ghost 5.75.2 → 5.76.0

package/core/built/admin/assets/{vendor-f6856af9fcd8ab6533f2a4339ececbc8.js → vendor-6b83da0c6e6fede335947219c59e1543.js}

@@ -9312,7 +9312,7 @@ e.default={content:'<path d="M1.061 2.56v6.257a3 3 0 00.878 2.121L13.5 22.5a1.5
 Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0
 e.default={content:'<path clip-rule="evenodd" d="M8 2.706a1 1 0 011-1h15a1 1 0 01.707.293l21 21a1 1 0 01-1.414 1.414L23.586 3.706H9a1 1 0 01-1-1z"/><path clip-rule="evenodd" d="M3.172 8.878A4 4 0 016 7.706h12.258a4 4 0 012.827 1.17l18.328 18.327a4.001 4.001 0 01-1.424 6.573l-7.213 2.707-2.71 7.21a4.002 4.002 0 01-6.573 1.424L3.171 26.791A4 4 0 012 23.962V11.706a4 4 0 011.172-2.828zM6 9.706a2 2 0 00-2 2v12.256a2.003 2.003 0 00.585 1.415l18.322 18.326a2 2 0 003.287-.712l2.87-7.637a1 1 0 01.585-.584l7.638-2.866a2 2 0 00.712-3.287L19.67 10.291a2 2 0 00-1.413-.585H6z"/><path d="M12.25 15.956a2 2 0 100 4 2 2 0 000-4"/>',attrs:{fill:"none",viewBox:"0 0 48 48"}}})),define("ember-svg-jar/inlined/thumbs-down",["exports"],(function(e){"use strict"
 Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0
-e.default={content:'<path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M2 14.429h3.444a1.906 1.906 0 011.543.794l4.617 7.095a1.622 1.622 0 001.992.537 1.597 1.597 0 00.894-1.87l-.833-3.142a1.867 1.867 0 01.993-2.164 1.91 1.91 0 01.833-.193h4.63a1.882 1.882 0 001.806-2.426v-.011l-1.8-6.008v-.016c-.733-2.36-1.992-3.97-4.469-3.97-5.934 0-5.595-.684-12.524 2.818-.377.188-.752.379-1.126.572V16.5"/>',attrs:{fill:"none",viewBox:"0 0 24 24"}}})),define("ember-svg-jar/inlined/thumbs-up",["exports"],(function(e){"use strict"
+e.default={content:'<path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M22 14.429h-3.445a1.905 1.905 0 00-1.543.794l-4.617 7.095a1.622 1.622 0 01-2.783-.233 1.597 1.597 0 01-.103-1.1l.833-3.142a1.867 1.867 0 00-.993-2.164 1.911 1.911 0 00-.833-.193h-4.63A1.881 1.881 0 012.08 13.06v-.011l1.8-6.008v-.016c.733-2.36 1.992-3.97 4.47-3.97 5.933 0 5.594-.684 12.523 2.818.377.188.752.379 1.126.572V16.5"/>',attrs:{fill:"none",viewBox:"0 0 24 24"}}})),define("ember-svg-jar/inlined/thumbs-up",["exports"],(function(e){"use strict"
 Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0
 e.default={content:'<path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M2.001 10.571h3.443a1.907 1.907 0 001.543-.794l4.618-7.095a1.62 1.62 0 011.992-.537 1.598 1.598 0 01.892 1.871l-.832 3.14a1.867 1.867 0 00.993 2.165c.259.127.544.193.832.194h4.63a1.883 1.883 0 011.807 2.426v.011l-1.8 6.008v.015c-.733 2.36-1.993 3.97-4.47 3.97-5.933 0-5.593.684-12.524-2.818-.375-.188-.75-.38-1.125-.57v-9.89"/>',attrs:{fill:"none",viewBox:"0 0 24 24"}}})),define("ember-svg-jar/inlined/trash",["exports"],(function(e){"use strict"
 Object.defineProperty(e,"__esModule",{value:!0}),e.default=void 0
@@ -9914,4 +9914,4 @@ e.default=class{constructor(e){if(this._data=new t.default,e)for(let t=0;t<e.len
 return this}get(e){let t=this._data[e]
 return t===r.UNDEFINED_KEY?void 0:t}set(e,t){return this._data[e]=t,this}delete(e){return this._data[e]=r.UNDEFINED_KEY,!0}}}))
 
