ghost 5.2.2 → 5.3.0

package/core/server/data/migrations/versions/5.3/2022-07-06-09-13-add-ghost-explore-integration-role-permissions.js

@@ -0,0 +1,11 @@
+const {addPermissionWithRoles} = require('../../utils');
+
+module.exports = addPermissionWithRoles({
+    name: 'Read explore data',
+    action: 'read',
+    object: 'explore'
+}, [
+    'Administrator',
+    'Admin Integration',
+    'Ghost Explore Integration'
+]);

package/core/server/data/migrations/versions/5.3/2022-07-06-09-17-add-ghost-explore-integration.js

@@ -0,0 +1,38 @@
+const logging = require('@tryghost/logging');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        logging.info('Creating Ghost Explore Integration');
+        const existingIntegration = await knex('integrations').where({
+            type: 'internal',
+            name: 'Ghost Explore',
+            slug: 'ghost-explore'
+        }).first();
+
+        if (existingIntegration) {
+            logging.warn('Integration already exists, skipping');
+            return;
+        }
+
+        await knex('integrations').insert({
+            id: (new ObjectID()).toHexString(),
+            type: 'internal',
+            name: 'Ghost Explore',
+            description: 'Internal Integration for the Ghost Explore directory',
+            slug: 'ghost-explore',
+            created_at: knex.raw('current_timestamp'),
+            created_by: meta.MIGRATION_USER
+        });
+    },
+    async function down(knex) {
+        logging.info('Deleting Ghost Explore Integration');
+
+        await knex('integrations').where({
+            type: 'internal',
+            name: 'Ghost Explore',
+            slug: 'ghost-explore'
+        }).del();
+    }
+);

package/core/server/data/migrations/versions/5.3/2022-07-06-09-26-add-ghost-explore-integration-api-key.js

@@ -0,0 +1,73 @@
+const {InternalServerError} = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+const security = require('@tryghost/security');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        logging.info('Adding Admin API key for Ghost Explore Integration');
+
+        const integration = await knex('integrations').where({
+            slug: 'ghost-explore',
+            type: 'internal',
+            name: 'Ghost Explore'
+        }).first();
+
+        if (!integration) {
+            throw new InternalServerError('Could not find Ghost Explore Integration');
+        }
+
+        const role = await knex('roles').where({
+            name: 'Ghost Explore Integration'
+        }).first();
+
+        if (!role) {
+            throw new InternalServerError('Could not find Ghost Explore Integration Role');
+        }
+
+        const existingKey = await knex('api_keys').where({
+            integration_id: integration.id,
+            role_id: role.id
+        }).first();
+
+        if (existingKey) {
+            logging.warn('Admin API key already exists');
+            return;
+        }
+
+        await knex('api_keys').insert({
+            id: (new ObjectID()).toHexString(),
+            type: 'admin',
+            secret: security.secret.create('admin'),
+            role_id: role.id,
+            integration_id: integration.id,
+            created_at: knex.raw('current_timestamp'),
+            created_by: meta.MIGRATION_USER
+        });
+    },
+    async function down(knex) {
+        logging.info('Removing Ghost Explore API key');
+
+        const integration = await knex('integrations').where({
+            slug: 'ghost-explore',
+            type: 'internal',
+            name: 'Ghost Explore'
+        }).first();
+
+        const role = await knex('roles').where({
+            name: 'Ghost Explore Integration'
+        }).first();
+
+        if (!role || !integration) {
+            logging.warn('Could not delete API key');
+            return;
+        }
+
+        logging.info('Deleting API Key');
+        await knex('api_keys').where({
+            integration_id: integration.id,
+            role_id: role.id
+        }).del();
+    }
+);

package/core/server/data/schema/default-settings/default-settings.json

@@ -450,5 +450,19 @@
             "defaultValue": "all",
             "type": "string"
         }
+    },
+    "comments": {
+        "comments_enabled": {
+            "type": "string",
+            "defaultValue": "off",
+            "validations": {
+                "isEmpty": false,
+                "isIn": [[
+                    "off",
+                    "all",
+                    "paid"
+                ]]
+            }
+        }
     }
 }

