ghost 5.74.2 → 5.74.4

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.74%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2270a47c7b40%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2247f97526c1%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.74%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a5d777fdf2%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2254a22f23e1%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22f76ec8c678%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-ad224505f7a80c242cc1272d1755995d.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-0456ea5c74bd1b27239c11706d1acae9.css" title="light">
 
     
 </head>
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-f6856af9fcd8ab6533f2a4339ececbc8.js"></script>
-<script src="assets/chunk.761.5cfbe0d0f8ec7aefe7bc.js"></script>
-<script src="assets/chunk.143.a97e9374518a7e548084.js"></script>
-    <script src="assets/ghost-ad9952b86c1d886c49a92339adf702e3.js"></script>
+<script src="assets/chunk.137.0297fba124bc9ba1bbc1.js"></script>
+<script src="assets/chunk.143.0c31227118654150d49c.js"></script>
+    <script src="assets/ghost-7d0f91cd17901ac15ce0ae64a3091e2a.js"></script>
 </body>
 </html>

package/core/frontend/helpers/img_url.js

@@ -7,19 +7,21 @@
 // Returns the URL for the current object scope i.e. If inside a post scope will return image permalink
 // `absolute` flag outputs absolute URL, else URL is relative.
 const {urlUtils} = require('../services/proxy');
+const {
+    detectInternalImage,
+    getImageWithSize,
+    getUnsplashImage,
+    detectUnsplashImage
+} = require('../utils/images');
 
-const url = require('url');
 const _ = require('lodash');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
-const imageTransform = require('@tryghost/image-transform');
 
 const messages = {
     attrIsRequired: 'Attribute is required e.g. {{img_url feature_image}}'
 };
 
-const STATIC_IMAGE_URL_PREFIX = `${urlUtils.STATIC_IMAGE_URL_PREFIX}`;
-
 module.exports = function imgUrl(requestedImageUrl, options) {
     // CASE: if no url is passed, e.g. `{{img_url}}` we show a warning
     if (arguments.length < 2) {
@@ -46,7 +48,7 @@ module.exports = function imgUrl(requestedImageUrl, options) {
 
