ghost 5.116.2 → 5.118.0

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.116%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2270b6e1c5ab%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22fd54878445%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22f374d17369%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%22bff4438287%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%222c1461dad3%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%22ffcc9f090c%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.118%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2270b6e1c5ab%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22fd54878445%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22dfc54ca9f9%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%2245376f8ac6%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%222be41c1d8b%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%22a6a4e7e500%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-8e3ee8261528bb429cfe78ce79a4a82a.js"></script>
-<script src="assets/chunk.713.761d11035fe0bf3e557c.js"></script>
-<script src="assets/chunk.524.578de86e5014b911b05a.js"></script>
-    <script src="assets/ghost-868c537d5c02ca65323d0122596a67ec.js"></script>
+<script src="assets/chunk.713.48f120c377bcaffdfddf.js"></script>
+<script src="assets/chunk.524.5710919eb507b9a81166.js"></script>
+    <script src="assets/ghost-cd90a28b214ee800a007bb62cd45e6e6.js"></script>
 </body>
 </html>

package/core/frontend/helpers/social_url.js

@@ -0,0 +1,31 @@
+// # Social URL Helper
+// Usage: `{{social_url type="platform"}}` (e.g., type="facebook", type="twitter")
+//
+// Output a url for a social media username defined in site settings.
+const {socialUrls} = require('../services/proxy');
+const {localUtils} = require('../services/handlebars');
+
+// We use the name social_url to match the helper for consistency:
+module.exports = function social_url(options) { // eslint-disable-line camelcase
+    // Check for required hash option 'type'
+    if (!options || !options.hash || !options.hash.type) {
+        return null;
+    }
+
+    const platform = options.hash.type;
+    const siteData = options.data && options.data.site;
+
+    if (!siteData) {
+        return null;
+    }
+
+    // Use localUtils.findKey for potential context fallback, though siteData is primary
+    const username = localUtils.findKey(platform, this, siteData);
+
+    // Check if the platform is supported by socialUrls and the username exists
+    if (username && typeof socialUrls[platform] === 'function') {
+        return socialUrls[platform](username);
+    }
+
+    return null;
+};

package/core/server/api/endpoints/users.js

@@ -53,6 +53,13 @@ function shouldInvalidateCacheAfterChange(model) {
         'location',
         'facebook',
         'twitter',
+        'mastodon',
+        'youtube',
+        'linkedin',
+        'bluesky',
+        'instagram',
+        'tiktok',
+        'threads',
         'status',
         'visibility',
         'meta_title',

package/core/server/api/endpoints/utils/serializers/output/config.js

@@ -21,7 +21,8 @@ module.exports = {
             'tenor',
             'pintura',
             'signupForm',
-            'stats'
+            'stats',
+            'security'
         ];
 
         frame.response = {

package/core/server/data/migrations/versions/5.117/2025-04-14-02-36-30-add-additional-social-accounts-columns-to-user-table.js

@@ -0,0 +1,38 @@
+const {combineNonTransactionalMigrations, createAddColumnMigration} = require('../../utils');
+module.exports = combineNonTransactionalMigrations(
+    createAddColumnMigration('users', 'threads', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'bluesky', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'mastodon', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'tiktok', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'youtube', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'instagram', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    }),
+    createAddColumnMigration('users', 'linkedin', {
+        type: 'string',
+        maxlength: 191,
+        nullable: true
+    })
+);

package/core/server/data/schema/schema.js

@@ -131,6 +131,13 @@ module.exports = {
         location: {type: 'text', maxlength: 65535, nullable: true, validations: {isLength: {max: 150}}},
         facebook: {type: 'string', maxlength: 2000, nullable: true},
         twitter: {type: 'string', maxlength: 2000, nullable: true},
+        threads: {type: 'string', maxlength: 191, nullable: true},
+        bluesky: {type: 'string', maxlength: 191, nullable: true},
+        mastodon: {type: 'string', maxlength: 191, nullable: true},
+        tiktok: {type: 'string', maxlength: 191, nullable: true},
+        youtube: {type: 'string', maxlength: 191, nullable: true},
+        instagram: {type: 'string', maxlength: 191, nullable: true},
+        linkedin: {type: 'string', maxlength: 191, nullable: true},
         accessibility: {type: 'text', maxlength: 65535, nullable: true},
         status: {
             type: 'string',

