ghost 5.80.1 → 5.80.3

package/core/built/admin/assets/{vendor-6b83da0c6e6fede335947219c59e1543.js → vendor-43a631b7c834235c4ff0b2186b5ca27d.js}

@@ -2478,10 +2478,8 @@ var e=this.handle
 return this.handle+=3,e}finishMalloc(e,t){this.table[e+1]=l(t,0)}size(){return this.offset}getaddr(e){return this.table[e]}gethandle(e){this.table.push(e,l(0,3),0)
 var t=this.handle
 return this.handle+=3,t}sizeof(e){return f(this.table,e)}scopesizeof(e){return m(this.table,e)}free(e){var t=this.table[e+1]
-this.table[e+1]=u(t,1)}compact(){for(var e=0,{table:t,table:{length:r},heap:n}=this,i=0;i<r;i+=3){var o=t[i],s=t[i+1],a=s&Size.SIZE_MASK,l=0&s
-if(2!==l)if(1===l)t[i+1]=u(s,2),e+=a
-else if(0===l){for(var c=o;c<=i+a;c++)n[c-e]=n[c]
-t[i]=o-e}else 3===l&&(t[i]=o-e)}this.offset=this.offset-e}pushPlaceholder(e){this.sizeCheck()
+this.table[e+1]=u(t,1)}compact(){for(var e=0,{table:t,table:{length:r},heap:n}=this,i=0;i<r;i+=3){for(var o=t[i],s=t[i+1],a=s&Size.SIZE_MASK,l=o;l<=i+a;l++)n[l-e]=n[l]
+t[i]=o-e}this.offset=this.offset-e}pushPlaceholder(e){this.sizeCheck()
 var t=this.offset++
 this.heap[t]=2147483647,this.placeholders.push([t,e])}pushStdlib(e){this.sizeCheck()
 var t=this.offset++
@@ -2645,7 +2643,7 @@ return this.slots[e]}set(e,t){if(e>=this.slots.length)throw new RangeError(`BUG:
 this.slots[e]=t}}e.PartialScopeImpl=ge
 var be=new class{constructor(){this.evaluateOpcode=(0,t.fillNulls)(104).slice()}add(e,t,r="syscall"){this.evaluateOpcode[e]={syscall:"machine"!==r,evaluate:t}}debugBefore(e,t){return{sp:undefined,pc:e.fetchValue(i.$pc),name:undefined,params:undefined,type:t.type,isMachine:t.isMachine,size:t.size,state:void 0}}debugAfter(e,t){}evaluate(e,t,r){var n=this.evaluateOpcode[r]
 n.syscall?n.evaluate(e,t):n.evaluate(e[l],t)}}
-class ve{constructor(){(0,t.initializeGuid)(this)}}class ye extends ve{}function _e(e){return"function"!=typeof e.toString?"":String(e)}function we(e){return e===n.UNDEFINED_REFERENCE}function Ee(e){return 0|(e.dynamicLayout?1:0)|(e.dynamicTag?2:0)|(e.prepareArgs?4:0)|(e.createArgs?8:0)|(e.attributeHook?16:0)|(e.elementHook?32:0)|(e.dynamicScope?64:0)|(e.createCaller?128:0)|(e.updateHook?256:0)|(e.createInstance?512:0)|(e.wrapped?1024:0)|(e.willDestroy?2048:0)}function xe(e,t,r){return!!(t&r)}function ke(e,t){return!!(e&t)}be.add(16,((e,{op1:t})=>{var r=e.stack,n=e.runtime.resolver.resolve(t)(r.popJs(),e)
+class ve{constructor(){(0,t.initializeGuid)(this)}}class ye extends ve{}function _e(e){return"function"!=typeof e.toString?"":String(e)}function we(e){return e===n.UNDEFINED_REFERENCE}function Ee(e){return(e.dynamicLayout?1:0)|(e.dynamicTag?2:0)|(e.prepareArgs?4:0)|(e.createArgs?8:0)|(e.attributeHook?16:0)|(e.elementHook?32:0)|(e.dynamicScope?64:0)|(e.createCaller?128:0)|(e.updateHook?256:0)|(e.createInstance?512:0)|(e.wrapped?1024:0)|(e.willDestroy?2048:0)}function xe(e,t,r){return!!(t&r)}function ke(e,t){return!!(e&t)}be.add(16,((e,{op1:t})=>{var r=e.stack,n=e.runtime.resolver.resolve(t)(r.popJs(),e)
 e.loadValue(i.$v0,n)})),be.add(21,((e,{op1:t})=>{var r=e.referenceForSymbol(t)
 e.stack.pushJs(r)})),be.add(19,((e,{op1:t})=>{var r=e.stack.pop()
 e.scope().bindSymbol(t,r)})),be.add(20,((e,{op1:t})=>{var r=e.stack.popJs(),n=e.stack.popJs(),i=e.stack.popJs()
@@ -3382,7 +3380,7 @@ return C.ENCODE_AND_DECODE_PATH_SEGMENTS?h(r):r},y[2]=function(e,t){return g(t,e
 var _=Object.freeze({}),w=Object.freeze([])
 function E(e,t,r){t.length>0&&47===t.charCodeAt(0)&&(t=t.substr(1))
 for(var n=t.split("/"),i=void 0,o=void 0,s=0;s<n.length;s++){var a,l=n[s],u=0
