ghost 5.129.2 → 6.0.0-alpha.1

package/core/server/services/url/config.js

@@ -19,7 +19,6 @@ module.exports = [
                 // @TODO: https://github.com/TryGhost/Ghost/issues/10335
                 // 'page',
                 'status',
-                'amp',
                 'codeinjection_head',
                 'codeinjection_foot',
                 'meta_title',
@@ -68,7 +67,6 @@ module.exports = [
                 // @TODO: https://github.com/TryGhost/Ghost/issues/10335
                 // 'page',
                 // 'status',
-                'amp',
                 'codeinjection_head',
                 'codeinjection_foot',
                 'meta_title',

package/core/server/web/api/app.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('web:api:default:app');
 const config = require('../../../shared/config');
 const express = require('../../../shared/express');
 const sentry = require('../../../shared/sentry');
+const middleware = require('../shared/middleware');
 const errorHandler = require('@tryghost/mw-error-handler');
 const APIVersionCompatibilityService = require('../../services/api-version-compatibility');
 
@@ -19,6 +20,9 @@ module.exports = function setupApiApp() {
     apiApp.use(APIVersionCompatibilityService.versionRewrites);
     apiApp.use(APIVersionCompatibilityService.contentVersion);
 
+    // Enforce capped limit parameter
+    apiApp.use(middleware.maxLimitCap);
+
     apiApp.lazyUse('/content/', require('./endpoints/content/app'));
     apiApp.lazyUse('/admin/', require('./endpoints/admin/app'));
 

package/core/server/web/api/endpoints/admin/middleware.js

@@ -5,7 +5,7 @@ const shared = require('../../../shared');
 const apiMw = require('../../middleware');
 
 const messages = {
-    notImplemented: 'The server does not support the functionality required to fulfill the request.',
+    apiTokenBlocked: 'API tokens do not have permission to access this endpoint',
     staffTokenBlocked: 'Staff tokens are not allowed to access this endpoint'
 };
 
@@ -14,7 +14,7 @@ const messages = {
  * @param {import('express').Response} res
  * @param {import('express').NextFunction} next
  */
-const notImplemented = function notImplemented(req, res, next) {
+const tokenPermissionCheck = function tokenPermissionCheck(req, res, next) {
     // CASE: user is logged in with user auth, skip to permission system
     if (!req.api_key) {
         return next();
@@ -81,10 +81,9 @@ const notImplemented = function notImplemented(req, res, next) {
         }
     }
 
-    next(new errors.InternalServerError({
-        errorType: 'NotImplementedError',
-        message: tpl(messages.notImplemented),
-        statusCode: 501
+    next(new errors.NoPermissionError({
+        message: tpl(messages.apiTokenBlocked),
+        statusCode: 403
     }));
 };
 
@@ -102,7 +101,7 @@ module.exports.authAdminApi = [
     apiMw.cors,
     shared.middleware.urlRedirects.adminSSLAndHostRedirect,
     shared.middleware.prettyUrls,
-    notImplemented
+    tokenPermissionCheck
 ];
 
 /**
@@ -118,7 +117,7 @@ module.exports.authAdminApiWithUrl = [
     apiMw.cors,
     shared.middleware.urlRedirects.adminSSLAndHostRedirect,
     shared.middleware.prettyUrls,
-    notImplemented
+    tokenPermissionCheck
 ];
 
 /**
@@ -130,5 +129,5 @@ module.exports.publicAdminApi = [
     apiMw.cors,
     shared.middleware.urlRedirects.adminSSLAndHostRedirect,
     shared.middleware.prettyUrls,
-    notImplemented
+    tokenPermissionCheck
 ];

package/core/server/web/api/endpoints/admin/routes.js

@@ -19,7 +19,6 @@ module.exports = function apiRoutes() {
 
     // ## Public
     router.get('/site', mw.publicAdminApi, http(api.site.read));
-    router.post('/mail_events', mw.publicAdminApi, http(api.mailEvents.add));
 
     // ## Configuration
     router.get('/config', mw.authAdminApi, http(api.config.read));
@@ -247,7 +246,6 @@ module.exports = function apiRoutes() {
     router.get('/tinybird/token', mw.authAdminApi, http(api.tinybird.token));
 
     // ## Sessions
-    router.get('/session', mw.authAdminApi, http(api.session.read));
     // We don't need auth when creating a new session (logging in)
     router.post('/session',
         shared.middleware.brute.globalBlock,

package/core/server/web/comments/routes.js

@@ -23,6 +23,9 @@ module.exports = function apiRoutes() {
     // Authenticated Routes
     router.use(membersService.middleware.loadMemberSession);
 
+    // Enforce capped limit parameter
+    router.use(shared.middleware.maxLimitCap);
+
     router.get('/', http(api.commentsMembers.browse));
     router.get('/post/:post_id', http(api.commentsMembers.browse));
     router.get('/:id', http(api.commentsMembers.read));

package/core/server/web/shared/middleware/index.js

@@ -11,6 +11,10 @@ module.exports = {
         return require('./cache-control');
     },
 