     if (!isInternalImage) {
         // Detect Unsplash width and format
-        const isUnsplashImage = /images\.unsplash\.com/.test(requestedImageUrl);
+        const isUnsplashImage = detectUnsplashImage(requestedImageUrl);
         if (isUnsplashImage) {
             try {
                 return getUnsplashImage(requestedImageUrl, sizeOptions);
@@ -99,95 +101,3 @@ function getImageSizeOptions(options) {
         requestedFormat
     };
 }
-
-function detectInternalImage(requestedImageUrl) {
-    const siteUrl = urlUtils.getSiteUrl();
-    const isAbsoluteImage = /https?:\/\//.test(requestedImageUrl);
-    const isAbsoluteInternalImage = isAbsoluteImage && requestedImageUrl.startsWith(siteUrl);
-
-    // CASE: imagePath is a "protocol relative" url e.g. "//www.gravatar.com/ava..."
-    //       by resolving the the imagePath relative to the blog url, we can then
-    //       detect if the imagePath is external, or internal.
-    const isRelativeInternalImage = !isAbsoluteImage && url.resolve(siteUrl, requestedImageUrl).startsWith(siteUrl);
-
-    return isAbsoluteInternalImage || isRelativeInternalImage;
-}
-
-function getUnsplashImage(imagePath, sizeOptions) {
-    const parsedUrl = new URL(imagePath);
-    const {requestedSize, imageSizes, requestedFormat} = sizeOptions;
-
-    if (requestedFormat) {
-        const supportedFormats = ['avif', 'gif', 'jpg', 'png', 'webp'];
-        if (supportedFormats.includes(requestedFormat)) {
-            parsedUrl.searchParams.set('fm', requestedFormat);
-        } else if (requestedFormat === 'jpeg') {
-            // Map to alias
-            parsedUrl.searchParams.set('fm', 'jpg');
-        }
-    }
-
-    if (!imageSizes || !imageSizes[requestedSize]) {
-        return parsedUrl.toString();
-    }
-
-    const {width, height} = imageSizes[requestedSize];
-
-    if (!width && !height) {
-        return parsedUrl.toString();
-    }
-
-    parsedUrl.searchParams.delete('w');
-    parsedUrl.searchParams.delete('h');
-
-    if (width) {
-        parsedUrl.searchParams.set('w', width);
-    }
-    if (height) {
-        parsedUrl.searchParams.set('h', height);
-    }
-    return parsedUrl.toString();
-}
-
-/**
- *
- * @param {string} imagePath
- * @param {Object} sizeOptions
- * @param {string} sizeOptions.requestedSize
- * @param {Object[]} sizeOptions.imageSizes
- * @param {string} [sizeOptions.requestedFormat]
- * @returns
- */
-function getImageWithSize(imagePath, sizeOptions) {
-    const hasLeadingSlash = imagePath[0] === '/';
-
-    if (hasLeadingSlash) {
-        return '/' + getImageWithSize(imagePath.slice(1), sizeOptions);
-    }
-    const {requestedSize, imageSizes, requestedFormat} = sizeOptions;
-
-    if (!requestedSize) {
-        return imagePath;
-    }
-
-    if (!imageSizes || !imageSizes[requestedSize]) {
-        return imagePath;
-    }
-
-    const {width, height} = imageSizes[requestedSize];
-
-    if (!width && !height) {
-        return imagePath;
-    }
-
-    const [imgBlogUrl, imageName] = imagePath.split(STATIC_IMAGE_URL_PREFIX);
-
-    const sizeDirectoryName = prefixIfPresent('w', width) + prefixIfPresent('h', height);
-    const formatPrefix = requestedFormat && imageTransform.canTransformToFormat(requestedFormat) ? `/format/${requestedFormat}` : '';
-
-    return [imgBlogUrl, STATIC_IMAGE_URL_PREFIX, `/size/${sizeDirectoryName}`, formatPrefix, imageName].join('');
-}
-
-function prefixIfPresent(prefix, string) {
-    return string ? prefix + string : '';
-}

package/core/frontend/meta/image-dimensions.js

@@ -1,4 +1,6 @@
 const _ = require('lodash');
+const {getImageWithSize} = require('../utils/images');
+const config = require('../../shared/config');
 const imageSizeCache = require('../../server/lib/image').cachedImageSizeFromUrl;
 
 /**
@@ -9,23 +11,28 @@ const imageSizeCache = require('../../server/lib/image').cachedImageSizeFromUrl;
  * called to receive image width and height
  */
 async function getImageDimensions(metaData) {
+    const MAX_SOCIAL_IMG_WIDTH = config.get('imageOptimization:internalImageSizes:social-image:width') || 1200;
+
     const fetch = {
         coverImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.coverImage.url),
         authorImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.authorImage.url),
         ogImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.ogImage.url),
+        twitterImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.twitterImage),
         logo: imageSizeCache.getCachedImageSizeFromUrl(metaData.site.logo.url)
     };
 
-    const [coverImage, authorImage, ogImage, logo] = await Promise.all([
+    const [coverImage, authorImage, ogImage, twitterImage, logo] = await Promise.all([
         fetch.coverImage,
         fetch.authorImage,
         fetch.ogImage,
+        fetch.twitterImage,
         fetch.logo
     ]);
     const imageObj = {
         coverImage,
         authorImage,
         ogImage,
+        twitterImage,
         logo
     };
 