-12&(a=2<<(u=""===l?4:58===l.charCodeAt(0)?1:42===l.charCodeAt(0)?2:0))&&(l=l.slice(1),(i=i||[]).push(l),(o=o||[]).push(0!=(4&a))),14&a&&r[u]++,e.push({type:u,value:c(l)})}return{names:i||w,shouldDecodes:o||w}}function x(e,t,r){return e.char===t&&e.negate===r}var k=function(e,t,r,n,i){this.states=e,this.id=t,this.char=r,this.negate=n,this.nextStates=i?t:null,this.pattern="",this._regex=void 0,this.handlers=void 0,this.types=void 0}
+12&(a=2<<(u=""===l?4:58===l.charCodeAt(0)?1:42===l.charCodeAt(0)?2:0))&&(l=l.slice(1),(i=i||[]).push(l),(o=o||[]).push(!!(4&a))),14&a&&r[u]++,e.push({type:u,value:c(l)})}return{names:i||w,shouldDecodes:o||w}}function x(e,t,r){return e.char===t&&e.negate===r}var k=function(e,t,r,n,i){this.states=e,this.id=t,this.char=r,this.negate=n,this.nextStates=i?t:null,this.pattern="",this._regex=void 0,this.handlers=void 0,this.types=void 0}
 function O(e,t){return e.negate?e.char!==t&&-1!==e.char:e.char===t||-1===e.char}function P(e,t){for(var r=[],n=0,i=e.length;n<i;n++){var o=e[n]
 r=r.concat(o.match(t))}return r}k.prototype.regex=function(){return this._regex||(this._regex=new RegExp(this.pattern)),this._regex},k.prototype.get=function(e,t){var r=this.nextStates
 if(null!==r)if(f(r))for(var n=0;n<r.length;n++){var i=this.states[r[n]]
@@ -3736,7 +3734,7 @@ case 3:return[s,a,n]
 case 4:return[l,s,n]
 case 5:return[n,s,a]}},i.hsv.hsl=function(e){var t,r,n,i=e[0],o=e[1]/100,s=e[2]/100,a=Math.max(s,.01)
 return n=(2-o)*s,r=o*a,[i,100*(r=(r/=(t=(2-o)*a)<=1?t:2-t)||0),100*(n/=2)]},i.hwb.rgb=function(e){var t,r,n,i,o,s,a,l=e[0]/360,u=e[1]/100,c=e[2]/100,d=u+c
-switch(d>1&&(u/=d,c/=d),n=6*l-(t=Math.floor(6*l)),0!=(1&t)&&(n=1-n),i=u+n*((r=1-c)-u),t){default:case 6:case 0:o=r,s=i,a=u
+switch(d>1&&(u/=d,c/=d),n=6*l-(t=Math.floor(6*l)),1&t&&(n=1-n),i=u+n*((r=1-c)-u),t){default:case 6:case 0:o=r,s=i,a=u
 break
 case 1:o=i,s=r,a=u
 break
@@ -5188,7 +5186,7 @@ if(Array.isArray(t))for(var i=0;i<t.length;i++)t[i]=e(t[i],r)
 else if("object"===n(t))for(var o in t)t.hasOwnProperty(o)&&(t[o]=e(t[o],r))
 return t}(e.data,t),e.attachments=void 0,e}},function(e,t){function r(e){e=e||{},this.ms=e.min||100,this.max=e.max||1e4,this.factor=e.factor||2,this.jitter=e.jitter>0&&e.jitter<=1?e.jitter:0,this.attempts=0}e.exports=r,r.prototype.duration=function(){var e=this.ms*Math.pow(this.factor,this.attempts++)
 if(this.jitter){var t=Math.random(),r=Math.floor(t*this.jitter*e)
-e=0==(1&Math.floor(10*t))?e-r:e+r}return 0|Math.min(e,this.max)},r.prototype.reset=function(){this.attempts=0},r.prototype.setMin=function(e){this.ms=e},r.prototype.setMax=function(e){this.max=e},r.prototype.setJitter=function(e){this.jitter=e}}])})),"undefined"==typeof FastBoot&&(/*! VelocityJS.org (1.5.2). (C) 2014 Julian Shapiro. MIT @license: en.wikipedia.org/wiki/MIT_License */
+e=1&Math.floor(10*t)?e+r:e-r}return 0|Math.min(e,this.max)},r.prototype.reset=function(){this.attempts=0},r.prototype.setMin=function(e){this.ms=e},r.prototype.setMax=function(e){this.max=e},r.prototype.setJitter=function(e){this.jitter=e}}])})),"undefined"==typeof FastBoot&&(/*! VelocityJS.org (1.5.2). (C) 2014 Julian Shapiro. MIT @license: en.wikipedia.org/wiki/MIT_License */
 /*! VelocityJS.org jQuery Shim (1.0.1). (C) 2014 The jQuery Foundation. MIT @license: en.wikipedia.org/wiki/MIT_License. */
 function(e){"use strict"
 if(!e.jQuery){var t=function(e,r){return new t.fn.init(e,r)}
@@ -9914,4 +9912,4 @@ e.default=class{constructor(e){if(this._data=new t.default,e)for(let t=0;t<e.len
 return this}get(e){let t=this._data[e]
 return t===r.UNDEFINED_KEY?void 0:t}set(e,t){return this._data[e]=t,this}delete(e){return this._data[e]=r.UNDEFINED_KEY,!0}}}))
 