-//# sourceMappingURL=vendor-ffd7d22c69e5aabc538c4d6a09afe243.map
+//# sourceMappingURL=vendor-0462eb4577b6a717a7cadbacd0d3b276.map

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.75%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%226db67756e6%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22b092dea02b%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2290920a9a6f%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.76%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a27d96c707%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22ace375b522%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22bc3086cb53%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-0456ea5c74bd1b27239c11706d1acae9.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-0704a125141af505d40c5f71e84f33ab.css" title="light">
 
     
 </head>
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-f6856af9fcd8ab6533f2a4339ececbc8.js"></script>
-<script src="assets/chunk.214.611b4f2521fabe34eea8.js"></script>
-<script src="assets/chunk.143.3bd2e0f4f76f9b3424bd.js"></script>
-    <script src="assets/ghost-2fe51d0831dd1694a4e88abd5f38e2fb.js"></script>
+    <script src="assets/vendor-6b83da0c6e6fede335947219c59e1543.js"></script>
+<script src="assets/chunk.664.0bd9e83a6b03130112ae.js"></script>
+<script src="assets/chunk.143.f5d2319ca15f1acb9a3e.js"></script>
+    <script src="assets/ghost-971615b195b524bf97f678a350865195.js"></script>
 </body>
 </html>

package/core/cli/generate-data.js

@@ -1,15 +1,20 @@
+/* eslint-disable ghost/filenames/match-exported-class */
 const Command = require('./command');
 const DataGenerator = require('@tryghost/data-generator');
 const config = require('../shared/config');
 
+const schemaTables = require('../server/data/schema').tables;
+
 module.exports = class DataGeneratorCommand extends Command {
     setup() {
         this.help('Generates random data to populate the database for development & testing');
         this.argument('--base-data-pack', {type: 'string', defaultValue: '', desc: 'Base data pack file location, imported instead of random content'});
-        this.argument('--quantity', {type: 'number', desc: 'When importing a single table, the quantity to import'});
         this.argument('--clear-database', {type: 'boolean', defaultValue: false, desc: 'Clear all entries in the database before importing'});
         this.argument('--tables', {type: 'string', desc: 'Only import the specified list of tables, where quantities can be specified by appending a colon followed by the quantity for each table. Example: --tables=members:1000,posts,tags,members_login_events'});
+        this.argument('--quantities', {type: 'string', desc: 'Allows you to specify different default quantities for specific tables without affecting the tables that are generated. Example: --quantities=members:1000'});
         this.argument('--with-default', {type: 'boolean', defaultValue: false, desc: 'Include default tables as well as those specified (simply override quantities)'});
+        this.argument('--print-dependencies', {type: 'boolean', defaultValue: false, desc: 'Prints the dependency tree for the data generator and exits'});
+        this.argument('--seed', {type: 'number', defaultValue: '', desc: 'Use a seed to reliably generate the same data on multiple runs (timestamps will still change a little bit to remain up to date)'});
     }
 
     initializeContext(context) {
@@ -29,6 +34,8 @@ module.exports = class DataGeneratorCommand extends Command {
     }
 
     async handle(argv = {}) {
+        // If we can't stream, throw an error while creating the connection
+        process.env.REQUIRE_INFILE_STREAM = '1';
         const knex = require('../server/data/db/connection');
 
         const tables = (argv.tables ? argv.tables.split(',') : []).map(table => ({
@@ -36,6 +43,24 @@ module.exports = class DataGeneratorCommand extends Command {
             quantity: parseInt(table.split(':')[1]) || undefined
         }));
 
