ghost 5.71.2 → 5.72.1

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.71%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22f960def3fe%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22b4a426895e%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.72%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%227bfacb4ae6%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2258cfaff0c3%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-d4aa86641c6080ce3bc58e6d54252774.js"></script>
-<script src="assets/chunk.338.a23271afc734a6de1d3b.js"></script>
-<script src="assets/chunk.143.dd3ca5f62fa39254412e.js"></script>
-    <script src="assets/ghost-a43c6dbe8d871a5929a0c4ccb54d391e.js"></script>
+    <script src="assets/vendor-71d606e7533962f2cd721075ab56a66a.js"></script>
+<script src="assets/chunk.611.cbd29e2a43c5b8a0d83e.js"></script>
+<script src="assets/chunk.143.ece81e21fe21e88fd1b3.js"></script>
+    <script src="assets/ghost-f85471aad8d3f75d7024a9c2bf2f77bd.js"></script>
 </body>
 </html>

package/core/frontend/apps/private-blogging/lib/views/private.hbs

@@ -5,7 +5,7 @@
         <meta http-equiv="Content-Type" content="text/html" charset="UTF-8" />
         <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
 
-        <title>{{@site.title}} - Private Site Access</title>
+        <title>{{@site.title}}</title>
 
         <meta name="HandheldFriendly" content="True">
         <meta name="MobileOptimized" content="320">

package/core/frontend/web/middleware/static-theme.js

@@ -45,7 +45,7 @@ function isAllowedFile(file) {
 
     const normalizedFilePath = path.normalize(decodedFilePath);
 
-    const allowedFiles = ['manifest.json'];
+    const allowedFiles = ['manifest.json', 'assetlinks.json'];
     const allowedPath = '/assets/';
     const alwaysDeny = ['.hbs'];
 

package/core/server/api/endpoints/recommendations.js

@@ -48,6 +48,24 @@ module.exports = {
         }
     },
 
+    /**
+     * Fetch metadata for a recommendation URL
+     */
+    check: {
+        headers: {
+            cacheInvalidate: true
+        },
+        options: [],
+        validation: {},
+        permissions: {
+            // Everyone who has add permissions, can 'check'
+            method: 'add'
+        },
+        async query(frame) {
+            return await recommendations.controller.check(frame);
+        }
+    },
+
     edit: {
         headers: {
             cacheInvalidate: true

package/core/server/data/migrations/utils/schema.js

@@ -96,6 +96,22 @@ function createSetNullableMigration(table, column, options = {}) {
     );
 }
 
+/**
+ * @param {string} table
+ * @param {string[]|string} columns One or multiple columns (in case the index should be for multiple columns)
+ * @returns {Migration}
+ */
+function createAddIndexMigration(table, columns) {
+    return createTransactionalMigration(
+        async function up(knex) {
+            await commands.addIndex(table, columns, knex);
+        },
+        async function down(knex) {
+            await commands.dropIndex(table, columns, knex);
+        }
+    );
+}
+
 /**
  * @param {string} table
  * @param {string} from
@@ -163,7 +179,8 @@ module.exports = {
     createDropColumnMigration,
     createSetNullableMigration,
     createDropNullableMigration,
-    createRenameColumnMigration
+    createRenameColumnMigration,
+    createAddIndexMigration
 };
 
 /**

package/core/server/data/migrations/versions/5.72/2023-10-31-11-06-00-members-created-attribution-id-index.js

@@ -0,0 +1,3 @@
+const {createAddIndexMigration} = require('../../utils');
+
+module.exports = createAddIndexMigration('members_created_events', ['attribution_id']);

package/core/server/data/migrations/versions/5.72/2023-10-31-11-06-01-members-subscription-created-attribution-id-index.js

@@ -0,0 +1,3 @@
+const {createAddIndexMigration} = require('../../utils');
+
+module.exports = createAddIndexMigration('members_subscription_created_events', ['attribution_id']);

package/core/server/data/schema/commands.js

@@ -175,6 +175,60 @@ async function renameColumn(tableName, from, to, transaction = db.knex) {
     });
 }
 