-//# sourceMappingURL=vendor-0462eb4577b6a717a7cadbacd0d3b276.map
+//# sourceMappingURL=vendor-d101e8f704a5e36b553c9b65b75cd58d.map

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.80%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22c1a8c8a94f%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22d3a1c163cf%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%221c1d39191e%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.80%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22c1a8c8a94f%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2224dcc6aee2%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2233f4aa4a54%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-40f01556960b49381176bbfa19a89c9a.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-71cfcdf9410af9b3aec11a28f9a4130f.css" title="light">
 
     
 </head>
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-6b83da0c6e6fede335947219c59e1543.js"></script>
-<script src="assets/chunk.763.6b160e403073ecabbfa6.js"></script>
-<script src="assets/chunk.524.eecfc0cb2091306f132c.js"></script>
-    <script src="assets/ghost-ea7a51891dfca9b7a04aacfffe7dea4e.js"></script>
+    <script src="assets/vendor-43a631b7c834235c4ff0b2186b5ca27d.js"></script>
+<script src="assets/chunk.763.7849440ec6494d2449e9.js"></script>
+<script src="assets/chunk.524.c6ed93ff44a9cb49235c.js"></script>
+    <script src="assets/ghost-594a7dd26bdb4fec210b285cab5555cb.js"></script>
 </body>
 </html>

package/core/frontend/helpers/get.js

@@ -11,6 +11,7 @@ const Sentry = require('@sentry/node');
 
 const _ = require('lodash');
 const jsonpath = require('jsonpath');
+const nqlLang = require('@tryghost/nql-lang');
 
 const messages = {
     mustBeCalledAsBlock: 'The {\\{{helperName}}} helper must be called as a block. E.g. {{#{helperName}}}...{{/{helperName}}}',
@@ -121,6 +122,84 @@ function parseOptions(globals, data, options) {
     return options;
 }
 
