ghost 5.74.3 → 5.74.4

package/core/server/services/newsletters/NewslettersService.js

@@ -8,7 +8,9 @@ const errors = require('@tryghost/errors');
 
 const messages = {
     nameAlreadyExists: 'A newsletter with the same name already exists',
-    newsletterNotFound: 'Newsletter not found.'
+    newsletterNotFound: 'Newsletter not found.',
+    senderEmailNotAllowed: 'You cannot set the sender email address to {email}',
+    replyToNotAllowed: 'You cannot set the reply-to email address to {email}'
 };
 
 class NewslettersService {
@@ -21,9 +23,10 @@ class NewslettersService {
      * @param {Object} options.singleUseTokenProvider
      * @param {Object} options.urlUtils
      * @param {ILimitService} options.limitService
+     * @param {Object} options.emailAddressService
      * @param {Object} options.labs
      */
-    constructor({NewsletterModel, MemberModel, mail, singleUseTokenProvider, urlUtils, limitService, labs}) {
+    constructor({NewsletterModel, MemberModel, mail, singleUseTokenProvider, urlUtils, limitService, labs, emailAddressService}) {
         this.NewsletterModel = NewsletterModel;
         this.MemberModel = MemberModel;
         this.urlUtils = urlUtils;
@@ -31,6 +34,8 @@ class NewslettersService {
         this.limitService = limitService;
         /** @private */
         this.labs = labs;
+        /** @private */
+        this.emailAddressService = emailAddressService;
 
         /* email verification setup */
 
@@ -243,14 +248,48 @@ class NewslettersService {
     async prepAttrsForEmailVerification(attrs, newsletter) {
         const cleanedAttrs = _.cloneDeep(attrs);
         const emailsToVerify = [];
+        const emailProperties = [
+            {property: 'sender_email', type: 'from', emptyable: true, error: messages.senderEmailNotAllowed}
+        ];
+
+        if (!this.emailAddressService.service.useNewEmailAddresses) {
+            // Validate reply_to is either newsletter or support
+            if (cleanedAttrs.sender_reply_to !== undefined) {
+                if (!['newsletter', 'support'].includes(cleanedAttrs.sender_reply_to)) {
+                    throw new errors.ValidationError({
+                        message: tpl(messages.replyToNotAllowed, {email: cleanedAttrs.sender_reply_to})
+                    });
+                }
+            }
+        } else {
+            if (cleanedAttrs.sender_reply_to !== undefined) {
+                if (!['newsletter', 'support'].includes(cleanedAttrs.sender_reply_to)) {
+                    emailProperties.push({property: 'sender_reply_to', type: 'replyTo', emptyable: false, error: messages.replyToNotAllowed});
+                }
+            }
+        }
 
-        for (const property of ['sender_email']) {
+        for (const {property, type, emptyable, error} of emailProperties) {
             const email = cleanedAttrs[property];
             const hasChanged = !newsletter || newsletter.get(property) !== email;
 
-            if (await this.requiresEmailVerification({email, hasChanged})) {
-                delete cleanedAttrs[property];
-                emailsToVerify.push({email, property});
+            if (hasChanged && email !== undefined) {
+                if (email === null || email === '' && emptyable) {
+                    continue;
+                }
+
+                const validated = this.emailAddressService.service.validate(email, type);
+
+                if (!validated.allowed) {
+                    throw new errors.ValidationError({
+                        message: tpl(error, {email})
+                    });
+                }
+
+                if (validated.verificationEmailRequired) {
+                    delete cleanedAttrs[property];
+                    emailsToVerify.push({email, property});
+                }
             }
         }
 
@@ -264,19 +303,6 @@ class NewslettersService {
         return {cleanedAttrs, emailsToVerify};
     }
 
-    /**
-     * @private
-     */
-    async requiresEmailVerification({email, hasChanged}) {
-        if (!email || !hasChanged) {
-            return false;
-        }
-
-        // TODO: check other newsletters for known/verified email
-
-        return true;
-    }
-
     /**
      * @private
      */
@@ -304,6 +330,13 @@ class NewslettersService {
             fromEmail = `no-reply@${toDomain}`;
         }
 