+/**
+ * Adds an non-unique index to a table over the given columns.
+ *
+ * @param {string} tableName - name of the table to add indexes to
+ * @param {string|string[]} columns - column(s) to add indexes for
+ * @param {import('knex').Knex} [transaction] - connection object containing knex reference
+ */
+async function addIndex(tableName, columns, transaction = db.knex) {
+    try {
+        logging.info(`Adding index for '${columns}' in table '${tableName}'`);
+
+        return await transaction.schema.table(tableName, function (table) {
+            table.index(columns);
+        });
+    } catch (err) {
+        if (err.code === 'SQLITE_ERROR') {
+            logging.warn(`Index for '${columns}' already exists for table '${tableName}'`);
+            return;
+        }
+        if (err.code === 'ER_DUP_KEYNAME') {
+            logging.warn(`Index for '${columns}' already exists for table '${tableName}'`);
+            return;
+        }
+        throw err;
+    }
+}
+
+/**
+ * Drops a non-unique index from a table over the given columns.
+ *
+ * @param {string} tableName - name of the table to remove indexes from
+ * @param {string|string[]} columns - column(s) to remove indexes for
+ * @param {import('knex').Knex} [transaction] - connection object containing knex reference
+ */
+async function dropIndex(tableName, columns, transaction = db.knex) {
+    try {
+        logging.info(`Dropping index for '${columns}' in table '${tableName}'`);
+
+        return await transaction.schema.table(tableName, function (table) {
+            table.dropIndex(columns);
+        });
+    } catch (err) {
+        if (err.code === 'SQLITE_ERROR') {
+            logging.warn(`Constraint for '${columns}' does not exist for table '${tableName}'`);
+            return;
+        }
+        if (err.code === 'ER_CANT_DROP_FIELD_OR_KEY') {
+            logging.warn(`Constraint for '${columns}' does not exist for table '${tableName}'`);
+            return;
+        }
+        throw err;
+    }
+}
+
 /**
  * Adds an unique index to a table over the given columns.
  *
@@ -535,6 +589,8 @@ module.exports = {
     getIndexes,
     addUnique,
     dropUnique,
+    addIndex,
+    dropIndex,
     addPrimaryKey,
     addForeign,
     dropForeign,

package/core/server/data/schema/schema.js

@@ -523,7 +523,7 @@ module.exports = {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         created_at: {type: 'dateTime', nullable: false},
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
-        attribution_id: {type: 'string', maxlength: 24, nullable: true},
+        attribution_id: {type: 'string', maxlength: 24, nullable: true, index: true},
         attribution_type: {
             type: 'string', maxlength: 50, nullable: true, validations: {
                 isIn: [['url', 'post', 'page', 'author', 'tag']]
@@ -709,7 +709,7 @@ module.exports = {
         created_at: {type: 'dateTime', nullable: false},
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
         subscription_id: {type: 'string', maxlength: 24, nullable: false, references: 'members_stripe_customers_subscriptions.id', cascadeDelete: true},
-        attribution_id: {type: 'string', maxlength: 24, nullable: true},
+        attribution_id: {type: 'string', maxlength: 24, nullable: true, index: true},
         attribution_type: {
             type: 'string', maxlength: 50, nullable: true, validations: {
                 isIn: [['url', 'post', 'page', 'author', 'tag']]

package/core/server/services/custom-redirects/CustomRedirectsAPI.js

@@ -9,7 +9,7 @@ const errors = require('@tryghost/errors');
 const messages = {
     jsonParse: 'Could not parse JSON: {context}.',
     yamlParse: 'Could not parse YAML: {context}.',
-    yamlPlainString: 'YAML input cannot be a plain string. Check the format of your YAML file.',
+    yamlInvalid: 'YAML input is invalid. Check the contents of your YAML file.',
     redirectsHelp: 'https://ghost.org/docs/themes/routing/#redirects',
     redirectsRegister: 'Could not register custom redirects.'
 };
@@ -78,13 +78,9 @@ const parseRedirectsFile = (content, ext) => {
             });
         }
 
-        // yaml.load passes almost every yaml code.
-        // Because of that, it's hard to detect if there's an error in the file.
-        // But one of the obvious errors is the plain string output.
-        // Here we check if the user made this mistake.
-        if (typeof configYaml === 'string') {
+        if (typeof configYaml !== 'object' || configYaml === null) {
             throw new errors.BadRequestError({
-                message: tpl(messages.yamlPlainString),
+                message: tpl(messages.yamlInvalid),
                 help: tpl(messages.redirectsHelp)
             });
         }

package/core/server/services/members/MembersConfigProvider.js

@@ -35,10 +35,6 @@ class MembersConfigProvider {
         return this._settingsHelpers.getMembersSupportAddress();
     }
 