+function optimiseFilterCacheability(resource, options) {
+    const noOptimisation = {
+        options,
+        parseResult(result) {
+            return result;
+        }
+    };
+    if (resource !== 'posts') {
+        return noOptimisation;
+    }
+
+    if (!options.filter) {
+        return noOptimisation;
+    }
+
+    try {
+        if (options.filter.split('id:-').length !== 2) {
+            return noOptimisation;
+        }
+
+        const parsedFilter = nqlLang.parse(options.filter);
+        // Support either `id:blah` or `id:blah+other:stuff`
+        if (!parsedFilter.$and && !parsedFilter.id) {
+            return noOptimisation;
+        }
+        const queries = parsedFilter.$and || [parsedFilter];
+        const query = queries.find((q) => {
+            return q?.id?.$ne;
+        });
+
+        if (!query) {
+            return noOptimisation;
+        }
+
+        const idToFilter = query.id.$ne;
+
+        let limit = options.limit;
+        if (options.limit !== 'all') {
+            limit = options.limit ? 1 + parseInt(options.limit, 10) : 16;
+        }
+
+        // We replace with id:-null so we don't have to deal with leading/trailing AND operators
+        const filter = options.filter.replace(/id:-[a-f0-9A-F]{24}/, 'id:-null');
+
+        const parseResult = function parseResult(result) {
+            const filteredPosts = result?.posts?.filter((post) => {
+                return post.id !== idToFilter;
+            }) || [];
+
+            const modifiedResult = {
+                ...result,
+                posts: limit === 'all' ? filteredPosts : filteredPosts.slice(0, limit - 1)
+            };
+
+            modifiedResult.meta = modifiedResult.meta || {};
+            modifiedResult.meta.cacheabilityOptimisation = true;
+
+            if (typeof modifiedResult?.meta?.pagination?.limit === 'number') {
+                modifiedResult.meta.pagination.limit = modifiedResult.meta.pagination.limit - 1;
+            }
+
+            return modifiedResult;
+        };
+
+        return {
+            options: {
+                ...options,
+                limit,
+                filter
+            },
+            parseResult
+        };
+    } catch (err) {
+        logging.warn(err);
+        return noOptimisation;
+    }
+}
+
 /**
  *
  * @param {String} resource
@@ -131,6 +210,12 @@ function parseOptions(globals, data, options) {
  */
 async function makeAPICall(resource, controllerName, action, apiOptions) {
     const controller = api[controllerName];
+    let makeRequest = options => controller[action](options);
+
+    const {
+        options,
+        parseResult
+    } = optimiseFilterCacheability(resource, apiOptions);
 
     let timer;
 
@@ -141,7 +226,7 @@ async function makeAPICall(resource, controllerName, action, apiOptions) {
             const logLevel = config.get('optimization:getHelper:timeout:level') || 'error';
             const threshold = config.get('optimization:getHelper:timeout:threshold');
 
-            const apiResponse = controller[action](apiOptions);
+            const apiResponse = makeRequest(options).then(parseResult);
 
             const timeout = new Promise((resolve) => {
                 timer = setTimeout(() => {
@@ -161,7 +246,7 @@ async function makeAPICall(resource, controllerName, action, apiOptions) {
             response = await Promise.race([apiResponse, timeout]);
             clearTimeout(timer);
         } else {
-            response = await controller[action](apiOptions);
+            response = await makeRequest(options).then(parseResult);
         }
 
         return response;
@@ -279,3 +364,5 @@ module.exports = async function get(resource, options) {
 };
 
 module.exports.async = true;
+
+module.exports.optimiseFilterCacheability = optimiseFilterCacheability;

package/core/frontend/public/robots.txt

@@ -1,7 +1,6 @@
 User-agent: *
 Sitemap: {{blog-url}}/sitemap.xml
 Disallow: /ghost/
-Disallow: /p/
 Disallow: /email/
 Disallow: /r/
 Disallow: /webmentions/receive/

package/core/frontend/services/rendering/renderer.js

@@ -1,6 +1,12 @@
+const path = require('path');
 const debug = require('@tryghost/debug')('services:routing:renderer:renderer');
+const {IncorrectUsageError} = require('@tryghost/errors');
 const setContext = require('./context');
 const templates = require('./templates');
+const tpl = require('@tryghost/tpl');
+const messages = {
+    couldNotReadFile: 'Could not read file {file}'
+};
 
 /**
  * @description Helper function to finally render the data.
@@ -26,5 +32,17 @@ module.exports = function renderer(req, res, data) {
     }
 