+        if (this.emailAddressService.useNewEmailAddresses) {
+            // Gone with the old logic: always use the default email address here
+            // We don't need to validate the FROM address, only the to address
+            // Also because we are not only validating FROM addresses, but also possible REPLY-TO addresses, which we won't send FROM
+            fromEmail = this.emailAddressService.defaultFromAddress;
+        }
+
         const {ghostMailer} = this;
 
         this.magicLinkService.transporter = {

package/core/server/services/newsletters/index.js

@@ -5,6 +5,7 @@ const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils');
 const limitService = require('../limits');
 const labs = require('../../../shared/labs');
+const emailAddressService = require('../email-address');
 
 const MAGIC_LINK_TOKEN_VALIDITY = 24 * 60 * 60 * 1000;
 const MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE = 10 * 60 * 1000;
@@ -22,5 +23,6 @@ module.exports = new NewslettersService({
     }),
     urlUtils,
     limitService,
-    labs
+    labs,
+    emailAddressService: emailAddressService
 });

package/core/server/services/offers/OfferBookshelfRepository.js

@@ -100,6 +100,12 @@ class OfferBookshelfRepository {
         const count = await this.OfferRedemptionModel.where({offer_id: json.id}).count('id', {
             transacting: options.transacting
         });
+
+        const lastRedeemed = await this.OfferRedemptionModel.where({offer_id: json.id}).orderBy('created_at', 'DESC').fetchAll({
+            transacting: options.transacting,
+            limit: 1
+        });
+
         try {
             return await Offer.create({
                 id: json.id,
@@ -119,7 +125,8 @@ class OfferBookshelfRepository {
                     id: json.product.id,
                     name: json.product.name
                 },
-                created_at: json.created_at
+                created_at: json.created_at,
+                last_redeemed: lastRedeemed.toJSON().length > 0 ? lastRedeemed.toJSON()[0].created_at : null
             }, null);
         } catch (err) {
             logger.error(err);

package/core/server/services/settings/settings-service.js

@@ -92,6 +92,10 @@ module.exports = {
         fields.push(new CalculatedField({key: 'firstpromoter_account', type: 'string', group: 'firstpromoter', fn: settingsHelpers.getFirstpromoterId.bind(settingsHelpers), dependents: ['firstpromoter', 'firstpromoter_id']}));
         fields.push(new CalculatedField({key: 'donations_enabled', type: 'boolean', group: 'donations', fn: settingsHelpers.areDonationsEnabled.bind(settingsHelpers), dependents: ['stripe_secret_key', 'stripe_publishable_key', 'stripe_connect_secret_key', 'stripe_connect_publishable_key']}));
 
+        // E-mail addresses
+        fields.push(new CalculatedField({key: 'default_email_address', type: 'string', group: 'email', fn: settingsHelpers.getDefaultEmailAddress.bind(settingsHelpers), dependents: ['labs']}));
+        fields.push(new CalculatedField({key: 'support_email_address', type: 'string', group: 'email', fn: settingsHelpers.getMembersSupportAddress.bind(settingsHelpers), dependents: ['labs', 'members_support_address']}));
+
         return fields;
     },
 

package/core/server/services/settings-helpers/SettingsHelpers.js

@@ -1,15 +1,18 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const {EmailAddressParser} = require('@tryghost/email-addresses');
+const logging = require('@tryghost/logging');
 
 const messages = {
     incorrectKeyType: 'type must be one of "direct" or "connect".'
 };
 
 class SettingsHelpers {
-    constructor({settingsCache, urlUtils, config}) {
+    constructor({settingsCache, urlUtils, config, labs}) {
         this.settingsCache = settingsCache;
         this.urlUtils = urlUtils;
         this.config = config;
+        this.labs = labs;
     }
 
     isMembersEnabled() {
@@ -83,7 +86,18 @@ class SettingsHelpers {
         return this.settingsCache.get('firstpromoter_id');
     }
 
