor', {extraAllowedProperties: ['id']});
-            let postCollection = Posts.forge();
+        reassignByAuthor: async function reassignByAuthor(unfilteredOptions) {
+            let options = this.filterOptions(unfilteredOptions, 'reassignByAuthor', {extraAllowedProperties: ['id']});
             let authorId = options.id;
 
             if (!authorId) {
@@ -308,34 +249,76 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                 }));
             }
 
-            // CASE: if you are the primary author of a post, the whole post and it's relations get's deleted.
-            //       `posts_authors` are automatically removed (bookshelf-relations)
-            // CASE: if you are the secondary author of a post, you are just deleted as author.
-            //       must happen manually
-            const destroyPost = (() => {
-                return postCollection
-                    .query('where', 'author_id', '=', authorId)
-                    .fetch(options)
-                    .call('invokeThen', 'destroy', options)
-                    .then(function (response) {
-                        return (options.transacting || ghostBookshelf.knex)('posts_authors')
-                            .where('author_id', authorId)
-                            .del()
-                            .then(() => response);
-                    })
-                    .catch((err) => {
-                        throw new errors.InternalServerError({err: err});
-                    });
+            const reassignPost = (async () => {
+                let trx = options.transacting;
+                let knex = ghostBookshelf.knex;
+
+                try {
+                    // There's only one possible owner per Ghost instance
+                    const ownerUser = await knex('roles')
+                        .transacting(trx)
+                        .join('roles_users', 'roles.id', '=', 'roles_users.role_id')
+                        .where('roles.name', 'Owner')
+                        .select('roles_users.user_id');
+                    const ownerId = ownerUser[0].user_id;
+
+                    const authorsPosts = await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', authorId)
+                        .select('post_id', 'sort_order');
+
+                    const ownersPosts = await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', ownerId)
+                        .select('post_id');
+
+                    const authorsPrimaryPosts = authorsPosts.filter(ap => ap.sort_order === 0);
+                    const primaryPostsWithOwnerCoauthor = _.intersectionBy(authorsPrimaryPosts, ownersPosts, 'post_id');
+                    const primaryPostsWithOwnerCoauthorIds = primaryPostsWithOwnerCoauthor.map(post => post.post_id);
+
+                    // remove author and bump owner's sort_order to 0 to make them a primary author
+                    // remove author from posts
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', primaryPostsWithOwnerCoauthorIds)
+                        .where('author_id', authorId)
+                        .del();
+
+                    // make the owner a primary author
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', primaryPostsWithOwnerCoauthorIds)
+                        .where('author_id', ownerId)
+                        .update('sort_order', 0);
+
+                    const primaryPostsWithoutOwnerCoauthor = _.differenceBy(authorsPrimaryPosts, primaryPostsWithOwnerCoauthor, 'post_id');
+                    const postsWithoutOwnerCoauthorIds = primaryPostsWithoutOwnerCoauthor.map(post => post.post_id);
+
+                    // swap out current author with the owner
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', postsWithoutOwnerCoauthorIds)
+                        .where('author_id', authorId)
+                        .update('author_id', ownerId);
+
+                    // remove author as secondary author from any other posts
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', authorId)
+                        .del();
+                } catch (err) {
+                    throw new errors.InternalServerError({err: err});
+                }
             });
 
             if (!options.transacting) {
                 return ghostBookshelf.transaction((transacting) => {
                     options.transacting = transacting;
-                    return destroyPost();
+                    return reassignPost();
                 });
             }
 
-            return destroyPost();
+            return reassignPost();
         },
 
         permissible: function permissible(postModelOrId, action, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission) {
@@ -375,10 +358,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             isAdd = (action === 'add');
             isDestroy = (action === 'destroy');
 
-            function isChanging(attr) {
-                return unsafeAttrs[attr] && unsafeAttrs[attr] !== postModel.get(attr);
-            }
-
             function isChangingAuthors() {
                 if (!unsafeAttrs.authors) {
                     return false;
@@ -394,14 +373,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             function isOwner() {
                 let isCorrectOwner = true;
 
