ghost 5.74.5 → 5.75.0

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.74%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a5d777fdf2%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2254a22f23e1%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22f76ec8c678%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.75%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%228fe2f5ae8e%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22b092dea02b%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2290920a9a6f%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-f6856af9fcd8ab6533f2a4339ececbc8.js"></script>
-<script src="assets/chunk.137.0297fba124bc9ba1bbc1.js"></script>
-<script src="assets/chunk.143.2a6618f48157c893c4e3.js"></script>
-    <script src="assets/ghost-7d0f91cd17901ac15ce0ae64a3091e2a.js"></script>
+<script src="assets/chunk.214.611b4f2521fabe34eea8.js"></script>
+<script src="assets/chunk.143.48ba4e0e6f8fd2e11002.js"></script>
+    <script src="assets/ghost-ceacd55503e4d34de4b4e7ba2309a6ab.js"></script>
 </body>
 </html>

package/core/frontend/meta/context-object.js

@@ -2,15 +2,6 @@ const settingsCache = require('../../shared/settings-cache');
 const _ = require('lodash');
 
 function getContextObject(data, context) {
-    /**
-     * If the data object does not contain the requested context, we return the fallback object.
-     */
-    const blog = {
-        cover_image: settingsCache.get('cover_image'),
-        twitter: settingsCache.get('twitter'),
-        facebook: settingsCache.get('facebook')
-    };
-
     let chosenContext;
 
     // @TODO: meta layer is very broken, it's really hard to understand what it's doing
@@ -31,9 +22,13 @@ function getContextObject(data, context) {
         chosenContext = data[context];
     }
 
-    // Super fallback.
+    // If the data object does not contain the requested context, we return the fallback object.
     if (!chosenContext) {
-        chosenContext = blog;
+        chosenContext = {
+            cover_image: settingsCache.get('cover_image'),
+            twitter: settingsCache.get('twitter'),
+            facebook: settingsCache.get('facebook')
+        };
     }
 
     return chosenContext;

package/core/server/data/migrations/versions/5.75/2023-11-27-15-55-add-members-newsletters-index.js

@@ -0,0 +1,26 @@
+const logging = require('@tryghost/logging');
+const {createNonTransactionalMigration} = require('../../utils');
+const {addIndex, dropIndex} = require('../../../schema/commands');
+
+module.exports = createNonTransactionalMigration(
+    async function up(knex) {
+        await addIndex('members_newsletters', ['newsletter_id', 'member_id'], knex);
+    },
+    async function down(knex) {
+        try {
+            await dropIndex('members_newsletters', ['newsletter_id', 'member_id'], knex);
+        } catch (err) {
+            if (err.code === 'ER_DROP_INDEX_FK') {
+                logging.error({
+                    message: 'Error dropping index over members_newsletters(newsletter_id, member_id), re-adding index for newsletter_id'
+                });
+
+                await addIndex('members_newsletters', ['newsletter_id'], knex);
+                await dropIndex('members_newsletters', ['newsletter_id', 'member_id'], knex);
+                return;
+            }
+
+            throw err;
+        }
+    }
+);

package/core/server/data/schema/schema.js

@@ -936,7 +936,10 @@ module.exports = {
     members_newsletters: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
-        newsletter_id: {type: 'string', maxlength: 24, nullable: false, references: 'newsletters.id', cascadeDelete: true}
+        newsletter_id: {type: 'string', maxlength: 24, nullable: false, references: 'newsletters.id', cascadeDelete: true},
+        '@@INDEXES@@': [
+            ['newsletter_id', 'member_id']
+        ]
     },
     comments: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},

package/core/server/models/newsletter.js

@@ -1,7 +1,6 @@
 const ghostBookshelf = require('./base');
 const ObjectID = require('bson-objectid').default;
 const uuid = require('uuid');
-const DatabaseInfo = require('@tryghost/database-info');
 const urlUtils = require('../../shared/url-utils');
 