+        /**
+         * @type {Record<string, number>}
+         */
+        const quantities = {};
+
+        if (argv.quantities) {
+            for (const quantity of argv.quantities.split(',')) {
+                const [table, amount] = quantity.split(':');
+
+                if (amount === undefined || !isFinite(parseInt(amount))) {
+                    this.fatal(`Missing quantity for table ${table}`);
+                    return;
+                }
+
+                quantities[table] = parseInt(amount);
+            }
+        }
+
         const dataGenerator = new DataGenerator({
             baseDataPack: argv['base-data-pack'],
             knex,
@@ -51,7 +76,11 @@ module.exports = class DataGeneratorCommand extends Command {
             baseUrl: config.getSiteUrl(),
             clearDatabase: argv['clear-database'],
             tables,
-            withDefault: argv['with-default']
+            schemaTables,
+            withDefault: argv['with-default'],
+            printDependencies: argv['print-dependencies'],
+            quantities,
+            seed: argv.seed || undefined
         });
         try {
             await dataGenerator.importData();

package/core/frontend/apps/private-blogging/lib/middleware.js

@@ -55,8 +55,7 @@ const privateBlogging = {
             name: 'ghost-private',
             maxAge: constants.ONE_MONTH_MS,
             signed: false,
-            sameSite: urlUtils.isSSL(config.get('url')) ? 'none' : 'lax',
-            secure: urlUtils.isSSL(config.get('url'))
+            sameSite: 'none'
         })(req, res, next);
     },
 

package/core/frontend/helpers/excerpt.js

@@ -22,6 +22,8 @@ module.exports = function excerpt(options) {
     } else {
         excerptText = '';
     }
+    
+    excerptText = _.escape(excerptText);
 
     truncateOptions = _.reduce(truncateOptions, (_truncateOptions, value, key) => {
         if (['words', 'characters'].includes(key)) {

package/core/frontend/public/robots.txt

@@ -4,3 +4,4 @@ Disallow: /ghost/
 Disallow: /p/
 Disallow: /email/
 Disallow: /r/
+Disallow: /webmentions/receive/

package/core/server/api/endpoints/utils/serializers/input/settings.js

@@ -38,6 +38,7 @@ const EDITABLE_SETTINGS = [
     'portal_name',
     'portal_button',
     'portal_plans',
+    'portal_default_plan',
     'portal_button_style',
     'firstpromoter',
     'firstpromoter_id',

package/core/server/data/db/connection.js

@@ -1,9 +1,11 @@
 const _ = require('lodash');
 const knex = require('knex');
 const os = require('os');
+const fs = require('fs');
 
 const logging = require('@tryghost/logging');
 const config = require('../../../shared/config');
+const errors = require('@tryghost/errors');
 let knexInstance;
 
 // @TODO:
@@ -45,6 +47,14 @@ function configure(dbConfig) {
         dbConfig.connection.timezone = 'Z';
         dbConfig.connection.charset = 'utf8mb4';
         dbConfig.connection.decimalNumbers = true;
+
+        if (process.env.REQUIRE_INFILE_STREAM) {
+            if (process.env.NODE_ENV === 'development' || process.env.ALLOW_INFILE_STREAM) {
+                dbConfig.connection.infileStreamFactory = path => fs.createReadStream(path);
+            } else {
+                throw new errors.InternalServerError({message: 'MySQL infile streaming is required to run the current process, but is not allowed. Run the script in development mode or set ALLOW_INFILE_STREAM=1.'});
+            }
+        }
     }
 
     return dbConfig;

package/core/server/data/migrations/versions/5.76/2023-12-05-11-00-add-portal-default-plan-setting.js