-                if (!unsafeAttrs.author_id && !unsafeAttrs.authors) {
+                if (!unsafeAttrs.authors) {
                     return false;
                 }
 
-                if (unsafeAttrs.author_id) {
-                    isCorrectOwner = unsafeAttrs.author_id && unsafeAttrs.author_id === context.user;
-                }
-
                 if (unsafeAttrs.authors) {
                     isCorrectOwner = isCorrectOwner && unsafeAttrs.authors.length && unsafeAttrs.authors[0].id === context.user;
                 }
@@ -418,13 +393,13 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             }
 
             if (isContributor && isEdit) {
-                hasUserPermission = !isChanging('author_id') && !isChangingAuthors() && isCoAuthor();
+                hasUserPermission = !isChangingAuthors() && isCoAuthor();
             } else if (isContributor && isAdd) {
                 hasUserPermission = isOwner();
             } else if (isContributor && isDestroy) {
                 hasUserPermission = isPrimaryAuthor();
             } else if (isAuthor && isEdit) {
-                hasUserPermission = isCoAuthor() && !isChanging('author_id') && !isChangingAuthors();
+                hasUserPermission = isCoAuthor() && !isChangingAuthors();
             } else if (isAuthor && isAdd) {
                 hasUserPermission = isOwner();
             } else if (postModel) {
@@ -444,7 +419,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                     // @TODO: we need a concept for making a diff between incoming authors and existing authors
                     // @TODO: for now we simply re-use the new concept of `excludedAttrs`
                     // We only check the primary author of `authors`, any other change will be ignored.
-                    // By this we can deprecate `author_id` more easily.
                     if (isContributor || isAuthor) {
                         return {
                             excludedAttrs: ['authors'].concat(excludedAttrs)

package/core/server/models/settings.js

@@ -53,8 +53,7 @@ function parseDefaultSettings() {
     const dynamicDefault = {
         db_hash: () => uuid.v4(),
         public_hash: () => crypto.randomBytes(15).toString('hex'),
-        // @TODO: session_secret would ideally be named "admin_session_secret"
-        session_secret: () => crypto.randomBytes(32).toString('hex'),
+        admin_session_secret: () => crypto.randomBytes(32).toString('hex'),
         theme_session_secret: () => crypto.randomBytes(32).toString('hex'),
         members_public_key: () => getMembersKey('public'),
         members_private_key: () => getMembersKey('private'),
@@ -217,6 +216,11 @@ Settings = ghostBookshelf.Model.extend({
                 return Promise.reject(new errors.ValidationError({message: tpl(messages.valueCannotBeBlank)}));
             }
 
+            // Ensure that object keys are stringified
+            if (_.isObject(item.value)) {
+                item.value = JSON.stringify(item.value);
+            }
+
             item = self.filterData(item);
 
             return Settings.forge({key: item.key}).fetch(options).then(function then(setting) {

package/core/server/models/webhook.js

@@ -1,5 +1,6 @@
 const Promise = require('bluebird');
 const ghostBookshelf = require('./base');
+const ghostVersion = require('@tryghost/version');
 let Webhook;
 let Webhooks;
 
@@ -8,7 +9,7 @@ Webhook = ghostBookshelf.Model.extend({
 
     defaults() {
         return {
-            api_version: 'v4',
+            api_version: `v${ghostVersion.safe}`,
             status: 'available'
         };
     },

package/core/server/run-update-check.js

@@ -38,7 +38,7 @@ if (parentPort) {
     const permissions = require('./services/permissions');
     await permissions.init();
 