package/core/server/services/auth/session/index.js

@@ -5,12 +5,12 @@ const createSessionMiddleware = require('./middleware');
 const settingsCache = require('../../../../shared/settings-cache');
 const {GhostMailer} = require('../../mail');
 const {t} = require('../../i18n');
-const labs = require('../../../../shared/labs');
 
 const expressSession = require('./express-session');
 
 const models = require('../../../models');
 const urlUtils = require('../../../../shared/url-utils');
+const config = require('../../../../shared/config');
 const {blogIcon} = require('../../../lib/image');
 const url = require('url');
 
@@ -47,13 +47,16 @@ const sessionService = createSessionService({
     getSettingsCache(key) {
         return settingsCache.get(key);
     },
+    isStaffDeviceVerificationDisabled() {
+        // This config flag is set to true by default, so we need to check for false
+        return config.get('security:staffDeviceVerification') !== true;
+    },
     getBlogLogo() {
         return blogIcon.getIconUrl({absolute: true, fallbackToDefault: false})
             || 'https://static.ghost.org/v4.0.0/images/ghost-orb-1.png';
     },
     mailer,
     urlUtils,
-    labs,
     t
 });
 

package/core/server/services/auth/session/middleware.js

@@ -15,7 +15,8 @@ function SessionMiddleware({sessionService}) {
             } else {
                 await sessionService.sendAuthCodeToUser(req, res);
                 throw new errors.NoPermissionError({
-                    code: '2FA_TOKEN_REQUIRED',
+                    code: sessionService.isVerificationRequired() ? '2FA_TOKEN_REQUIRED' : '2FA_NEW_DEVICE_DETECTED',
+                    context: 'A 6-digit sign-in verification code has been sent to your email to keep your account safe.',
                     errorType: 'Needs2FAError',
                     message: 'User must verify session to login.'
                 });

package/core/server/services/auth/session/session-service.js

@@ -57,9 +57,9 @@ totp.options = {
  * @param {(key: 'require_email_mfa' | 'admin_session_secret' | 'title') => boolean | string} deps.getSettingsCache
  * @param {() => string} deps.getBlogLogo
  * @param {import('../../core/core/server/services/mail').GhostMailer} deps.mailer
- * @param {import('../../core/core/shared/labs')} deps.labs
  * @param {import('../../core/core/server/services/i18n').t} deps.t
  * @param {import('../../core/core/shared/url-utils')} deps.urlUtils
+ * @param {() => boolean} deps.isStaffDeviceVerificationDisabled
  * @returns {SessionService}
  */
 
@@ -71,7 +71,7 @@ module.exports = function createSessionService({
     getBlogLogo,
     mailer,
     urlUtils,
-    labs,
+    isStaffDeviceVerificationDisabled,
     t
 }) {
     /**
@@ -128,7 +128,7 @@ module.exports = function createSessionService({
         session.user_agent = req.get('user-agent');
         session.ip = req.ip;
 
-        if (!labs.isSet('staff2fa')) {
+        if (isStaffDeviceVerificationDisabled()) {
             session.verified = true;
         }
     }
@@ -260,7 +260,7 @@ module.exports = function createSessionService({
         const siteTitle = getSettingsCache('title');
         const siteLogo = getBlogLogo();
         const siteUrl = urlUtils.urlFor('home', true);
-        const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
+        const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)','i'));
         const siteDomain = (domain && domain[1]);
         const email = emailTemplate({
             t,
@@ -271,7 +271,7 @@ module.exports = function createSessionService({
             siteLogo: siteLogo,
             token: token,
             deviceDetails: await getDeviceDetails(session.user_agent, session.ip),
-            is2FARequired: this.isVerificationRequired()
+            is2FARequired: isVerificationRequired()
         });
 
         try {
@@ -320,7 +320,7 @@ module.exports = function createSessionService({
     async function removeUserForSession(req, res) {
         const session = await getSession(req, res);
 