package/core/server/data/schema/fixtures/fixtures.json

@@ -69,6 +69,10 @@
                     "name": "Admin Integration",
                     "description": "External Apps"
                 },
+                {
+                    "name": "Ghost Explore Integration",
+                    "description": "Internal Integration for the Ghost Explore directory"
+                },
                 {
                     "name": "DB Backup Integration",
                     "description": "Internal DB Backup Client"
@@ -82,6 +86,11 @@
         {
             "name": "Permission",
             "entries": [
+                {
+                    "name": "Read explore data",
+                    "action_type": "read",
+                    "object_type": "explore"
+                },
                 {
                     "name": "Export database",
                     "action_type": "exportContent",
@@ -561,6 +570,46 @@
                     "name": "Edit newsletters",
                     "action_type": "edit",
                     "object_type": "newsletter"
+                },
+                {
+                    "name": "Browse comments",
+                    "action_type": "browse",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Read comments",
+                    "action_type": "read",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Edit comments",
+                    "action_type": "edit",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Add comments",
+                    "action_type": "add",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Delete comments",
+                    "action_type": "destroy",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Moderate comments",
+                    "action_type": "moderate",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Like comments",
+                    "action_type": "like",
+                    "object_type": "comment"
+                },
+                {
+                    "name": "Unlike comments",
+                    "action_type": "unlike",
+                    "object_type": "comment"
                 }
             ]
         },
@@ -614,6 +663,13 @@
                     "type": "builtin",
                     "api_keys": [{"type": "admin"}]
                 },
+                {
+                    "slug": "ghost-explore",
+                    "name": "Ghost Explore",
+                    "description": "Built-in Ghost Explore integration",
+                    "type": "internal",
+                    "api_keys": [{"type": "admin", "role": "Ghost Explore Integration"}]
+                },
                 {
                     "slug": "ghost-backup",
                     "name": "Ghost Backup",
@@ -678,7 +734,9 @@
                     "offer": "all",
                     "authentication": "resetAllPasswords",
                     "members_stripe_connect": "auth",
-                    "newsletter": "all"
+                    "newsletter": "all",
+                    "explore": "read",
+                    "comment": "all"
                 },
                 "DB Backup Integration": {
                     "db": "all"
@@ -686,6 +744,9 @@
                 "Scheduler Integration": {
                     "post": "publish"
                 },
+                "Ghost Explore Integration": {
+                    "explore": "read"
+                },
                 "Admin Integration": {
                     "mail": "all",
                     "notification": "all",
@@ -707,7 +768,9 @@
                     "snippet": "all",
                     "product": ["browse", "read", "add", "edit"],
                     "offer": ["browse", "read", "add", "edit"],
-                    "newsletter": ["browse", "read", "add", "edit"]
+                    "newsletter": ["browse", "read", "add", "edit"],
+                    "explore": "read",
+                    "comment": "all"
                 },
                 "Editor": {
                     "notification": "all",

package/core/server/data/schema/schema.js

@@ -148,6 +148,7 @@ module.exports = {
         meta_description: {type: 'string', maxlength: 2000, nullable: true, validations: {isLength: {max: 500}}},
         tour: {type: 'text', maxlength: 65535, nullable: true},
         last_seen: {type: 'dateTime', nullable: true},
+        comment_notifications: {type: 'boolean', nullable: false, defaultTo: true},
         created_at: {type: 'dateTime', nullable: false},
         created_by: {type: 'string', maxlength: 24, nullable: false},
         updated_at: {type: 'dateTime', nullable: true},
@@ -392,12 +393,15 @@ module.exports = {
             }
         },
         name: {type: 'string', maxlength: 191, nullable: true},
+        bio: {type: 'string', maxlength: 191, nullable: true, validations: {isLength: {max: 50}}},
         note: {type: 'string', maxlength: 2000, nullable: true},
         geolocation: {type: 'string', maxlength: 2000, nullable: true},
+        enable_comment_notifications: {type: 'boolean', nullable: false, defaultTo: true},
         email_count: {type: 'integer', unsigned: true, nullable: false, defaultTo: 0},
         email_opened_count: {type: 'integer', unsigned: true, nullable: false, defaultTo: 0},
         email_open_rate: {type: 'integer', unsigned: true, nullable: true, index: true},
-        last_seen_at: {type: 'dateTime',nullable: true},
+        last_seen_at: {type: 'dateTime', nullable: true},
+        last_commented_at: {type: 'dateTime', nullable: true},
         created_at: {type: 'dateTime', nullable: false},
         created_by: {type: 'string', maxlength: 24, nullable: false},
         updated_at: {type: 'dateTime', nullable: true},
@@ -742,5 +746,31 @@ module.exports = {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
         newsletter_id: {type: 'string', maxlength: 24, nullable: false, references: 'newsletters.id', cascadeDelete: true}
+    },
+    comments: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        post_id: {type: 'string', maxlength: 24, nullable: false, unique: false, references: 'posts.id', cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'members.id'},
+        parent_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'comments.id'},
+        status: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'published', validations: {isIn: [['published', 'hidden', 'deleted']]}},
+        html: {type: 'text', maxlength: 1000000000, fieldtype: 'long', nullable: true},
+        edited_at: {type: 'dateTime', nullable: true},
+        created_at: {type: 'dateTime', nullable: false},
+        updated_at: {type: 'dateTime', nullable: false}
+    },
+    comment_likes: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        comment_id: {type: 'string', maxlength: 24, nullable: false, unique: false, references: 'comments.id', cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'members.id'},
+        created_at: {type: 'dateTime', nullable: false},
+        updated_at: {type: 'dateTime', nullable: false}
+    },
+    comment_reports: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        comment_id: {type: 'string', maxlength: 24, nullable: false, unique: false, references: 'comments.id', cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'members.id'},
+        reason: {type: 'text', maxlength: 65535, nullable: false},
+        created_at: {type: 'dateTime', nullable: false},
+        updated_at: {type: 'dateTime', nullable: false}
     }
 };

