ghost 5.73.2 → 5.74.1

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.73%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22ce83cc9517%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2291be3d3866%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.74%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%228d3cae634e%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22344c297ea0%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-f6856af9fcd8ab6533f2a4339ececbc8.js"></script>
-<script src="assets/chunk.761.88d6f15954870c0c9f60.js"></script>
-<script src="assets/chunk.143.69dbfb81579afebba388.js"></script>
-    <script src="assets/ghost-f849fe36e5d0bab807c159e331a2c5a9.js"></script>
+<script src="assets/chunk.761.5cfbe0d0f8ec7aefe7bc.js"></script>
+<script src="assets/chunk.143.821225c203086be63d54.js"></script>
+    <script src="assets/ghost-ad9952b86c1d886c49a92339adf702e3.js"></script>
 </body>
 </html>

package/core/frontend/services/routing/controllers/previews.js

@@ -53,6 +53,11 @@ module.exports = function previewController(req, res, next) {
                 return urlUtils.redirect301(res, routerManager.getUrlByResourceId(post.id, {withSubdirectory: true}));
             }
 
+            // published content should only resolve to /:slug or /email/:uuid - /p/:uuid is for drafts only in lieu of an actual preview api
+            if (post.status !== 'published' && post.email_only === true) {
+                return urlUtils.redirect301(res, urlUtils.urlJoin('/email', post.uuid, '/'));
+            }
+
             post.access = !!post.html;
 
             return renderer.renderEntry(req, res)(post);

package/core/frontend/src/cards/css/toggle.css

@@ -70,8 +70,10 @@
     justify-content: center;
     align-items: center;
     margin-left: 1em;
+    padding: 0;
     background: none;
     border: 0;
+    cursor: pointer;
 }
 
 .kg-toggle-heading svg {

package/core/server/api/endpoints/members.js

@@ -143,6 +143,31 @@ module.exports = {
         }
     },
 
+    logout: {
+        statusCode: 204,
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'id'
+        ],
+        validation: {
+            options: {
+                id: {
+                    required: true
+                }
+            }
+        },
+        permissions: {
+            method: 'edit'
+        },
+        async query(frame) {
+            const member = await membersService.api.memberBREADService.logout(frame.options);
+
+            return member;
+        }
+    },
+
     editSubscription: {
         statusCode: 200,
         headers: {

package/core/server/api/endpoints/utils/serializers/output/mappers/activity-feed-events.js

@@ -107,7 +107,7 @@ const feedbackEventMapper = (json, frame) => {
     } else {
         response.post = null;
     }
-    
+
     if (data.member) {
         response.member = _.pick(data.member, memberFields);
     } else {
@@ -159,6 +159,12 @@ const activityFeedMapper = (event, frame) => {
     if (event.data?.subscriptionCreatedEvent) {
         delete event.data.subscriptionCreatedEvent;
     }
+
+    if (event.data.member) {
+        event.data.member = _.pick(event.data.member, memberFields);
+    } else {
+        event.data.member = null;
+    }
     return event;
 };
 

package/core/server/data/migrations/versions/5.74/2023-11-14-11-15-00-add-transient-id-column-nullable.js

@@ -0,0 +1,9 @@
+const {createAddColumnMigration} = require('../../utils');
+
+// First make a nullable column
+module.exports = createAddColumnMigration('members', 'transient_id', {
+    type: 'string',
+    maxlength: 191,
+    nullable: true,
+    unique: true
+});

package/core/server/data/migrations/versions/5.74/2023-11-14-11-16-00-fill-transient-id-column.js

@@ -0,0 +1,17 @@
+const logging = require('@tryghost/logging');
+
+const {createTransactionalMigration} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        logging.info('Setting transient_id column to email');
+
+        const updatedRows = await knex('members')
+            .update('transient_id', knex.raw('email'));
+
+        logging.info(`Updated ${updatedRows} members with transient_id = email`);
+    },
+    async function down() {
+        // Not required
+    }
+);

package/core/server/data/migrations/versions/5.74/2023-11-14-11-17-00-drop-nullable-transient-id-column.js