-        if (this.isVerificationRequired()) {
+        if (isVerificationRequired()) {
             session.verified = undefined;
         }
 
@@ -370,5 +370,6 @@ module.exports = function createSessionService({
         verifyAuthCodeForUser,
         generateAuthCodeForUser,
         isVerificationRequired
+
     };
 };

package/core/server/services/members/api.js

@@ -1,7 +1,7 @@
 const stripeService = require('../stripe');
 const settingsCache = require('../../../shared/settings-cache');
 const settingsHelpers = require('../../services/settings-helpers');
-const MembersApi = require('@tryghost/members-api');
+const MembersApi = require('./members-api/members-api');
 const logging = require('@tryghost/logging');
 const mail = require('../mail');
 const models = require('../../models');
@@ -25,7 +25,7 @@ const sharedConfig = require('../../../shared/config');
 
 const MAGIC_LINK_TOKEN_VALIDITY = 24 * 60 * 60 * 1000;
 const MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE = 10 * 60 * 1000;
-const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 3;
+const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 7;
 
 const ghostMailer = new mail.GhostMailer();
 

package/core/server/services/members/members-api/controllers/MemberController.js

@@ -0,0 +1,214 @@
+const errors = require('@tryghost/errors');
+const tpl = require('@tryghost/tpl');
+
+const messages = {
+    blockedEmailDomain: 'Memberships from this email domain are currently restricted.'
+};
+
+module.exports = class MemberController {
+    /**
+     * @param {object} deps
+     * @param {any} deps.memberRepository
+     * @param {any} deps.productRepository
+     * @param {any} deps.paymentsService
+     * @param {any} deps.tiersService
+     * @param {any} deps.StripePrice
+     * @param {any} deps.tokenService
+     * @param {any} deps.sendEmailWithMagicLink
+     * @param {any} deps.settingsCache
+     */
+    constructor({
+        memberRepository,
+        productRepository,
+        paymentsService,
+        tiersService,
+        StripePrice,
+        tokenService,
+        sendEmailWithMagicLink,
+        settingsCache
+    }) {
+        this._memberRepository = memberRepository;
+        this._productRepository = productRepository;
+        this._paymentsService = paymentsService;
+        this._tiersService = tiersService;
+        this._StripePrice = StripePrice;
+        this._tokenService = tokenService;
+        this._sendEmailWithMagicLink = sendEmailWithMagicLink;
+        this._settingsCache = settingsCache;
+    }
+
+    async updateEmailAddress(req, res) {
+        const identity = req.body.identity;
+        const email = req.body.email;
+        const options = {
+            forceEmailType: true
+        };
+
+        if (!identity) {
+            res.writeHead(403);
+            return res.end('No Permission.');
+        }
+
+        const blockedEmailDomains = this._settingsCache.get('all_blocked_email_domains');
+        const emailDomain = req.body.email.split('@')[1]?.toLowerCase();
+        if (emailDomain && blockedEmailDomains.includes(emailDomain)) {
+            throw new errors.BadRequestError({
+                message: tpl(messages.blockedEmailDomain)
+            });
+        }
+
+        let tokenData = {};
+        try {
+            const member = await this._memberRepository.getByToken(identity);
+            tokenData.oldEmail = member.get('email');
+        } catch (err) {
+            res.writeHead(401);
+            return res.end('Unauthorized.');
+        }
+
+        try {
+            await this._sendEmailWithMagicLink({email, tokenData, requestedType: 'updateEmail', options});
+            res.writeHead(201);
+            return res.end('Created.');
+        } catch (err) {
+            res.writeHead(500);
+            return res.end('Internal Server Error.');
+        }
+    }
+
+    async updateSubscription(req, res) {
+        try {
+            const identity = req.body.identity;
+            const subscriptionId = req.params.id;
+            const cancelAtPeriodEnd = req.body.cancel_at_period_end;
+            const smartCancel = req.body.smart_cancel;
+            const cancellationReason = req.body.cancellation_reason;
+            let ghostPriceId = req.body.priceId;
+            const tierId = req.body.tierId;
+            const cadence = req.body.cadence;
+
+            if (cancelAtPeriodEnd === undefined && ghostPriceId === undefined && smartCancel === undefined && tierId === undefined && cadence === undefined) {
+                throw new errors.BadRequestError({
+                    message: 'Updating subscription failed!',
+                    help: 'Request should contain "cancel_at_period_end" or "priceId" or "smart_cancel" field.'