 const Newsletter = ghostBookshelf.Model.extend({
@@ -156,17 +155,11 @@ const Newsletter = ghostBookshelf.Model.extend({
             active_members(modelOrCollection) {
                 modelOrCollection.query('columns', 'newsletters.*', (qb) => {
                     qb.count('members_newsletters.id')
+                        .from('members_newsletters')
                         .join('members', 'members.id', 'members_newsletters.member_id')
                         .whereRaw('members_newsletters.newsletter_id = newsletters.id')
                         .andWhere('members.email_disabled', false)
                         .as('count__active_members');
-
-                    // https://github.com/TryGhost/Product/issues/4181
-                    if (DatabaseInfo.isMySQL(ghostBookshelf.knex)) {
-                        qb.fromRaw('members_newsletters force index (members_newsletters_newsletter_id_foreign)');
-                    } else {
-                        qb.from('members_newsletters');
-                    }
                 });
             }
         };

package/core/server/services/newsletters/NewslettersService.js

@@ -159,8 +159,7 @@ class NewslettersService {
             throw error;
         }
 
-        // Load relations correctly
-        newsletter = await this.NewsletterModel.findOne({id: newsletter.id}, {...options, require: true});
+        let optedInMemberCount = undefined;
 
         // subscribe existing members if opt_in_existing=true
         if (options.opt_in_existing) {
@@ -169,8 +168,7 @@ class NewslettersService {
             // subscribe members that have an existing subscription to an active newsletter
             const memberIds = await this.MemberModel.fetchAllSubscribed(_.pick(options, 'transacting'));
 
-            newsletter.meta = newsletter.meta || {};
-            newsletter.meta.opted_in_member_count = memberIds.length;
+            optedInMemberCount = memberIds.length;
 
             if (memberIds.length) {
                 debug(`Found ${memberIds.length} members to subscribe`);
@@ -179,6 +177,14 @@ class NewslettersService {
             }
         }
 
+        // Load relations correctly
+        newsletter = await this.NewsletterModel.findOne({id: newsletter.id}, {...options, require: true});
+
+        if (optedInMemberCount !== undefined) {
+            newsletter.meta = newsletter.meta || {};
+            newsletter.meta.opted_in_member_count = optedInMemberCount;
+        }
+
         // send any verification emails and respond with the appropriate meta added
         return this.respondWithEmailVerification(newsletter, emailsToVerify);
     }
@@ -237,7 +243,12 @@ class NewslettersService {
         const attrs = {};
         attrs[property] = value;
 
-        return this.NewsletterModel.edit(attrs, {id});
+        const updatedNewsletter = await this.NewsletterModel.edit(attrs, {id});
+
+        updatedNewsletter.meta = updatedNewsletter.meta || {};
+        updatedNewsletter.meta.email_verified = property;
+
+        return updatedNewsletter;
     }
 
     /* Email verification Internals */
@@ -330,11 +341,11 @@ class NewslettersService {
             fromEmail = `no-reply@${toDomain}`;
         }
 
-        if (this.emailAddressService.useNewEmailAddresses) {
+        if (this.emailAddressService.service.useNewEmailAddresses) {
             // Gone with the old logic: always use the default email address here
             // We don't need to validate the FROM address, only the to address
             // Also because we are not only validating FROM addresses, but also possible REPLY-TO addresses, which we won't send FROM
-            fromEmail = this.emailAddressService.defaultFromAddress;
+            fromEmail = this.emailAddressService.service.defaultFromAddress;
         }
 
         const {ghostMailer} = this;