@@ -0,0 +1,8 @@
+const {addSetting} = require('../../utils');
+
+module.exports = addSetting({
+    key: 'portal_default_plan',
+    value: 'yearly',
+    type: 'string',
+    group: 'portal'
+});

package/core/server/data/schema/default-settings/default-settings.json

@@ -330,6 +330,14 @@
             "defaultValue": "[\"free\"]",
             "type": "array"
         },
+        "portal_default_plan": {
+            "defaultValue": "yearly",
+            "validations": {
+                "isEmpty": false,
+                "isIn": [["yearly", "monthly"]]
+            },
+            "type": "string"
+        },
         "portal_products": {
             "defaultValue": "[]",
             "type": "array"

package/core/server/services/public-config/site.js

@@ -19,7 +19,13 @@ module.exports = function getSiteProperties() {
 
     if (config.get('client_sentry') && !config.get('client_sentry').disabled) {
         siteProperties.sentry_dsn = config.get('client_sentry').dsn;
-        siteProperties.sentry_env = config.get('env');
+
+        let environment = config.get('PRO_ENV');
+        if (!environment) {
+            environment = config.get('env');
+        }
+
+        siteProperties.sentry_env = environment;
     }
 
     return siteProperties;

package/core/shared/SentryKnexTracingIntegration.js

@@ -0,0 +1,67 @@
+/**
+ * @typedef {import('knex').Knex.Client} KnexClient
+ */
+
+/**
+ * @typedef {import('@sentry/types').Integration} SentryIntegration
+ */
+
+/**
+ * Sentry Knex tracing integration
+ *
+ * @implements {SentryIntegration}
+ */
+class SentryKnexTracingIntegration {
+    static id = 'Knex';
+
+    name = SentryKnexTracingIntegration.id;
+
+    /** @type {KnexClient} */
+    #knex;
+
+    /** @type {Map} */
+    #spanCache = new Map();
+
+    /**
+     * @param {KnexClient} knex
+     */
+    constructor(knex) {
+        this.#knex = knex;
+    }
+
+    /**
+     * @param {Function} addGlobalEventProcessor
+     * @param {Function} getCurrentHub
+     */
+    setupOnce(addGlobalEventProcessor, getCurrentHub) {
+        this.#knex.on('query', (query) => {
+            const scope = getCurrentHub().getScope();
+            const parentSpan = scope?.getSpan();
+
+            const span = parentSpan?.startChild({
+                op: 'db.query',
+                description: query.sql
+            });
+
+            if (span) {
+                this.#spanCache.set(query.__knexQueryUid, span);
+            }
+        });
+
+        const handleQueryExecuted = (err, query) => {
+            const queryId = query.__knexQueryUid;
+            const span = this.#spanCache.get(queryId);
+
+            if (span) {
+                span.finish();
+
+                this.#spanCache.delete(queryId);
+            }
+        };
+
+        this.#knex.on('query-response', handleQueryExecuted);
+        this.#knex.on('query-error', handleQueryExecuted);
+    }
+}
+
+module.exports = SentryKnexTracingIntegration;

package/core/shared/config/defaults.json

@@ -182,7 +182,7 @@
     },
     "portal": {
         "url": "https://cdn.jsdelivr.net/ghost/portal@~{version}/umd/portal.min.js",
-        "version": "2.36"
+        "version": "2.37"
     },
     "sodoSearch": {
         "url": "https://cdn.jsdelivr.net/ghost/sodo-search@~{version}/umd/sodo-search.min.js",

package/core/shared/labs.js

@@ -21,7 +21,6 @@ const GA_FEATURES = [
     'announcementBar',
     'signupForm',
     'recommendations',
-    'editorEmojiPicker',
     'listUnsubscribeHeader',
     'filterEmailDisabled'
 ];
@@ -45,12 +44,11 @@ const ALPHA_FEATURES = [
     'tipsAndDonations',
     'importMemberTier',
     'lexicalIndicators',
-    'editorEmojiPicker',
     'adminXOffers',
     'filterEmailDisabled',
     'adminXDemo',
-    'tkReminders',
-    'newEmailAddresses'
+    'newEmailAddresses',
+    'portalImprovements'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/core/shared/sentry.js