@@ -53,12 +60,33 @@ async function getImageDimensions(metaData) {
                     });
                 }
             } else {
-                _.assign(metaData[value], {
-                    dimensions: {
-                        width: key.width,
-                        height: key.height
+                if (key.width > MAX_SOCIAL_IMG_WIDTH) {
+                    const ratio = key.height / key.width;
+                    key.width = MAX_SOCIAL_IMG_WIDTH;
+                    key.height = Math.round(MAX_SOCIAL_IMG_WIDTH * ratio);
+
+                    const sizeOptions = {
+                        requestedSize: `social-image`,
+                        imageSizes: config.get('imageOptimization:internalImageSizes')
+                    };
+
+                    if (typeof metaData[value] === 'string') {
+                        const url = getImageWithSize(metaData[value], sizeOptions);
+                        metaData[value] = url;
+                    } else {
+                        const url = getImageWithSize(metaData[value].url, sizeOptions);
+                        _.assign(metaData[value], {url});
                     }
-                });
+                }
+
+                if (typeof metaData[value] === 'object') {
+                    _.assign(metaData[value], {
+                        dimensions: {
+                            width: key.width,
+                            height: key.height
+                        }
+                    });
+                }
             }
         }
     });

package/core/frontend/utils/images.js

@@ -0,0 +1,100 @@
+const url = require('url');
+const imageTransform = require('@tryghost/image-transform');
+const urlUtils = require('../../shared/url-utils');
+
+module.exports.detectInternalImage = function detectInternalImage(requestedImageUrl) {
+    const siteUrl = urlUtils.getSiteUrl();
+    const isAbsoluteImage = /https?:\/\//.test(requestedImageUrl);
+    const isAbsoluteInternalImage = isAbsoluteImage && requestedImageUrl.startsWith(siteUrl);
+
+    // CASE: imagePath is a "protocol relative" url e.g. "//www.gravatar.com/ava..."
+    //       by resolving the the imagePath relative to the blog url, we can then
+    //       detect if the imagePath is external, or internal.
+    const isRelativeInternalImage = !isAbsoluteImage && url.resolve(siteUrl, requestedImageUrl).startsWith(siteUrl);
+
+    return isAbsoluteInternalImage || isRelativeInternalImage;
+};
+
+module.exports.detectUnsplashImage = function detectUnsplashImage(requestedImageUrl) {
+    const isUnsplashImage = /images\.unsplash\.com/.test(requestedImageUrl);
+    return isUnsplashImage;
+};
+
+module.exports.getUnsplashImage = function getUnsplashImage(imagePath, sizeOptions) {
+    const parsedUrl = new URL(imagePath);
+    const {requestedSize, imageSizes, requestedFormat} = sizeOptions;
+
+    if (requestedFormat) {
+        const supportedFormats = ['avif', 'gif', 'jpg', 'png', 'webp'];
+        if (supportedFormats.includes(requestedFormat)) {
+            parsedUrl.searchParams.set('fm', requestedFormat);
+        } else if (requestedFormat === 'jpeg') {
+            // Map to alias
+            parsedUrl.searchParams.set('fm', 'jpg');
+        }
+    }
+
+    if (!imageSizes || !imageSizes[requestedSize]) {
+        return parsedUrl.toString();
+    }
+
+    const {width, height} = imageSizes[requestedSize];
+
+    if (!width && !height) {
+        return parsedUrl.toString();
+    }
+
+    parsedUrl.searchParams.delete('w');
+    parsedUrl.searchParams.delete('h');
+
+    if (width) {
+        parsedUrl.searchParams.set('w', width);
+    }
+    if (height) {
+        parsedUrl.searchParams.set('h', height);
+    }
+    return parsedUrl.toString();
+};
+
+/**
+ *
+ * @param {string} imagePath
+ * @param {Object} sizeOptions
+ * @param {string} sizeOptions.requestedSize
+ * @param {Object[]} sizeOptions.imageSizes
+ * @param {string} [sizeOptions.requestedFormat]
+ * @returns
+ */
+module.exports.getImageWithSize = function getImageWithSize(imagePath, sizeOptions) {
+    const hasLeadingSlash = imagePath[0] === '/';
+
+    if (hasLeadingSlash) {
+        return '/' + getImageWithSize(imagePath.slice(1), sizeOptions);
+    }
+    const {requestedSize, imageSizes, requestedFormat} = sizeOptions;
+
+    if (!requestedSize) {
+        return imagePath;
+    }
+
+    if (!imageSizes || !imageSizes[requestedSize]) {
+        return imagePath;
+    }
+
+    const {width, height} = imageSizes[requestedSize];
+
+    if (!width && !height) {
+        return imagePath;
+    }
+
+    const [imgBlogUrl, imageName] = imagePath.split(urlUtils.STATIC_IMAGE_URL_PREFIX);
+
+    const sizeDirectoryName = prefixIfPresent('w', width) + prefixIfPresent('h', height);
+    const formatPrefix = requestedFormat && imageTransform.canTransformToFormat(requestedFormat) ? `/format/${requestedFormat}` : '';
+
+    return [imgBlogUrl, urlUtils.STATIC_IMAGE_URL_PREFIX, `/size/${sizeDirectoryName}`, formatPrefix, imageName].join('');
+};
+
+function prefixIfPresent(prefix, string) {
+    return string ? prefix + string : '';
+}

