ghost 5.76.1 → 5.77.0

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.76%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22c5245f84d0%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22ace375b522%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%222814ff3e02%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.77%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a9a58f16a8%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2233d2c60ad0%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22d07813452e%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-6b83da0c6e6fede335947219c59e1543.js"></script>
-<script src="assets/chunk.664.0bd9e83a6b03130112ae.js"></script>
-<script src="assets/chunk.143.16780ac5d51ee6a46eb2.js"></script>
-    <script src="assets/ghost-971615b195b524bf97f678a350865195.js"></script>
+<script src="assets/chunk.664.99d0951b803d7ec00d8b.js"></script>
+<script src="assets/chunk.143.16228699a88898175515.js"></script>
+    <script src="assets/ghost-90accaf45b85c7bc55ca781472d27e8e.js"></script>
 </body>
 </html>

package/core/frontend/helpers/excerpt.js

@@ -22,7 +22,7 @@ module.exports = function excerpt(options) {
     } else {
         excerptText = '';
     }
-    
+
     excerptText = _.escape(excerptText);
 
     truncateOptions = _.reduce(truncateOptions, (_truncateOptions, value, key) => {
@@ -32,8 +32,9 @@ module.exports = function excerpt(options) {
         return _truncateOptions;
     }, {});
 
+    // For custom excerpts, make sure we truncate them only based on length
     if (!_.isEmpty(this.custom_excerpt)) {
-        truncateOptions.characters = this.custom_excerpt.length;
+        truncateOptions.characters = excerptText.length; // length is expanded by use of escaped characters
         if (truncateOptions.words) {
             delete truncateOptions.words;
         }

package/core/frontend/helpers/get.js

@@ -7,6 +7,7 @@ const {hbs} = require('../services/handlebars');
 const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
+const Sentry = require('@sentry/node');
 
 const _ = require('lodash');
 const jsonpath = require('jsonpath');
@@ -206,32 +207,47 @@ module.exports = async function get(resource, options) {
 
     // Parse the options we're going to pass to the API
     apiOptions = parseOptions(ghostGlobals, this, apiOptions);
+    let apiOptionsString = Object.entries(apiOptions)
+        .map(([key, value]) => ` ${key}="${value}"`)
+        .join('');
     apiOptions.context = {member: data.member};
-
     try {
-        const response = await makeAPICall(resource, controllerName, action, apiOptions);
-
-        // prepare data properties for use with handlebars
-        if (response[resource] && response[resource].length) {
-            response[resource].forEach(prepareContextResource);
-        }
-
-        // used for logging details of slow requests
-        returnedRowsCount = response[resource] && response[resource].length;
-
-        // block params allows the theme developer to name the data using something like
-        // `{{#get "posts" as |result pageInfo|}}`
-        const blockParams = [response[resource]];
-        if (response.meta && response.meta.pagination) {
-            response.pagination = response.meta.pagination;
-            blockParams.push(response.meta.pagination);
-        }
+        const spanName = `{{#get "${resource}"${apiOptionsString}}} ${data.member ? 'member' : 'public'}`;
+        const result = await Sentry.startSpan({
+            op: 'frontend.helpers.get', 
+            name: spanName,
+            tags: {
+                resource,
+                ...apiOptions,
+                context: data.member ? 'member' : 'public'
+            }
+        }, async (span) => {
+            const response = await makeAPICall(resource, controllerName, action, apiOptions);
 
-        // Call the main template function
-        return options.fn(response, {
-            data: data,
-            blockParams: blockParams
+            // prepare data properties for use with handlebars
+            if (response[resource] && response[resource].length) {
+                response[resource].forEach(prepareContextResource);
+            }
+    
+            // used for logging details of slow requests
+            returnedRowsCount = response[resource] && response[resource].length;
+            span?.setTag('returnedRows', returnedRowsCount);
+    
+            // block params allows the theme developer to name the data using something like
+            // `{{#get "posts" as |result pageInfo|}}`
+            const blockParams = [response[resource]];
+            if (response.meta && response.meta.pagination) {
+                response.pagination = response.meta.pagination;
+                blockParams.push(response.meta.pagination);
+            }
+    
+            // Call the main template function
+            return options.fn(response, {
+                data: data,
+                blockParams: blockParams
+            });
         });
+        return result;
     } catch (error) {
         logging.error(error);
         data.error = error.message;

package/core/frontend/services/routing/controllers/previews.js

@@ -49,12 +49,13 @@ module.exports = function previewController(req, res, next) {
                 return next();
             }
 
+            // published content should only resolve to /:slug - /p/:uuid is for drafts only in lieu of an actual preview api
             if (post.status === 'published') {
                 return urlUtils.redirect301(res, routerManager.getUrlByResourceId(post.id, {withSubdirectory: true}));
             }
 