+    /**
+     * @deprecated
+     * Please don't make up new email addresses: use the default email addresses
+     */
     getDefaultEmailDomain() {
+        if (this.#managedEmailEnabled()) {
+            const customSendingDomain = this.#managedSendingDomain();
+            if (customSendingDomain) {
+                return customSendingDomain;
+            }
+        }
+
         const url = this.urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
         const domain = (url && url[1]) || '';
         if (domain.startsWith('www.')) {
@@ -93,7 +107,15 @@ class SettingsHelpers {
     }
 
     getMembersSupportAddress() {
-        const supportAddress = this.settingsCache.get('members_support_address') || 'noreply';
+        let supportAddress = this.settingsCache.get('members_support_address');
+
+        if (!supportAddress && this.useNewEmailAddresses()) {
+            // In the new flow, we make a difference between an empty setting (= use default) and a 'noreply' setting (=use noreply @ domain)
+            // Also keep the name of the default email!
+            return EmailAddressParser.stringify(this.getDefaultEmail());
+        }
+
+        supportAddress = supportAddress || 'noreply';
 
         // Any fromAddress without domain uses site domain, like default setting `noreply`
         if (supportAddress.indexOf('@') < 0) {
@@ -102,13 +124,60 @@ class SettingsHelpers {
         return supportAddress;
     }
 
+    /**
+     * @deprecated Use getDefaultEmail().address (without name) or EmailAddressParser.stringify(this.getDefaultEmail()) (with name) instead
+     */
     getNoReplyAddress() {
+        return this.getDefaultEmailAddress();
+    }
+
+    getDefaultEmailAddress() {
+        return this.getDefaultEmail().address;
+    }
+
+    getDefaultEmail() {
+        if (this.useNewEmailAddresses()) {
+            // parse the email here and remove the sender name
+            // E.g. when set to "bar" <from@default.com>
+            const configAddress = this.config.get('mail:from');
+            const parsed = EmailAddressParser.parse(configAddress);
+            if (parsed) {
+                return parsed;
+            }
+
+            // For missing configs, we default to the old flow
+            logging.warn('Missing mail.from config, falling back to a generated email address. Please update your config file and set a valid from address');
+        }
+        return {
+            address: this.getLegacyNoReplyAddress()
+        };
+    }
+
+    /**
+     * @deprecated
+     * Please start using the new EmailAddressService
+     */
+    getLegacyNoReplyAddress() {
         return `noreply@${this.getDefaultEmailDomain()}`;
     }
 
     areDonationsEnabled() {
         return this.isStripeConnected();
     }
+
+    useNewEmailAddresses() {
+        return this.#managedEmailEnabled() || this.labs.isSet('newEmailAddresses');
+    }
+
+    // PRIVATE
+
+    #managedEmailEnabled() {
+        return !!this.config.get('hostSettings:managedEmail:enabled');
+    }
+
+    #managedSendingDomain() {
+        return this.config.get('hostSettings:managedEmail:sendingDomain');
+    }
 }
 
 module.exports = SettingsHelpers;

package/core/server/services/settings-helpers/index.js

@@ -2,5 +2,6 @@ const settingsCache = require('../../../shared/settings-cache');
 const urlUtils = require('../../../shared/url-utils');
 const config = require('../../../shared/config');
 const SettingsHelpers = require('./SettingsHelpers');
+const labs = require('../../../shared/labs');
 
-module.exports = new SettingsHelpers({settingsCache, urlUtils, config});
+module.exports = new SettingsHelpers({settingsCache, urlUtils, config, labs});

package/core/shared/config/overrides.json

@@ -124,7 +124,8 @@
             "signup-form-icon": {"width": 192, "height": 192},
             "email-header-image": {"width": 1200},
             "email-latest-posts-image": {"width": 200, "height": 200},
-            "email-latest-posts-image-mobile": {"width": 1200, "height": 960}
+            "email-latest-posts-image-mobile": {"width": 1200, "height": 960},
+            "social-image": {"width": 1200}
         }
     }
 }

package/core/shared/labs.js

@@ -46,7 +46,11 @@ const ALPHA_FEATURES = [
     'importMemberTier',
     'lexicalIndicators',
     'editorEmojiPicker',
-    'adminXOffers'
+    'adminXOffers',
+    'filterEmailDisabled',
+    'adminXDemo',
+    'tkReminders',
+    'newEmailAddresses'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/core/shared/sentry.js