+    get maxLimitCap() {
+        return require('./max-limit-cap');
+    },
+
     get prettyUrls() {
         return require('./pretty-urls');
     },

package/core/server/web/shared/middleware/max-limit-cap.js

@@ -0,0 +1,27 @@
+const {applyLimitCap, limitConfig} = require('../../../../shared/max-limit-cap');
+
+// Prior to Ghost 6.x we allowed any limit value, including 'all', but as sites
+// grew in size it led to performance issues and mis-use of the API.
+
+// After Ghost 6.x we only allow a max limit of 100. This middleware enforces
+// that limit by rewriting the limit parameter before it reaches any API code.
+
+function maxLimitCap(req, res, next) {
+    const limit = req.query.limit;
+
+    if (!limit) {
+        return next();
+    }
+
+    // Apply the shared limit capping logic with URL for exception endpoint checking
+    const cappedLimit = applyLimitCap(limit, {url: req.originalUrl});
+
+    req.query.limit = cappedLimit;
+    next();
+}
+
+// Create middleware stack with limitConfig property for test access
+/** @type {Array<Function> & {limitConfig: object}} */
+const middlewareStack = Object.assign([maxLimitCap], {limitConfig});
+
+module.exports = middlewareStack;

package/core/server/web/shared/middleware/pretty-urls.js

@@ -1,8 +1,9 @@
 // Pretty URL redirects
 //
-// These are two pieces of middleware that handle ensuring that
+// These are three pieces of middleware that handle ensuring that
 // URLs get formatted correctly.
 // Slashes ensures that we get trailing slashes
+// redirectAmpUrls removes /amp from the end of urls if it exists (AMP support removed in v6) 
 // Uncapitalise changes case to lowercase
 // @TODO optimize this to reduce the number of redirects required to get to a pretty URL
 // @TODO move this to being used by routers?
@@ -15,5 +16,6 @@ module.exports = [
             'Cache-Control': `public, max-age=${config.get('caching:301:maxAge')}`
         }
     }),
+    require('./redirect-amp-urls'),
     require('./uncapitalise')
 ];

package/core/server/web/shared/middleware/redirect-amp-urls.js

@@ -0,0 +1,36 @@
+const urlUtils = require('../../../../shared/url-utils');
+const localUtils = require('../utils');
+
+/**
+ * redirectAmpUrls middleware
+ *
+ * 1. Detect requests whose path ends with `/amp/` (case-insensitive) or `/amp` before a query-string
+ * 2. Issue a 301 redirect to the same URL without that suffix, preserving the query string.
+ *
+ * Needs to sit early in the public-site middleware stack so that the request never reaches
+ * the dynamic routers or results in a 404.
+ *
+ * Example:
+ *   /welcome/amp/      -> /welcome/
+ *   /welcome/amp/?q=1  -> /welcome/?q=1
+ *
+ * @param {import('express').Request} req - Express request object
+ * @param {import('express').Response} res - Express response object  
+ * @param {import('express').NextFunction} next - Express next function
+ * @returns {void}
+ */
+function redirectAmpUrls(req, res, next) {
+    const ampPattern = /\/amp\/?$/i;
+    const url = new URL(req.url, 'http://example.com');
+    
+    if (!ampPattern.test(url.pathname)) {
+        return next();
+    }
+
+    const sanitizedPath = url.pathname.replace(ampPattern, '/') + url.search;
+    const redirectPath = localUtils.removeOpenRedirectFromUrl(sanitizedPath);
+
+    return urlUtils.redirect301(res, redirectPath);
+}
+
+module.exports = redirectAmpUrls; 

package/core/shared/config/defaults.json

@@ -171,6 +171,8 @@
         }
     },
     "optimization": {
+        "maxLimit": 100,
+        "allowLimitAll": false,
         "getHelper": {
             "timeout": {
                 "threshold": 5000,

package/core/shared/config/env/config.production.json

@@ -17,5 +17,9 @@
             "enabled": true
         },
         "transports": ["file"]
+    },
+    "explore": {
+        "update_url": "https://explore.ghost.org/api/update",
+        "testimonials_url": "https://explore.ghost.org/api/testimonials"
     }
 }

package/core/shared/config/overrides.json

@@ -12,10 +12,7 @@
         "publicFilePath": "core/frontend/public"
     },
     "apps": {
-        "internal": [
-            "private-blogging",
-            "amp"
-        ]
+        "internal": ["private-blogging"]
     },
     "slugs": {
         "protected": ["ghost", "rss", "amp"]

package/core/shared/labs.js

@@ -26,12 +26,15 @@ const GA_FEATURES = [
     'themeErrorsNotification',
     'announcementBar',
     'customFonts',
-    'contentVisibility'
+    'contentVisibility',
+    'ActivityPub',
+    'trafficAnalytics',
+    'ui60',
+    'explore'
 ];
 