package/core/server/models/base/plugins/crud.js

@@ -7,6 +7,16 @@ const messages = {
     couldNotUnderstandRequest: 'Could not understand request.'
 };
 
+// If user requested an excerpt we need to ensure plaintext and custom_excerpt is also included so we can include it when we query the database.
+const requiredForExcerpt = (requestedColumns) => {
+    if (requestedColumns){
+        if (requestedColumns.includes('excerpt') && !requestedColumns.includes('plaintext') && !requestedColumns.includes('plaintext') || !requestedColumns) {
+            requestedColumns.push('plaintext');
+            requestedColumns.push('custom_excerpt');
+        }
+    }
+};
+
 /**
  * @param {Bookshelf} Bookshelf
  */
@@ -72,6 +82,8 @@ module.exports = function (Bookshelf) {
             const options = this.filterOptions(unfilteredOptions, 'findPage');
             const itemCollection = this.getFilteredCollection(options);
             const requestedColumns = options.columns;
+            // make sure we include plaintext and custom_excerpt if excerpt is requested
+            requiredForExcerpt(requestedColumns);
 
             // Set this to true or pass ?debug=true as an API option to get output
             itemCollection.debug = unfilteredOptions.debug && process.env.NODE_ENV !== 'production';
@@ -126,6 +138,9 @@ module.exports = function (Bookshelf) {
             const options = this.filterOptions(unfilteredOptions, 'findOne');
             data = this.filterData(data);
             const model = this.forge(data);
+            const requestedColumns = options.columns;
+            // make sure we include plaintext and custom_excerpt if excerpt is requested
+            requiredForExcerpt(requestedColumns);
 
             // @NOTE: The API layer decides if this option is allowed
             if (options.filter) {

package/core/server/models/comment-like.js

@@ -0,0 +1,34 @@
+const ghostBookshelf = require('./base');
+
+const CommentLike = ghostBookshelf.Model.extend({
+    tableName: 'comment_likes',
+
+    defaults: function defaults() {
+        return {};
+    },
+
+    comment() {
+        return this.belongsTo('Comment', 'comment_id');
+    },
+
+    member() {
+        return this.belongsTo('Member', 'member_id');
+    },
+
+    emitChange: function emitChange(event, options) {
+        const eventToTrigger = 'comment_like' + '.' + event;
+        ghostBookshelf.Model.prototype.emitChange.bind(this)(this, eventToTrigger, options);
+    },
+
+    onCreated: function onCreated(model, options) {
+        ghostBookshelf.Model.prototype.onCreated.apply(this, arguments);
+
+        model.emitChange('added', options);
+    }
+}, {
+
+});
+
+module.exports = {
+    CommentLike: ghostBookshelf.model('CommentLike', CommentLike)
+};