@@ -2,6 +2,59 @@ const config = require('./config');
 const sentryConfig = config.get('sentry');
 const errors = require('@tryghost/errors');
 
+const beforeSend = function (event, hint) {
+    try {
+        const exception = hint.originalException;
+        const code = (exception && exception.code) ? exception.code : null;
+        const context = (exception && exception.context) ? exception.context : null;
+        const errorType = (exception && exception.errorType) ? exception.errorType : null;
+        const id = (exception && exception.id) ? exception.id : null;
+        const statusCode = (exception && exception.statusCode) ? exception.statusCode : null;
+        event.tags = event.tags || {};
+
+        if (errors.utils.isGhostError(exception)) {
+            // Unexpected errors have a generic error message, set it back to context if there is one
+            if (code === 'UNEXPECTED_ERROR' && context !== null) {
+                if (event.exception.values && event.exception.values.length > 0) {
+                    event.exception.values[0].type = context;
+                }
+            }
+
+            // This is a mysql2 error — add some additional context
+            if (exception.sql) {
+                const sql = exception.sql;
+                const errno = exception.errno ? exception.errno : null;
+                const sqlErrorCode = exception.sqlErrorCode ? exception.sqlErrorCode : null;
+                const sqlMessage = exception.sqlMessage ? exception.sqlMessage : null;
+                const sqlState = exception.sqlState ? exception.sqlState : null;
+                if (event.exception.values && event.exception.values.length > 0) {
+                    event.exception.values[0].type = `SQL Error ${errno}: ${sqlErrorCode}`;
+                    event.exception.values[0].value = sqlMessage;
+                    event.contexts = event.contexts || {};
+                    event.contexts.mysql = {
+                        errno: errno,
+                        code: sqlErrorCode,
+                        sql: sql,
+                        message: sqlMessage,
+                        state: sqlState
+                    };
+                }
+            }
+
+            // This is a Ghost Error, copy all our extra data to tags
+            event.tags.type = errorType;
+            event.tags.code = code;
+            event.tags.id = id;
+            event.tags.status_code = statusCode;
+        }
+        return event;
+    } catch (error) {
+        // If any errors occur in beforeSend, send the original event to Sentry
+        // Better to have some information than no information
+        return event;
+    }
+};
+
 if (sentryConfig && !sentryConfig.disabled) {
     const Sentry = require('@sentry/node');
     const version = require('@tryghost/version').full;
@@ -11,38 +64,7 @@ if (sentryConfig && !sentryConfig.disabled) {
         release: 'ghost@' + version,
         environment: environment,
         maxValueLength: 1000,
-        beforeSend: function (event, hint) {
-            const exception = hint.originalException;
-
-            event.tags = event.tags || {};
-
-            if (errors.utils.isGhostError(exception)) {
-                // Unexpected errors have a generic error message, set it back to context if there is one
-                if (exception.code === 'UNEXPECTED_ERROR' && exception.context !== null) {
-                    event.exception.values[0].type = exception.context;
-                }
-
-                // This is a mysql2 error — add some additional context
-                if (exception.sql) {
-                    event.exception.values[0].type = `SQL Error ${exception.errno}: ${exception.sqlErrorCode}`;
-                    event.exception.values[0].value = exception.sqlMessage;
-                    event.contexts.mysql = {
-                        errno: exception.errno,
-                        code: exception.sqlErrorCode,
-                        sql: exception.sql,
-                        message: exception.sqlMessage,
-                        state: exception.sqlState
-                    };
-                }
-
-                // This is a Ghost Error, copy all our extra data to tags
-                event.tags.type = exception.errorType;
-                event.tags.code = exception.code;
-                event.tags.id = exception.id;
-                event.tags.status_code = exception.statusCode;
-            }
-            return event;
-        }
+        beforeSend: beforeSend
     });
 
     module.exports = {
@@ -60,7 +82,8 @@ if (sentryConfig && !sentryConfig.disabled) {
                 return (error.statusCode === 500);
             }
         }),
-        captureException: Sentry.captureException
+        captureException: Sentry.captureException,
+        beforeSend: beforeSend
     };
 } else {
     const expressNoop = function (req, res, next) {