@@ -0,0 +1,4 @@
+const {createDropNullableMigration} = require('../../utils');
+
+// We need to disable foreign key checks because if MySQL is missing the STRICT_TRANS_TABLES mode, we cannot revert the migration
+module.exports = createDropNullableMigration('members', 'transient_id', {disableForeignKeyChecks: true});

package/core/server/data/schema/schema.js

@@ -417,6 +417,7 @@ module.exports = {
     members: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         uuid: {type: 'string', maxlength: 36, nullable: true, unique: true, validations: {isUUID: true}},
+        transient_id: {type: 'string', maxlength: 191, nullable: false, unique: true},
         email: {type: 'string', maxlength: 191, nullable: false, unique: true, validations: {isEmail: true}},
         status: {
             type: 'string', maxlength: 50, nullable: false, defaultTo: 'free', validations: {

package/core/server/lib/lexical.js

@@ -99,10 +99,6 @@ module.exports = {
                     && imageTransform.shouldResizeFileExtension(ext)
                     && typeof storage.getStorage('images').saveRaw === 'function';
             },
-            createDocument() {
-                const {JSDOM} = require('jsdom');
-                return (new JSDOM()).window.document;
-            },
             getCollectionPosts
         }, userOptions);
 

package/core/server/models/comment.js

@@ -78,7 +78,7 @@ const Comment = ghostBookshelf.Model.extend({
                     // Enforce _blank and safe URLs
                     transformTags: {
                         a: sanitizeHtml.simpleTransform('a', {
-                            target: '_blank', 
+                            target: '_blank',
                             rel: 'ugc noopener noreferrer nofollow'
                         })
                     }
@@ -106,7 +106,7 @@ const Comment = ghostBookshelf.Model.extend({
             if (options.parentId === null) {
                 return 'parent_id:null';
             }
-            return 'parent_id:' + options.parentId;
+            return 'parent_id:\'' + options.parentId + '\'';
         }
 
         return null;

package/core/server/models/member.js

@@ -11,6 +11,7 @@ const Member = ghostBookshelf.Model.extend({
         return {
             status: 'free',
             uuid: uuid.v4(),
+            transient_id: uuid.v4(),
             email_count: 0,
             email_opened_count: 0,
             enable_comment_notifications: true

package/core/server/models/post.js

@@ -904,7 +904,7 @@ Post = ghostBookshelf.Model.extend({
             ops.push(function updateRevisions() {
                 return ghostBookshelf.model('MobiledocRevision')
                     .findAll(Object.assign({
-                        filter: `post_id:${model.id}`,
+                        filter: `post_id:'${model.id}'`,
                         columns: ['id']
                     }, _.pick(options, 'transacting')))
                     .then((revisions) => {
@@ -958,7 +958,7 @@ Post = ghostBookshelf.Model.extend({
             ops.push(async function updateRevisions() {
                 const revisionModels = await ghostBookshelf.model('PostRevision')
                     .findAll(Object.assign({
-                        filter: `post_id:${model.id}`,
+                        filter: `post_id:'${model.id}'`,
                         columns: ['id', 'lexical', 'created_at', 'author_id', 'title', 'reason', 'post_status', 'created_at_ts', 'feature_image']
                     }, _.pick(options, 'transacting')));
 

package/core/server/services/email-analytics/EmailAnalyticsServiceWrapper.js

@@ -9,7 +9,7 @@ class EmailAnalyticsServiceWrapper {
         const {EmailAnalyticsService} = require('@tryghost/email-analytics-service');
         const {EmailEventStorage, EmailEventProcessor} = require('@tryghost/email-service');
         const MailgunProvider = require('@tryghost/email-analytics-provider-mailgun');
-        const {EmailRecipientFailure, EmailSpamComplaintEvent} = require('../../models');
+        const {EmailRecipientFailure, EmailSpamComplaintEvent, Email} = require('../../models');
         const StartEmailAnalyticsJobEvent = require('./events/StartEmailAnalyticsJobEvent');
 
         const domainEvents = require('@tryghost/domain-events');
@@ -19,14 +19,17 @@ class EmailAnalyticsServiceWrapper {
         const queries = require('./lib/queries');
         const membersService = require('../members');
         const membersRepository = membersService.api.members;
+        const emailSuppressionList = require('../email-suppression-list');
 
         this.eventStorage = new EmailEventStorage({
             db,
             membersRepository,
             models: {
+                Email,
                 EmailRecipientFailure,
                 EmailSpamComplaintEvent
-            }
+            },
+            emailSuppressionList
         });
 