-    getAuthEmailFromAddress() {
-        return this.getEmailSupportAddress();
-    }
-
     /**
      * @deprecated Use settingsHelpers.isStripeConnected instead
      */

package/core/server/services/members/api.js

@@ -47,7 +47,7 @@ function createApiInstance(config) {
                         logging.warn(message.text);
                     }
                     let msg = Object.assign({
-                        from: config.getAuthEmailFromAddress(),
+                        from: config.getEmailSupportAddress(),
                         subject: 'Signin',
                         forceTextContent: true
                     }, message);

package/core/server/services/members/middleware.js

@@ -265,8 +265,16 @@ const createSessionFromMagicLink = async function createSessionFromMagicLink(req
                 const ensureEndsWith = (string, endsWith) => (string.endsWith(endsWith) ? string : string + endsWith);
                 const removeLeadingSlash = string => string.replace(/^\//, '');
 
+                // Add query parameters so the frontend can detect that the signup went fine
+
                 const redirectUrl = new URL(removeLeadingSlash(ensureEndsWith(customRedirect, '/')), ensureEndsWith(baseUrl, '/'));
 
+                if (urlUtils.isSiteUrl(redirectUrl)) {
+                    // Add only for non-external URLs
+                    redirectUrl.searchParams.set('success', 'true');
+                    redirectUrl.searchParams.set('action', 'signup');
+                }
+
                 return res.redirect(redirectUrl.href);
             }
         }

package/core/server/services/recommendations/RecommendationServiceWrapper.js

@@ -50,6 +50,7 @@ class RecommendationServiceWrapper {
         const sentry = require('../../../shared/sentry');
         const settings = require('../settings');
         const RecommendationEnablerService = require('./RecommendationEnablerService');
+
         const {
             BookshelfRecommendationRepository,
             RecommendationService,
@@ -58,7 +59,8 @@ class RecommendationServiceWrapper {
             BookshelfClickEventRepository,
             IncomingRecommendationController,
             IncomingRecommendationService,
-            IncomingRecommendationEmailRenderer
+            IncomingRecommendationEmailRenderer,
+            RecommendationMetadataService
         } = require('@tryghost/recommendations');
 
         const mentions = require('../mentions');
@@ -87,13 +89,22 @@ class RecommendationServiceWrapper {
             sentry
         });
 
+        const oembedService = require('../oembed');
+        const externalRequest = require('../../../server/lib/request-external.js');
+
+        const recommendationMetadataService = new RecommendationMetadataService({
+            oembedService,
+            externalRequest
+        });
+
         this.service = new RecommendationService({
             repository: this.repository,
             recommendationEnablerService,
             wellknownService,
             mentionSendingService: mentions.sendingService,
             clickEventRepository: this.clickEventRepository,
-            subscribeEventRepository: this.subscribeEventRepository
+            subscribeEventRepository: this.subscribeEventRepository,
+            recommendationMetadataService
         });
 
         const mail = require('../mail');

package/core/server/web/api/endpoints/admin/routes.js

@@ -351,6 +351,7 @@ module.exports = function apiRoutes() {
     router.get('/recommendations', mw.authAdminApi, http(api.recommendations.browse));
     router.get('/recommendations/:id', mw.authAdminApi, http(api.recommendations.read));
     router.post('/recommendations', mw.authAdminApi, http(api.recommendations.add));
+    router.post('/recommendations/check', mw.authAdminApi, http(api.recommendations.check));
     router.put('/recommendations/:id', mw.authAdminApi, http(api.recommendations.edit));
     router.del('/recommendations/:id', mw.authAdminApi, http(api.recommendations.destroy));
 

package/core/shared/labs.js

@@ -43,7 +43,8 @@ const ALPHA_FEATURES = [
     'importMemberTier',
     'lexicalIndicators',
     'listUnsubscribeHeader',
-    'editorEmojiPicker'
+    'editorEmojiPicker',
+    'adminXOffers'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/core/shared/sentry.js

@@ -22,13 +22,25 @@ if (sentryConfig && !sentryConfig.disabled) {
                     event.exception.values[0].type = exception.context;
                 }
 
+                // This is a mysql2 error — add some additional context
+                if (exception.sql) {
+                    event.exception.values[0].type = `SQL Error ${exception.errno}: ${exception.sqlErrorCode}`;
+                    event.exception.values[0].value = exception.sqlMessage;
+                    event.contexts.mysql = {
+                        errno: exception.errno,
+                        code: exception.sqlErrorCode,
+                        sql: exception.sql,
+                        message: exception.sqlMessage,
+                        state: exception.sqlState
+                    };
+                }
+
                 // This is a Ghost Error, copy all our extra data to tags
                 event.tags.type = exception.errorType;
                 event.tags.code = exception.code;
                 event.tags.id = exception.id;
                 event.tags.statusCode = exception.statusCode;
             }
-
             return event;
         }
     });