package/core/server/api/endpoints/users.js

@@ -40,6 +40,39 @@ async function fetchOrCreatePersonalToken(userId) {
     return token;
 }
 
+function shouldInvalidateCacheAfterChange(model) {
+    // Model attributes that should trigger cache invalidation when changed
+    // (because they affect the frontend)
+    const publicAttrs = [
+        'name',
+        'slug',
+        'profile_image',
+        'cover_image',
+        'bio',
+        'website',
+        'location',
+        'facebook',
+        'twitter',
+        'status',
+        'visibility',
+        'meta_title',
+        'meta_description'
+    ];
+
+    if (model.wasChanged() === false) {
+        return false;
+    }
+
+    // Check if any of the changed attributes are public
+    for (const attr of Object.keys(model._changed)) {
+        if (publicAttrs.includes(attr) === true) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 module.exports = {
     docName: 'users',
 
@@ -137,11 +170,7 @@ module.exports = {
                         }));
                     }
 
-                    if (model.wasChanged()) {
-                        this.headers.cacheInvalidate = true;
-                    } else {
-                        this.headers.cacheInvalidate = false;
-                    }
+                    this.headers.cacheInvalidate = shouldInvalidateCacheAfterChange(model);
 
                     return model;
                 });

package/core/server/data/schema/schema.js

@@ -17,7 +17,7 @@ module.exports = {
         slug: {type: 'string', maxlength: 191, nullable: false, unique: true},
         sender_name: {type: 'string', maxlength: 191, nullable: true},
         sender_email: {type: 'string', maxlength: 191, nullable: true},
-        sender_reply_to: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'newsletter', validations: {isIn: [['newsletter', 'support']]}},
+        sender_reply_to: {type: 'string', maxlength: 191, nullable: false, defaultTo: 'newsletter'},
         status: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'active', validations: {isIn: [['active', 'archived']]}},
         visibility: {
             type: 'string',

package/core/server/models/base/plugins/events.js

@@ -7,6 +7,10 @@ const schema = require('../../../data/schema');
 // This wires up our model event system
 const events = require('../../../lib/common/events');
 
+// Run tests or development with NUMERIC_IDS=1 to enable numeric object IDs
+let forceNumericObjectIds = process.env.NODE_ENV !== 'production' && !!process.env.NUMERIC_IDS;
+let numberGenerator = 0;
+
 module.exports = function (Bookshelf) {
     Bookshelf.Model = Bookshelf.Model.extend({
         initializeEvents: function () {
@@ -39,7 +43,7 @@ module.exports = function (Bookshelf) {
          * no auto increment
          */
         setId: function setId() {
-            this.set('id', ObjectId().toHexString());
+            this.set('id', Bookshelf.Model.generateId());
         },
 