+                });
+            }
+
+            if ((cancelAtPeriodEnd === undefined || cancelAtPeriodEnd === false) && !smartCancel && cancellationReason !== undefined) {
+                throw new errors.BadRequestError({
+                    message: 'Updating subscription failed!',
+                    help: '"cancellation_reason" field requires the "cancel_at_period_end" or "smart_cancel" field to be true.'
+                });
+            }
+
+            if (cancellationReason && cancellationReason.length > 500) {
+                throw new errors.BadRequestError({
+                    message: 'Updating subscription failed!',
+                    help: '"cancellation_reason" field can be a maximum of 500 characters.'
+                });
+            }
+
+            let email;
+            try {
+                if (!identity) {
+                    throw new errors.BadRequestError({
+                        message: 'Updating subscription failed! Could not find member'
+                    });
+                }
+
+                const claims = await this._tokenService.decodeToken(identity);
+                email = claims && claims.sub;
+            } catch (err) {
+                res.writeHead(401);
+                return res.end('Unauthorized');
+            }
+
+            if (!email) {
+                throw new errors.BadRequestError({
+                    message: 'Invalid token'
+                });
+            }
+
+            if (tierId && cadence) {
+                const tier = await this._tiersService.api.read(tierId);
+                const stripePrice = await this._paymentsService.getPriceForTierCadence(tier, cadence);
+
+                await this._memberRepository.updateSubscription({
+                    email,
+                    subscription: {
+                        subscription_id: subscriptionId,
+                        price: stripePrice.id
+                    }
+                });
+            } else if (ghostPriceId !== undefined) {
+                const price = await this._StripePrice.findOne({
+                    id: ghostPriceId
+                });
+
+                if (!price) {
+                    res.writeHead(404);
+                    return res.end('Not Found.');
+                }
+
+                const priceId = price.get('stripe_price_id');
+                const product = await this._productRepository.get({stripe_price_id: priceId});
+
+                if (product.get('active') !== true) {
+                    res.writeHead(403);
+                    return res.end('Tier is archived.');
+                }
+
+                await this._memberRepository.updateSubscription({
+                    email,
+                    subscription: {
+                        subscription_id: subscriptionId,
+                        price: priceId
+                    }
+                });
+            } else if (cancelAtPeriodEnd !== undefined) {
+                await this._memberRepository.updateSubscription({
+                    email,
+                    subscription: {
+                        subscription_id: subscriptionId,
+                        cancel_at_period_end: cancelAtPeriodEnd,
+                        cancellationReason
+                    }
+                });
+            } else if (smartCancel) {
+                const currentSubscription = await this._memberRepository.getSubscription({
+                    email,
+                    subscription: {
+                        subscription_id: subscriptionId
+                    }
+                });
+
+                if (['past_due', 'unpaid'].includes(currentSubscription.status)) {
+                    await this._memberRepository.cancelSubscription({
+                        email,
+                        subscription: {
+                            subscription_id: subscriptionId,
+                            cancellationReason
+                        }
+                    });
+                } else {
+                    await this._memberRepository.updateSubscription({
+                        email,
+                        subscription: {
+                            subscription_id: subscriptionId,
+                            cancel_at_period_end: true,
+                            cancellationReason
+                        }
+                    });
+                }
+            }
+
+            res.writeHead(204);
+            res.end();
+        } catch (err) {
+            res.writeHead(err.statusCode || 500, {
+                'Content-Type': 'text/plain;charset=UTF-8'
+            });
+            res.end(err.message);
+        }
+    }
+};