         // Since this is running in a worker thread, we cant dispatch directly

package/core/server/services/email-suppression-list/MailgunEmailSuppressionList.js

@@ -47,6 +47,15 @@ class MailgunEmailSuppressionList extends AbstractEmailSuppressionList {
         return true;
     }
 
+    async removeUnsubscribe(email) {
+        try {
+            await this.apiClient.removeUnsubscribe(email);
+        } catch (err) {
+            logging.error(err);
+            return false;
+        }
+    }
+
     async getSuppressionData(email) {
         try {
             const model = await this.Suppression.findOne({

package/core/server/services/offers/OfferBookshelfRepository.js

@@ -97,7 +97,6 @@ class OfferBookshelfRepository {
      */
     async mapToOffer(model, options) {
         const json = model.toJSON();
-
         const count = await this.OfferRedemptionModel.where({offer_id: json.id}).count('id', {
             transacting: options.transacting
         });
@@ -119,7 +118,8 @@ class OfferBookshelfRepository {
                 tier: {
                     id: json.product.id,
                     name: json.product.name
-                }
+                },
+                created_at: json.created_at
             }, null);
         } catch (err) {
             logger.error(err);

package/core/server/services/webhooks/listen.js

@@ -52,7 +52,7 @@ const listen = async () => {
         const overLimit = await limitService.checkWouldGoOverLimit('customIntegrations');
 
         if (overLimit) {
-            logging.info(`Skipped subscribing webhooks to events. The "customIntegrations" plan limit is enabled."`);
+            logging.info(`Skipped subscribing webhooks to events. The "customIntegrations" plan limit is enabled.`);
             return;
         }
     }

package/core/server/web/api/endpoints/admin/routes.js

@@ -144,6 +144,7 @@ module.exports = function apiRoutes() {
     router.get('/members/:id', mw.authAdminApi, http(api.members.read));
     router.put('/members/:id', mw.authAdminApi, http(api.members.edit));
     router.del('/members/:id', mw.authAdminApi, http(api.members.destroy));
+    router.del('/members/:id/sessions', mw.authAdminApi, http(api.members.logout));
 
     router.post('/members/:id/subscriptions/', mw.authAdminApi, http(api.members.createSubscription));
     router.put('/members/:id/subscriptions/:subscription_id', mw.authAdminApi, http(api.members.editSubscription));

package/core/server/web/api/endpoints/content/routes.js

@@ -4,7 +4,6 @@ const api = require('../../../../api').endpoints;
 const {http} = require('@tryghost/api-framework');
 const mw = require('./middleware');
 const config = require('../../../../../shared/config');
-const membersService = require('../../../../../server/services/members');
 
 module.exports = function apiRoutes() {
     const router = express.Router('content api');
@@ -32,7 +31,7 @@ module.exports = function apiRoutes() {
     router.get('/tags/slug/:slug', mw.authenticatePublic, http(api.tagsPublic.read));
 
     // ## Settings
-    router.get('/settings', mw.authenticatePublic, membersService.middleware.loadMemberSession, http(api.publicSettings.browse));
+    router.get('/settings', mw.authenticatePublic, http(api.publicSettings.browse));
 
     // ## Members
     router.get('/newsletters', mw.authenticatePublic, http(api.newslettersPublic.browse));

package/core/server/web/members/app.js

@@ -51,7 +51,7 @@ module.exports = function setupMembersApp() {
 
     // Manage session
     membersApp.get('/api/session', middleware.getIdentityToken);
-    membersApp.delete('/api/session', middleware.deleteSession);
+    membersApp.delete('/api/session', bodyParser.json({limit: '5mb'}), middleware.deleteSession);
 
     // NOTE: this is wrapped in a function to ensure we always go via the getter
     membersApp.post(

package/core/shared/labs.js

@@ -21,7 +21,9 @@ const GA_FEATURES = [
     'announcementBar',
     'signupForm',
     'recommendations',
-    'editorEmojiPicker'
+    'editorEmojiPicker',
+    'listUnsubscribeHeader',
+    'filterEmailDisabled'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -43,7 +45,7 @@ const ALPHA_FEATURES = [
     'tipsAndDonations',
     'importMemberTier',
     'lexicalIndicators',
-    'listUnsubscribeHeader',
+    'editorEmojiPicker',
     'adminXOffers'
 ];