-            // published content should only resolve to /:slug or /email/:uuid - /p/:uuid is for drafts only in lieu of an actual preview api
-            if (post.status !== 'published' && post.email_only === true) {
+            // once an email-only post has been sent it shouldn't be available via /p/ to avoid leaking members-only content
+            if (post.status === 'sent') {
                 return urlUtils.redirect301(res, urlUtils.urlJoin('/email', post.uuid, '/'));
             }
 

package/core/server/api/endpoints/newsletters.js

@@ -1,4 +1,3 @@
-const models = require('../../models');
 const allowedIncludes = ['count.posts', 'count.members', 'count.active_members'];
 
 const newslettersService = require('../../services/newsletters');
@@ -27,7 +26,7 @@ module.exports = {
         },
         permissions: true,
         query(frame) {
-            return models.Newsletter.findPage(frame.options);
+            return newslettersService.browse(frame.options);
         }
     },
 

package/core/server/api/endpoints/stats.js

@@ -10,8 +10,14 @@ module.exports = {
             docName: 'members',
             method: 'browse'
         },
+        cache: statsService.cache,
+        generateCacheKeyData() {
+            return {
+                method: 'memberCountHistory'
+            };
+        },
         async query() {
-            return await statsService.getMemberCountHistory();
+            return await statsService.api.getMemberCountHistory();
         }
     },
     mrr: {
@@ -22,8 +28,14 @@ module.exports = {
             docName: 'members',
             method: 'browse'
         },
+        cache: statsService.cache,
+        generateCacheKeyData() {
+            return {
+                method: 'mrr'
+            };
+        },
         async query() {
-            return await statsService.getMRRHistory();
+            return await statsService.api.getMRRHistory();
         }
     },
     subscriptions: {
@@ -34,8 +46,15 @@ module.exports = {
             docName: 'members',
             method: 'browse'
         },
+        cache: statsService.cache,
+        generateCacheKeyData() {
+            return {
+                method: 'subscriptions'
+
+            };
+        },
         async query() {
-            return await statsService.getSubscriptionCountHistory();
+            return await statsService.api.getSubscriptionCountHistory();
         }
     },
     postReferrers: {
@@ -49,8 +68,18 @@ module.exports = {
             docName: 'posts',
             method: 'browse'
         },
+        cache: statsService.cache,
+        generateCacheKeyData(frame) {
+            return {
+                method: 'postReferrers',
+                data: {
+                    id: frame.data.id
+                }
+
+            };
+        },
         async query(frame) {
-            return await statsService.getPostReferrers(frame.data.id);
+            return await statsService.api.getPostReferrers(frame.data.id);
         }
     },
     referrersHistory: {
@@ -64,8 +93,14 @@ module.exports = {
             docName: 'posts',
             method: 'browse'
         },
+        cache: statsService.cache,
+        generateCacheKeyData() {
+            return {
+                method: 'referrersHistory'
+            };
+        },
         async query() {
-            return await statsService.getReferrersHistory();
+            return await statsService.api.getReferrersHistory();
         }
     }
 };

package/core/server/api/endpoints/utils/serializers/output/mappers/newsletters.js

@@ -1,4 +1,5 @@
 const utils = require('../../../index');
+const emailAddressService = require('../../../../../../services/email-address');
 
 module.exports = (model, frame) => {
     const jsonModel = model.toJSON(frame.options);
@@ -19,6 +20,17 @@ module.exports = (model, frame) => {
         };
 
         return serialized;
+    } else {
+        if (jsonModel.sender_email && jsonModel.sender_reply_to === 'newsletter') {
+            // If sender_email is not allowed, we'll return it as the sender_reply_to instead, so we display the current situation correctly in the frontend
+            // If one of the properties was changed, we need to reset sender_email in case it was not changed but is invalid in the database
+            // which can happen after a config change (= auto correcting behaviour)
+            const validated = emailAddressService.service.validate(jsonModel.sender_email, 'from');
+            if (!validated.allowed) {
+                jsonModel.sender_reply_to = jsonModel.sender_email;
+                jsonModel.sender_email = null;
+            }
+        }
     }
 
     return jsonModel;

package/core/server/services/explore/ExploreService.js

@@ -24,7 +24,7 @@ module.exports = class ExploreService {
      */
     async fetchData() {
         const totalMembers = await this.MembersService.stats.getTotalMembers();
-        const mrrStats = await this.StatsService.getMRRHistory();
+        const mrrStats = await this.StatsService.api.getMRRHistory();
 