package/core/server/models/comment.js

@@ -0,0 +1,163 @@
+const ghostBookshelf = require('./base');
+const _ = require('lodash');
+const errors = require('@tryghost/errors');
+const tpl = require('@tryghost/tpl');
+const commentsService = require('../services/comments');
+
+const messages = {
+    commentNotFound: 'Comment could not be found',
+    notYourCommentToEdit: 'You may only edit your own comments',
+    notYourCommentToDestroy: 'You may only delete your own comments'
+};
+
+const Comment = ghostBookshelf.Model.extend({
+    tableName: 'comments',
+
+    defaults: function defaults() {
+        return {
+            status: 'published'
+        };
+    },
+
+    post() {
+        return this.belongsTo('Post', 'post_id');
+    },
+
+    member() {
+        return this.belongsTo('Member', 'member_id');
+    },
+
+    parent() {
+        return this.belongsTo('Comment', 'parent_id');
+    },
+
+    likes() {
+        return this.hasMany('CommentLike', 'comment_id');
+    },
+
+    replies() {
+        return this.hasMany('Comment', 'parent_id');
+    },
+
+    emitChange: function emitChange(event, options) {
+        const eventToTrigger = 'comment' + '.' + event;
+        ghostBookshelf.Model.prototype.emitChange.bind(this)(this, eventToTrigger, options);
+    },
+
+    onSaving() {
+        ghostBookshelf.Model.prototype.onSaving.apply(this, arguments);
+
+        if (this.hasChanged('html')) {
+            const sanitizeHtml = require('sanitize-html');
+
+            this.set('html', sanitizeHtml(this.get('html'), {
+                allowedTags: ['p', 'br', 'a', 'blockquote'],
+                allowedAttributes: {
+                    a: ['href', 'target', 'rel']
+                },
+                selfClosing: ['br'],
+                // Enforce _blank and safe URLs
+                transformTags: {
+                    a: sanitizeHtml.simpleTransform('a', {
+                        target: '_blank', 
+                        rel: 'ugc noopener noreferrer nofollow'
+                    })
+                }
+            }));
+        }
+    },
+
+    onCreated: function onCreated(model, options) {
+        ghostBookshelf.Model.prototype.onCreated.apply(this, arguments);
+
+        if (!options.context.internal) {
+            commentsService.api.sendNewCommentNotifications(model);
+        }
+
+        model.emitChange('added', options);
+    },
+
+    enforcedFilters: function enforcedFilters() {
+        return 'parent_id:null';
+    }
+
+}, {
+    destroy: function destroy(unfilteredOptions) {
+        let options = this.filterOptions(unfilteredOptions, 'destroy', {extraAllowedProperties: ['id']});
+
+        const softDelete = () => {
+            return ghostBookshelf.Model.edit.call(this, {status: 'deleted'}, options);
+        };
+
+        if (!options.transacting) {
+            return ghostBookshelf.transaction((transacting) => {
+                options.transacting = transacting;
+                return softDelete();
+            });
+        }
+
+        return softDelete();
+    },
+
+    async permissible(commentModelOrId, action, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission, hasMemberPermission) {
+        const self = this;
+
+        if (hasUserPermission) {
+            return true;
+        }
+
+        if (_.isString(commentModelOrId)) {
+            // Grab the original args without the first one
+            const origArgs = _.toArray(arguments).slice(1);
+
+            // Get the actual comment model
+            return this.findOne({
+                id: commentModelOrId
+            }).then(function then(foundCommentModel) {
+                if (!foundCommentModel) {
+                    throw new errors.NotFoundError({
+                        message: tpl(messages.commentNotFound)
+                    });
+                }
+
+                // Build up the original args but substitute with actual model
+                const newArgs = [foundCommentModel].concat(origArgs);
+
+                return self.permissible.apply(self, newArgs);
+            });
+        }
+
+        if (action === 'edit' && commentModelOrId.get('member_id') !== context.member.id) {
+            return Promise.reject(new errors.NoPermissionError({
+                message: tpl(messages.notYourCommentToEdit)
+            }));
+        }
+
+        if (action === 'destroy' && commentModelOrId.get('member_id') !== context.member.id) {
+            return Promise.reject(new errors.NoPermissionError({
+                message: tpl(messages.notYourCommentToDestroy)
+            }));
+        }
+
+        return hasMemberPermission;
+    },
+
+    /**
+     * We have to ensure consistency. If you listen on model events (e.g. `member.added`), you can expect that you always
+     * receive all fields including relations. Otherwise you can't rely on a consistent flow. And we want to avoid
+     * that event listeners have to re-fetch a resource. This function is used in the context of inserting
+     * and updating resources. We won't return the relations by default for now.
+     */
+    defaultRelations: function defaultRelations(methodName, options) {
+        // @todo: the default relations are not working for 'add' when we add it below
+        if (['findAll', 'findPage', 'edit', 'findOne'].indexOf(methodName) !== -1) {
+            options.withRelated = _.union(['member', 'likes', 'replies', 'replies.member', 'replies.likes'], options.withRelated || []);
+        }
+
+        return options;
+    }
+});
+
+module.exports = {
+    Comment: ghostBookshelf.model('Comment', Comment)
+};

package/core/server/models/member.js

@@ -12,7 +12,8 @@ const Member = ghostBookshelf.Model.extend({
             status: 'free',
             uuid: uuid.v4(),
             email_count: 0,
-            email_opened_count: 0
+            email_opened_count: 0,
+            enable_comment_notifications: true
         };
     },
 

package/core/server/models/user.js

@@ -61,7 +61,8 @@ User = ghostBookshelf.Model.extend({
         return {
             password: security.identifier.uid(50),
             visibility: 'public',
-            status: 'active'
+            status: 'active',
+            comment_notifications: true
         };
     },
 

package/core/server/services/auth/session/express-session.js

@@ -23,7 +23,7 @@ function getExpressSessionMiddleware() {
                 maxAge: constants.SIX_MONTH_MS,
                 httpOnly: true,
                 path: urlUtils.getSubdir() + '/ghost',
-                sameSite: 'lax',
+                sameSite: 'none',
                 secure: urlUtils.isSSL(config.get('url'))
             }
         });