@@ -1,4 +1,6 @@
 const config = require('./config');
+const logging = require('@tryghost/logging');
+const SentryKnexTracingIntegration = require('./SentryKnexTracingIntegration');
 const sentryConfig = config.get('sentry');
 const errors = require('@tryghost/errors');
 
@@ -58,14 +60,43 @@ const beforeSend = function (event, hint) {
 if (sentryConfig && !sentryConfig.disabled) {
     const Sentry = require('@sentry/node');
     const version = require('@tryghost/version').full;
-    const environment = config.get('env');
-    Sentry.init({
+
+    let environment = config.get('PRO_ENV');
+    if (!environment) {
+        environment = config.get('env');
+    }
+
+    const sentryInitConfig = {
         dsn: sentryConfig.dsn,
         release: 'ghost@' + version,
         environment: environment,
         maxValueLength: 1000,
-        beforeSend: beforeSend
-    });
+        integrations: [],
+        beforeSend
+    };
+
+    // Enable tracing if sentry.tracing.enabled is true
+    if (sentryConfig.tracing?.enabled === true) {
+        sentryInitConfig.integrations.push(new Sentry.Integrations.Http({tracing: true}));
+        sentryInitConfig.tracesSampleRate = parseFloat(sentryConfig.tracing.sampleRate) || 0.0;
+        // Enable profiling, if configured, only if tracing is also configured
+        if (sentryConfig.profiling?.enabled === true) {
+            // Import Sentry's profiling integration if available
+            let ProfilingIntegration;
+            try {
+                ({ProfilingIntegration} = require('@sentry/profiling-node'));
+            } catch (err) {
+                logging.warn('Sentry Profiling Integration not available');
+                ProfilingIntegration = null;
+            }
+
+            if (ProfilingIntegration) {
+                sentryInitConfig.integrations.push(new ProfilingIntegration());
+                sentryInitConfig.profilesSampleRate = parseFloat(sentryConfig.profiling.sampleRate) || 0.0;
+            }
+        }
+    }
+    Sentry.init(sentryInitConfig);
 
     module.exports = {
         requestHandler: Sentry.Handlers.requestHandler(),
@@ -82,8 +113,17 @@ if (sentryConfig && !sentryConfig.disabled) {
                 return (error.statusCode === 500);
             }
         }),
+        tracingHandler: Sentry.Handlers.tracingHandler(),
         captureException: Sentry.captureException,
-        beforeSend: beforeSend
+        captureMessage: Sentry.captureMessage,
+        beforeSend: beforeSend,
+        initQueryTracing: (knex) => {
+            if (sentryConfig.tracing?.enabled === true) {
+                const integration = new SentryKnexTracingIntegration(knex);
+
+                Sentry.addIntegration(integration);
+            }
+        }
     };
 } else {
     const expressNoop = function (req, res, next) {
@@ -95,6 +135,8 @@ if (sentryConfig && !sentryConfig.disabled) {
     module.exports = {
         requestHandler: expressNoop,
         errorHandler: expressNoop,
-        captureException: noop
+        tracingHandler: expressNoop,
+        captureException: noop,
+        initQueryTracing: noop
     };
 }

package/core/shared/settings-cache/public.js

@@ -38,6 +38,7 @@ module.exports = {
     portal_signup_terms_html: 'portal_signup_terms_html',
     portal_signup_checkbox_required: 'portal_signup_checkbox_required',
     portal_plans: 'portal_plans',
+    portal_default_plan: 'portal_default_plan',
     portal_name: 'portal_name',
     portal_button: 'portal_button',
     comments_enabled: 'comments_enabled',