 // These features are considered publicly available and can be enabled/disabled by users
 const PUBLIC_BETA_FEATURES = [
-    'ActivityPub',
     'superEditors',
     'editorExcerpt',
     'additionalPaymentMethods'
@@ -42,14 +45,10 @@ const PUBLIC_BETA_FEATURES = [
 const PRIVATE_FEATURES = [
     'stripeAutomaticTax',
     'webmentions',
-    'trafficAnalytics',
     'importMemberTier',
     'urlCache',
-    'mailEvents',
     'lexicalIndicators',
-    'ui60',
     'contentVisibilityAlpha',
-    'explore',
     'emailCustomization'
 ];
 

package/core/shared/max-limit-cap.js

@@ -0,0 +1,61 @@
+const config = require('../shared/config');
+
+// Prior to Ghost 6.x we allowed any limit value, including 'all', but as sites
+// grew in size it led to performance issues and mis-use of the API.
+
+// After Ghost 6.x we only allow a max limit of 100. This shared module provides
+// the core limit capping logic that can be used by both middleware and helpers.
+
+const limitConfig = {
+    allowLimitAll: config.get('optimization:allowLimitAll') || false,
+    maxLimit: config.get('optimization:maxLimit') || 100,
+    // Temporary exceptions to the max limit rule (HTTP-specific)
+    exceptionEndpoints: [
+        '/ghost/api/admin/posts/export/',
+        '/ghost/api/admin/emails/' // /:id/batches/ and /:id/recipient-failures/
+    ]
+};
+
+/**
+ * Apply limit capping logic to a limit value
+ * @param {string|number} limit - The limit value to cap
+ * @param {Object} options - Optional settings
+ * @param {string} [options.url] - URL to check against exception endpoints (for middleware)
+ * @returns {string|number} The capped limit value
+ */
+function applyLimitCap(limit, options = {}) {
+    if (!limit) {
+        return limit;
+    }
+
+    // If 'all' is globally allowed, skip everything else
+    if (limit === 'all' && limitConfig.allowLimitAll) {
+        return limit;
+    }
+
+    // Check exception endpoints - they bypass all limits (HTTP-specific)
+    if (options.url && limitConfig.exceptionEndpoints.some(endpoint => options.url.startsWith(endpoint))) {
+        return limit;
+    }
+
+    // 'all' is no longer supported so gets capped to maxLimit
+    if (limit === 'all') {
+        return limitConfig.maxLimit;
+    }
+
+    // Convert to number for comparison
+    const numericLimit = parseInt(String(limit), 10);
+
+    // If it's not a valid number or exceeds maxLimit, cap it
+    if (isNaN(numericLimit) || numericLimit > limitConfig.maxLimit) {
+        return limitConfig.maxLimit;
+    }
+
+    // Return the original limit if it's within bounds
+    return limit;
+}
+
+module.exports = {
+    applyLimitCap,
+    limitConfig
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.129.2",
+  "version": "6.0.0-alpha.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -62,7 +62,7 @@
     "reset:data:tinybird": "cd core/server/data/tinybird/scripts && node reset-data-tinybird.js"
   },
   "engines": {
-    "node": "^18.12.1 || ^20.11.1 || ^22.13.1",
+    "node": "^22.13.1",
     "cli": "^1.27.0"
   },
   "dependencies": {
@@ -86,7 +86,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.2.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.0-alpha.1.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.2",
@@ -122,7 +122,6 @@
     "@tryghost/validator": "0.2.17",
     "@tryghost/version": "0.1.33",
     "@tryghost/zip": "1.1.49",
-    "amperize": "0.6.1",
     "body-parser": "1.20.3",
     "bookshelf": "1.2.0",
     "bookshelf-relations": "2.8.0",
@@ -226,21 +225,21 @@
   },
   "devDependencies": {
     "@actions/core": "1.11.1",
-    "@playwright/test": "1.53.2",
+    "@playwright/test": "1.54.1",
     "@prettier/sync": "0.6.1",
     "@tryghost/express-test": "0.15.0",
     "@tryghost/webhook-mock-receiver": "0.2.17",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.16.3",
+    "@types/node": "22.16.4",
     "@types/node-jose": "1.1.13",
     "@types/nodemailer": "6.4.17",
     "@types/sinon": "17.0.4",
     "@types/supertest": "6.0.3",
     "c8": "10.1.3",
     "cli-progress": "3.12.0",
-    "cssnano": "7.0.7",
+    "cssnano": "7.1.0",
     "detect-indent": "6.1.0",
     "detect-newline": "3.1.0",
     "expect": "29.7.0",
@@ -274,7 +273,7 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.2.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.0-alpha.1.tgz"
   },
   "nx": {
     "targets": {