         const {description, icon, title, url, accent_color: accentColor, locale} = this.PublicConfigService.site;
 

package/core/server/services/newsletters/NewslettersService.js

@@ -92,7 +92,7 @@ class NewslettersService {
      * @public
      * @param {Object} options data (id, uuid, slug...)
      * @param {Object} [options] options
-     * @returns {Promise<object>} JSONified Newsletter models
+     * @returns {Promise<object>}
      */
     async read(data, options = {}) {
         const newsletter = await this.NewsletterModel.findOne(data, options);
@@ -108,11 +108,14 @@ class NewslettersService {
     /**
      * @public
      * @param {Object} [options] options
-     * @returns {Promise<object>} JSONified Newsletter models
+     * @returns {Promise<object>}
      */
     async browse(options = {}) {
-        let newsletters = await this.NewsletterModel.findAll(options);
+        return await this.NewsletterModel.findPage(options);
+    }
 
+    async getAll(options = {}) {
+        const newsletters = await this.NewsletterModel.findAll(options);
         return newsletters.toJSON();
     }
 
@@ -298,6 +301,10 @@ class NewslettersService {
                 }
 
                 if (validated.verificationEmailRequired) {
+                    if (type === 'replyTo' && email === newsletter.get('sender_email')) {
+                        // This is some custom behaviour that allows swapping sender_email to sender_reply_to without requiring validation again
+                        continue;
+                    }
                     delete cleanedAttrs[property];
                     emailsToVerify.push({email, property});
                 }
@@ -311,6 +318,18 @@ class NewslettersService {
             }
         }
 
+        // If one of the properties was changed, we need to reset sender_email in case it was not changed but is invalid in the database
+        // which can happen after a config change (= auto correcting behaviour)
+        const didChangeReplyTo = newsletter && attrs.sender_reply_to !== undefined && newsletter.get('sender_reply_to') !== attrs.sender_reply_to;
+        const didChangeSenderEmail = newsletter && (attrs.sender_email !== undefined && newsletter.get('sender_email') !== attrs.sender_email);
+        if (didChangeReplyTo && !didChangeSenderEmail && newsletter.get('sender_email')) {
+            const validated = this.emailAddressService.service.validate(newsletter.get('sender_email'), 'from');
+            if (!validated.allowed) {
+                logging.info(`Resetting sender_email for newsletter ${newsletter.id} because it became invalid`);
+                cleanedAttrs.sender_email = null;
+            }
+        }
+
         return {cleanedAttrs, emailsToVerify};
     }
 

package/core/server/services/posts-public/service.js

@@ -8,34 +8,18 @@ class PostsPublicServiceWrapper {
         // Wire up all the dependencies
         const adapterManager = require('../adapter-manager');
         const config = require('../../../shared/config');
-        const EventAwareCacheWrapper = require('@tryghost/event-aware-cache-wrapper');
         const EventRegistry = require('../../lib/common/events');
 
         let postsCache;
         if (config.get('hostSettings:postsPublicCache:enabled')) {
-            const cache = adapterManager.getAdapter('cache:postsPublic');
-            postsCache = new EventAwareCacheWrapper({
-                cache: cache,
-                resetEvents: ['site.changed'],
-                eventRegistry: EventRegistry
+            postsCache = adapterManager.getAdapter('cache:postsPublic');
+            EventRegistry.on('site.changed', () => {
+                postsCache.reset();
             });
         }
 
-        let cache;
-        if (postsCache) {
-            // @NOTE: exposing cache through getter and setter to not loose the context of "this"
-            cache = {
-                get() {
-                    return postsCache.get(...arguments);
-                },
-                set() {
-                    return postsCache.set(...arguments);
-                }
-            };
-        }
-
         this.api = {
-            cache: cache
+            cache: postsCache
         };
     }
 }

package/core/server/services/segment/index.js

@@ -3,9 +3,7 @@ const config = require('../../../shared/config');
 const sentry = require('../../../shared/sentry');
 const logging = require('@tryghost/logging');
 const DomainEvents = require('@tryghost/domain-events');
-const events = require('../../lib/common/events');
 
-const ModelEventsAnalytics = require('./ModelEventsAnalytics');
 const DomainEventsAnalytics = require('./DomainEventsAnalytics');
 
 module.exports.init = function () {
@@ -22,18 +20,6 @@ module.exports.init = function () {
         logging
     });
 