package/core/server/services/settings/SettingsBREADService.js

@@ -1,6 +1,6 @@
 const _ = require('lodash');
 const tpl = require('@tryghost/tpl');
-const {NotFoundError, NoPermissionError, BadRequestError, IncorrectUsageError} = require('@tryghost/errors');
+const {NotFoundError, NoPermissionError, BadRequestError, IncorrectUsageError, ValidationError} = require('@tryghost/errors');
 const {obfuscatedSetting, isSecretSetting, hideValueIfSecret} = require('./settings-utils');
 const logging = require('@tryghost/logging');
 const MagicLink = require('@tryghost/magic-link');
@@ -9,7 +9,8 @@ const verifyEmailTemplate = require('./emails/verify-email');
 const EMAIL_KEYS = ['members_support_address'];
 const messages = {
     problemFindingSetting: 'Problem finding setting: {key}',
-    accessCoreSettingFromExtReq: 'Attempted to access core setting from external request'
+    accessCoreSettingFromExtReq: 'Attempted to access core setting from external request',
+    invalidEmail: 'Invalid email address'
 };
 
 class SettingsBREADService {
@@ -22,11 +23,13 @@ class SettingsBREADService {
      * @param {Object} options.singleUseTokenProvider
      * @param {Object} options.urlUtils
      * @param {Object} options.labsService - labs service instance
+     * @param {{service: Object}} options.emailAddressService
      */
-    constructor({SettingsModel, settingsCache, labsService, mail, singleUseTokenProvider, urlUtils}) {
+    constructor({SettingsModel, settingsCache, labsService, mail, singleUseTokenProvider, urlUtils, emailAddressService}) {
         this.SettingsModel = SettingsModel;
         this.settingsCache = settingsCache;
         this.labs = labsService;
+        this.emailAddressService = emailAddressService;
 
         /* email verification setup */
 
@@ -323,7 +326,18 @@ class SettingsBREADService {
                 const hasChanged = getSetting(setting).value !== email;
 
                 if (await this.requiresEmailVerification({email, hasChanged})) {
-                    emailsToVerify.push({email, key});
+                    const validated = this.emailAddressService.service.validate(email, 'replyTo');
+                    if (!validated.allowed) {
+                        throw new ValidationError({
+                            message: messages.invalidEmail
+                        });
+                    }
+
+                    if (validated.verificationEmailRequired) {
+                        emailsToVerify.push({email, key});
+                    } else {
+                        filteredSettings.push(setting);
+                    }
                 } else {
                     filteredSettings.push(setting);
                 }
@@ -375,6 +389,13 @@ class SettingsBREADService {
             fromEmail = `no-reply@${toDomain}`;
         }
 
+        if (this.emailAddressService.service.useNewEmailAddresses) {
+            // Gone with the old logic: always use the default email address here
+            // We don't need to validate the FROM address, only the to address
+            // Also because we are not only validating FROM addresses, but also possible REPLY-TO addresses, which we won't send FROM
+            fromEmail = this.emailAddressService.service.defaultFromAddress;
+        }
+
         const {ghostMailer} = this;
 
         this.magicLinkService.transporter = {

package/core/server/services/settings/settings-service.js

@@ -15,6 +15,7 @@ const urlUtils = require('../../../shared/url-utils');
 
 const ObjectId = require('bson-objectid').default;
 const settingsHelpers = require('../settings-helpers');
+const emailAddressService = require('../email-address');
 
 const MAGIC_LINK_TOKEN_VALIDITY = 24 * 60 * 60 * 1000;
 const MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE = 10 * 60 * 1000;
@@ -35,7 +36,8 @@ const getSettingsBREADServiceInstance = () => {
             validityPeriodAfterUsage: MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE,
             maxUsageCount: MAGIC_LINK_TOKEN_MAX_USAGE_COUNT
         }),
-        urlUtils
+        urlUtils,
+        emailAddressService: emailAddressService
     });
 };
 

package/core/shared/settings-cache/public.js

@@ -42,5 +42,7 @@ module.exports = {
     portal_button: 'portal_button',
     comments_enabled: 'comments_enabled',
     recommendations_enabled: 'recommendations_enabled',
-    outbound_link_tagging: 'outbound_link_tagging'
+    outbound_link_tagging: 'outbound_link_tagging',
+    default_email_address: 'default_email_address',
+    support_email_address: 'support_email_address'
 };