-    const settings = require('./services/settings');
+    const settings = require('./services/settings/settings-service');
     await settings.init();
     // Finished INIT
 

package/core/server/services/api-version-compatibility/index.js

@@ -1,38 +1,41 @@
 const APIVersionCompatibilityService = require('@tryghost/api-version-compatibility-service');
-const VersionNotificationsDataService = require('@tryghost/version-notifications-data-service');
 const versionMismatchHandler = require('@tryghost/mw-api-version-mismatch');
-// const {GhostMailer} = require('../mail');
-const settingsService = require('../../services/settings');
-const models = require('../../models');
-const logging = require('@tryghost/logging');
 const ghostVersion = require('@tryghost/version');
+const {GhostMailer} = require('../mail');
+const settingsService = require('../settings/settings-service');
+const models = require('../../models');
+const urlUtils = require('../../../shared/url-utils');
+const settingsCache = require('../../../shared/settings-cache');
 
 let serviceInstance;
 
 const init = () => {
-    //const ghostMailer = new GhostMailer();
-    const versionNotificationsDataService = new VersionNotificationsDataService({
-        UserModel: models.User,
-        settingsService: settingsService.getSettingsBREADServiceInstance()
-    });
+    const ghostMailer = new GhostMailer();
 
     serviceInstance = new APIVersionCompatibilityService({
+        UserModel: models.User,
+        ApiKeyModel: models.ApiKey,
+        settingsService: settingsService.getSettingsBREADServiceInstance(),
         sendEmail: (options) => {
             // NOTE: not using bind here because mockMailer is having trouble mocking bound methods
-            //return ghostMailer.send(options);
-            // For now log a warning, rather than sending an email
-            logging.warn(options.html);
+            return ghostMailer.send(options);
         },
-        fetchEmailsToNotify: versionNotificationsDataService.getNotificationEmails.bind(versionNotificationsDataService),
-        fetchHandled: versionNotificationsDataService.fetchNotification.bind(versionNotificationsDataService),
-        saveHandled: versionNotificationsDataService.saveNotification.bind(versionNotificationsDataService)
+        getSiteUrl: () => urlUtils.urlFor('home', true),
+        getSiteTitle: () => settingsCache.get('title')
     });
 };
 
-module.exports.errorHandler = (req, res, next) => {
-    return versionMismatchHandler(serviceInstance)(req, res, next);
+module.exports.errorHandler = (err, req, res, next) => {
+    return versionMismatchHandler(serviceInstance)(err, req, res, next);
 };
 
+/**
+ * If Accept-Version is set on the request set Content-Version on the response
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
 module.exports.contentVersion = (req, res, next) => {
     if (req.header('accept-version')) {
         res.header('Content-Version', `v${ghostVersion.safe}`);
@@ -40,4 +43,7 @@ module.exports.contentVersion = (req, res, next) => {
     next();
 };
 
+module.exports.versionRewrites = require('./mw-version-rewrites');
+module.exports.legacyApiPathMatch = require('./legacy-api-path-match');
+
 module.exports.init = init;

package/core/server/services/api-version-compatibility/legacy-api-path-match.js

@@ -0,0 +1,23 @@
+const pathMatch = require('path-match')();
+
+module.exports = (url) => {
+    let basePath = 'ghost/api';
+    let apiRouteMatcher = '/:version(v2|v3|v4|canary)?/:api(admin|content)/*';
+    let urlToMatch = url;
+
+    if (url.includes(basePath)) {
+        urlToMatch = url.split(basePath)[1];
+    }
+
+    if (!urlToMatch.endsWith('/')) {
+        urlToMatch += '/';
+    }
+
+    let {version, api} = pathMatch(apiRouteMatcher)(urlToMatch);
+
+    if (version === [null]) {
+        version = null;
+    }
+
+    return {version, api};
+};

package/core/server/services/api-version-compatibility/mw-version-rewrites.js

@@ -0,0 +1,36 @@
+const legacyApiPathMatch = require('./legacy-api-path-match');
+const urlUtils = require('../../../shared/url-utils');
+
+/**
+ * If there is a version in the URL, and this is a valid API URL containing admin/content
+ * Rewrite the URL and add the accept-version & deprecation headers
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+module.exports = (req, res, next) => {
+    let {version} = legacyApiPathMatch(req.url);
+
+    // If we don't match a valid version, carry on
+    if (!version) {
+        return next();
+    }
+
+    const versionlessUrl = req.url.replace(`${version}/`, '');
+
+    // Always send the explicit, numeric version in headers
+    if (version === 'canary') {
+        version = 'v4';
+    }
+
+    // Rewrite the url
+    req.url = versionlessUrl;
+
+    // Add the accept-version header so our internal systems will act as if it was set on the request
+    req.headers['accept-version'] = req.headers['accept-version'] || `${version}.0`;
+
+    res.header('Deprecation', `version="${version}"`);
+    res.header('Link', `<${urlUtils.urlJoin(urlUtils.urlFor('admin', true), 'api', versionlessUrl)}>; rel="latest-version"`);
+
+    next();
+};