-    const modelEventsAnalytics = new ModelEventsAnalytics({
-        analytics,
-        trackDefaults,
-        prefix,
-        exceptionHandler: sentry,
-        events,
-        logging
-    });
-
-    // Listen to model events
-    modelEventsAnalytics.subscribeToEvents();
-
     // Listen to domain events
     subscribeToDomainEvents.subscribeToEvents();
 };

package/core/server/services/stats/service.js

@@ -1,4 +1,27 @@
-const StatsService = require('@tryghost/stats-service');
-const db = require('../../data/db');
+class StatsServiceWrapper {
+    constructor() {
+        this.api = null;
+        this.cache = null;
+    }
 
-module.exports = StatsService.create({knex: db.knex});
+    async init() {
+        if (this.api) {
+            // Already done
+            return;
+        }
+
+        const StatsService = require('@tryghost/stats-service');
+        const db = require('../../data/db');
+
+        this.api = StatsService.create({knex: db.knex});
+
+        const adapterManager = require('../adapter-manager');
+        const config = require('../../../shared/config');
+
+        if (config.get('hostSettings:statsCache:enabled')) {
+            this.cache = adapterManager.getAdapter('cache:stats');
+        }
+    }
+}
+
+module.exports = new StatsServiceWrapper();

package/core/server/services/tags-public/service.js

@@ -8,33 +8,18 @@ class TagsPublicServiceWrapper {
         // Wire up all the dependencies
         const adapterManager = require('../adapter-manager');
         const config = require('../../../shared/config');
-        const EventAwareCacheWrapper = require('@tryghost/event-aware-cache-wrapper');
         const EventRegistry = require('../../lib/common/events');
 
         let tagsCache;
         if (config.get('hostSettings:tagsPublicCache:enabled')) {
-            let tagsPublicCache = adapterManager.getAdapter('cache:tagsPublic');
-            tagsCache = new EventAwareCacheWrapper({
-                cache: tagsPublicCache,
-                resetEvents: ['site.changed'],
-                eventRegistry: EventRegistry
+            tagsCache = adapterManager.getAdapter('cache:tagsPublic');
+            EventRegistry.on('site.changed', () => {
+                tagsCache.reset();
             });
         }
 
-        let cache;
-        if (tagsCache) {
-            // @NOTE: exposing cache through getter and setter to not loose the context of "this"
-            cache = {
-                get() {
-                    return tagsCache.get(...arguments);
-                },
-                set() {
-                    return tagsCache.set(...arguments);
-                }
-            };
-        }
         this.api = {
-            cache: cache
+            cache: tagsCache
         };
     }
 }

package/core/shared/labs.js

@@ -44,7 +44,7 @@ const ALPHA_FEATURES = [
     'tipsAndDonations',
     'importMemberTier',
     'lexicalIndicators',
-    'adminXOffers',
+    // 'adminXOffers',
     'filterEmailDisabled',
     'adminXDemo',
     'newEmailAddresses',

package/core/shared/sentry.js

@@ -57,6 +57,31 @@ const beforeSend = function (event, hint) {
     }
 };
 
+const ALLOWED_HTTP_TRANSACTIONS = [
+    '/ghost/api', // any Ghost API call
+    '/members/api', // any Members API call
+    '/:slug', // any frontend post/page
+    '/author', // any frontend author page
+    '/tag' // any frontend tag page
+].map((path) => {
+    // Sentry names HTTP transactions like: "<HTTP_METHOD> <PATH>" i.e. "GET /ghost/api/content/settings"
+    // Match any of the paths above with any HTTP method, and also the homepage "GET /"
+    return new RegExp(`^(GET|POST|PUT|DELETE)\\s(?<path>${path}\\/.+|\\/$)`);
+});
+
+const beforeSendTransaction = function (event) {
+    // Drop transactions that are not in the allowed list
+    for (const transaction of ALLOWED_HTTP_TRANSACTIONS) {
+        const match = event.transaction.match(transaction);
+
+        if (match?.groups?.path) {
+            return event;
+        }
+    }
+
+    return null;
+};
+
 if (sentryConfig && !sentryConfig.disabled) {
     const Sentry = require('@sentry/node');
     const version = require('@tryghost/version').full;
@@ -72,7 +97,8 @@ if (sentryConfig && !sentryConfig.disabled) {
         environment: environment,
         maxValueLength: 1000,
         integrations: [],
-        beforeSend
+        beforeSend,
+        beforeSendTransaction
     };
 
     // Enable tracing if sentry.tracing.enabled is true
@@ -117,6 +143,7 @@ if (sentryConfig && !sentryConfig.disabled) {
         captureException: Sentry.captureException,
         captureMessage: Sentry.captureMessage,
         beforeSend: beforeSend,
+        beforeSendTransaction: beforeSendTransaction,
         initQueryTracing: (knex) => {
             if (sentryConfig.tracing?.enabled === true) {
                 const integration = new SentryKnexTracingIntegration(knex);