         /**
@@ -268,5 +272,20 @@ module.exports = function (Bookshelf) {
 
             this.addAction(model, 'deleted', options);
         }
+    }, {
+        generateId: function generateId() {
+            if (forceNumericObjectIds) {
+                numberGenerator = numberGenerator + 1;
+                const counter = numberGenerator.toString();
+
+                // 77777777 here are to make sure generated ids's are larger than naturally generated ones
+                const base = '777777770000000000000000';
+                const id = base.substring(0, base.length - counter.length) + counter;
+
+                //// This always generates a valid object ID that is fully numeric
+                return id;
+            }
+            return ObjectId().toHexString();
+        }
     });
 };

package/core/server/services/email-address/EmailAddressServiceWrapper.js

@@ -0,0 +1,39 @@
+class EmailAddressServiceWrapper {
+    /**
+     * @type {import('@tryghost/email-addresses').EmailAddressService}
+     */
+    service;
+
+    init() {
+        if (this.service) {
+            return;
+        }
+
+        const labs = require('../../../shared/labs');
+        const config = require('../../../shared/config');
+        const settingsHelpers = require('../settings-helpers');
+        const validator = require('@tryghost/validator');
+
+        const {
+            EmailAddressService
+        } = require('@tryghost/email-addresses');
+
+        this.service = new EmailAddressService({
+            labs,
+            getManagedEmailEnabled: () => {
+                return config.get('hostSettings:managedEmail:enabled') ?? false;
+            },
+            getSendingDomain: () => {
+                return config.get('hostSettings:managedEmail:sendingDomain') || null;
+            },
+            getDefaultEmail: () => {
+                return settingsHelpers.getDefaultEmail();
+            },
+            isValidEmailAddress: (emailAddress) => {
+                return validator.isEmail(emailAddress);
+            }
+        });
+    }
+}
+
+module.exports = EmailAddressServiceWrapper;

package/core/server/services/email-address/index.js

@@ -0,0 +1,3 @@
+const EmailAddressServiceWrapper = require('./EmailAddressServiceWrapper');
+
+module.exports = new EmailAddressServiceWrapper();

package/core/server/services/email-service/EmailServiceWrapper.js

@@ -26,6 +26,7 @@ class EmailServiceWrapper {
         const membersRepository = membersService.api.members;
         const limitService = require('../limits');
         const labs = require('../../../shared/labs');
+        const emailAddressService = require('../email-address');
 
         const mobiledocLib = require('../../lib/mobiledoc');
         const lexicalLib = require('../../lib/lexical');
@@ -70,6 +71,7 @@ class EmailServiceWrapper {
             memberAttributionService: memberAttribution.service,
             audienceFeedbackService: audienceFeedback.service,
             outboundLinkTagger: memberAttribution.outboundLinkTagger,
+            emailAddressService: emailAddressService.service,
             labs,
             models: {Post}
         });

package/core/server/services/mail/GhostMailer.js

@@ -8,6 +8,8 @@ const tpl = require('@tryghost/tpl');
 const settingsCache = require('../../../shared/settings-cache');
 const urlUtils = require('../../../shared/url-utils');
 const metrics = require('@tryghost/metrics');
+const settingsHelpers = require('../settings-helpers');
+const emailAddress = require('../email-address');
 const messages = {
     title: 'Ghost at {domain}',
     checkEmailConfigInstructions: 'Please see {url} for instructions on configuring email.',
@@ -16,29 +18,59 @@ const messages = {
     reason: ' Reason: {reason}.',
     messageSent: 'Message sent. Double check inbox and spam folder!'
 };
+const {EmailAddressParser} = require('@tryghost/email-addresses');
+const logging = require('@tryghost/logging');
 
 function getDomain() {
     const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
     return domain && domain[1];
 }
 