package/core/server/services/auth/api-key/admin.js

@@ -3,7 +3,7 @@ const url = require('url');
 const models = require('../../../models');
 const errors = require('@tryghost/errors');
 const limitService = require('../../../services/limits');
-const config = require('../../../../shared/config');
+const {legacyApiPathMatch} = require('../../../services/api-version-compatibility');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 
@@ -139,19 +139,20 @@ const authenticateWithToken = async (req, res, next, {token, JWT_OPTIONS}) => {
         // https://github.com/auth0/node-jsonwebtoken/issues/208#issuecomment-231861138
         const secret = Buffer.from(apiKey.get('secret'), 'hex');
 
-        const {pathname} = url.parse(req.originalUrl);
-        const [hasMatch, version, api] = pathname.match(/ghost\/api\/([^/]+)\/([^/]+)\/(.+)*/); // eslint-disable-line no-unused-vars
+        // Using req.originalUrl means we get the right url even if version-rewrites have happened
+        const {version, api} = legacyApiPathMatch(req.originalUrl);
 
         // ensure the token was meant for this api
         let options;
-        if (!config.get('api:versions:all').includes(version)) {
-            // CASE: non-versioned api request
+
+        if (version) {
+            // CASE: legacy versioned api request
             options = Object.assign({
-                audience: new RegExp(`\/?${version}\/?$`) // eslint-disable-line no-useless-escape
+                audience: new RegExp(`/?${version}/${api}/?$`)
             }, JWT_OPTIONS);
         } else {
             options = Object.assign({
-                audience: new RegExp(`\/?${version}\/${api}\/?$`) // eslint-disable-line no-useless-escape
+                audience: new RegExp(`/?${api}/?$`)
             }, JWT_OPTIONS);
         }
 

package/core/server/services/auth/passwordreset.js

@@ -61,10 +61,10 @@ function generateToken(email, settingsAPI, transaction) {
 }
 
 function extractTokenParts(options) {
-    options.data.passwordreset[0].token = security.url.decodeBase64(options.data.passwordreset[0].token);
+    options.data.password_reset[0].token = security.url.decodeBase64(options.data.password_reset[0].token);
 
     const tokenParts = security.tokens.resetToken.extract({
-        token: options.data.passwordreset[0].token
+        token: options.data.password_reset[0].token
     });
 
     if (!tokenParts) {
@@ -93,7 +93,7 @@ function protectBruteForce({options, tokenParts}) {
 function doReset(options, tokenParts, settingsAPI) {
     let dbHash;
 
-    const data = options.data.passwordreset[0];
+    const data = options.data.password_reset[0];
     const resetToken = data.token;
     const oldPassword = data.oldPassword;
     const newPassword = data.newPassword;

package/core/server/services/auth/session/express-session.js

@@ -15,7 +15,7 @@ function getExpressSessionMiddleware() {
     if (!unoExpressSessionMiddleware) {
         unoExpressSessionMiddleware = session({
             store: sessionStore,
-            secret: settingsCache.get('session_secret'),
+            secret: settingsCache.get('admin_session_secret'),
             resave: false,
             saveUninitialized: false,
             name: 'ghost-admin-api-session',

package/core/server/services/auth/session/index.js

@@ -32,7 +32,7 @@ const sessionService = createSessionService({
     getOriginOfRequest,
     getSession: expressSession.getSession,
     findUserById({id}) {
-        return models.User.findOne({id});
+        return models.User.findOne({id, status: 'active'});
     }
 });