-function getFromAddress(requestedFromAddress) {
+/**
+ * @param {string} requestedFromAddress
+ * @param {string} requestedReplyToAddress
+ * @returns {{from: string, replyTo?: string|null}}
+ */
+function getFromAddress(requestedFromAddress, requestedReplyToAddress) {
+    if (settingsHelpers.useNewEmailAddresses()) {
+        if (!requestedFromAddress) {
+            // Use the default config
+            requestedFromAddress = emailAddress.service.defaultFromEmail;
+        }
+
+        // Clean up email addresses (checks whether sending is allowed + email address is valid)
+        const addresses = emailAddress.service.getAddressFromString(requestedFromAddress, requestedReplyToAddress);
+
+        // fill in missing name if not set
+        const defaultSiteTitle = settingsCache.get('title') ? settingsCache.get('title') : tpl(messages.title, {domain: getDomain()});
+        if (!addresses.from.name) {
+            addresses.from.name = defaultSiteTitle;
+        }
+
+        return {
+            from: EmailAddressParser.stringify(addresses.from),
+            replyTo: addresses.replyTo ? EmailAddressParser.stringify(addresses.replyTo) : null
+        };
+    }
     const configAddress = config.get('mail') && config.get('mail').from;
 
     const address = requestedFromAddress || configAddress;
     // If we don't have a from address at all
     if (!address) {
         // Default to noreply@[blog.url]
-        return getFromAddress(`noreply@${getDomain()}`);
+        return getFromAddress(`noreply@${getDomain()}`, requestedReplyToAddress);
     }
 
     // If we do have a from address, and it's just an email
     if (validator.isEmail(address, {require_tld: false})) {
         const defaultSiteTitle = settingsCache.get('title') ? settingsCache.get('title').replace(/"/g, '\\"') : tpl(messages.title, {domain: getDomain()});
-        return `"${defaultSiteTitle}" <${address}>`;
+        return {
+            from: `"${defaultSiteTitle}" <${address}>`
+        };
     }
 
-    return address;
+    logging.warn(`Invalid from address used for sending emails: ${address}`);
+    return {from: address};
 }
 
 /**
@@ -47,16 +79,21 @@ function getFromAddress(requestedFromAddress) {
  * @param {Object} message
  * @param {boolean} [message.forceTextContent] - force text content
  * @param {string} [message.from] - sender email address
+ * @param {string} [message.replyTo]
  * @returns {Object}
  */
 function createMessage(message) {
     const encoding = 'base64';
     const generateTextFromHTML = !message.forceTextContent;
-    return Object.assign({}, message, {
-        from: getFromAddress(message.from),
+
+    const addresses = getFromAddress(message.from, message.replyTo);
+
+    return {
+        ...message,
+        ...addresses,
         generateTextFromHTML,
         encoding
-    });
+    };
 }
 
 function createMailError({message, err, ignoreDefaultMessage} = {message: ''}) {
@@ -154,13 +191,13 @@ module.exports = class GhostMailer {
             return tpl(messages.messageSent);
         }
 
-        if (response.pending.length > 0) {
+        if (response.pending && response.pending.length > 0) {
             throw createMailError({
                 message: tpl(messages.reason, {reason: 'Email has been temporarily rejected'})
             });
         }
 
-        if (response.errors.length > 0) {
+        if (response.errors && response.errors.length > 0) {
             throw createMailError({
                 message: tpl(messages.reason, {reason: response.errors[0].message})
             });

package/core/server/services/members/service.js

@@ -89,7 +89,13 @@ const initVerificationTrigger = () => {
         isVerificationRequired: () => settingsCache.get('email_verification_required') === true,
         sendVerificationEmail: async ({subject, message, amountTriggered}) => {
             const escalationAddress = config.get('hostSettings:emailVerification:escalationAddress');
-            const fromAddress = config.get('user_email');
+            let fromAddress = config.get('user_email');
+            let replyTo = undefined;
+
+            if (settingsHelpers.useNewEmailAddresses()) {
+                replyTo = fromAddress;
+                fromAddress = settingsHelpers.getNoReplyAddress();
+            }
 
             if (escalationAddress) {
                 await ghostMailer.send({
@@ -100,6 +106,7 @@ const initVerificationTrigger = () => {
                     }),
                     forceTextContent: true,
                     from: fromAddress,
+                    replyTo,
                     to: escalationAddress
                 });
             }