     // Render Call
-    res.render(res._template, data);
+    res.render(res._template, data, function (err, html) {
+        if (err) {
+            if (err.code === 'ENOENT') {
+                return req.next(
+                    new IncorrectUsageError({
+                        message: tpl(messages.couldNotReadFile, {file: path.basename(err.path)})
+                    })
+                );
+            }
+            return req.next(err);
+        }
+        res.send(html);
+    });
 };

package/core/frontend/services/theme-engine/i18n/I18n.js

@@ -14,9 +14,9 @@ const get = require('lodash/get');
 class I18n {
     /**
      * @param {object} [options]
-     * @param {string} basePath - the base path to the translations directory
-     * @param {string} [locale] - a locale string
-     * @param {{dot|fulltext}} [stringMode] - which mode our translation keys use
+     * @param {string} options.basePath - the base path to the translations directory
+     * @param {string} [options.locale] - a locale string
+     * @param {string} [options.stringMode] - which mode our translation keys use
      */
     constructor(options = {}) {
         this._basePath = options.basePath || __dirname;
@@ -100,7 +100,7 @@ class I18n {
     /**
      * Attempt to load strings from a file
      *
-     * @param {sting} [locale]
+     * @param {string} [locale]
      * @returns {object} strings
      */
     _loadStrings(locale) {
@@ -110,7 +110,7 @@ class I18n {
             return this._readTranslationsFile(locale);
         } catch (err) {
             if (err.code === 'ENOENT') {
-                this._handleMissingFileError(locale, err);
+                this._handleMissingFileError(locale);
 
                 if (locale !== this.defaultLocale()) {
                     this._handleFallbackToDefault();
@@ -207,7 +207,7 @@ class I18n {
      */
     _readTranslationsFile(locale) {
         const filePath = path.join(...this._translationFileDirs(), this._translationFileName(locale));
-        const content = fs.readFileSync(filePath);
+        const content = fs.readFileSync(filePath, 'utf8');
         return JSON.parse(content);
     }
 
@@ -276,6 +276,7 @@ class I18n {
     _handleMissingFileError(locale) {
         logging.warn(`i18n was unable to find ${locale}.json.`);
     }
+
     _handleInvalidFileError(locale, err) {
         logging.error(new errors.IncorrectUsageError({
             err,

package/core/frontend/services/theme-engine/i18n/ThemeI18n.js

@@ -4,9 +4,9 @@ const I18n = require('./I18n');
 
 class ThemeI18n extends I18n {
     /**
-     * @param {objec} [options]
-     * @param {string} basePath - the base path for the translation directory (e.g. where themes live)
-     * @param {string} [locale] - a locale string
+     * @param {object} [options]
+     * @param {string} options.basePath - the base path for the translation directory (e.g. where themes live)
+     * @param {string} [options.locale] - a locale string
      */
     constructor(options = {}) {
         super(options);
@@ -48,6 +48,7 @@ class ThemeI18n extends I18n {
             logging.warn(`Theme translations file locales/${locale}.json not found.`);
         }
     }
+
     _handleInvalidFileError(locale, err) {
         logging.error(new errors.IncorrectUsageError({
             err,

package/core/server/adapters/storage/LocalStorageBase.js

@@ -58,7 +58,15 @@ class LocalStorageBase extends StorageBase {
         targetFilename = filename;
         await fs.mkdirs(targetDir);
 
-        await fs.copy(file.path, targetFilename);
+        try {
+            await fs.copy(file.path, targetFilename);
+        } catch (err) {
+            if (err.code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err});
+            }
+
+            throw err;
+        }
 
         // The src for the image must be in URI format, not a file system path, which in Windows uses \
         // For local file system storage can use relative path so add a slash
@@ -149,6 +157,10 @@ class LocalStorageBase extends StorageBase {
                         return next(new errors.NoPermissionError({err: err}));
                     }
 
+                    if (err.name === 'RangeNotSatisfiableError') {
+                        return next(new errors.RangeNotSatisfiableError({err}));
+                    }
+
                     return next(new errors.InternalServerError({err: err}));
                 }
 

package/core/server/api/endpoints/images.js

@@ -1,8 +1,10 @@
 /* eslint-disable ghost/ghost-custom/max-api-complexity */
-const storage = require('../../adapters/storage');
+const path = require('path');
+const errors = require('@tryghost/errors');
 const imageTransform = require('@tryghost/image-transform');
+
+const storage = require('../../adapters/storage');
 const config = require('../../../shared/config');
-const path = require('path');
 
 module.exports = {
     docName: 'images',
@@ -33,7 +35,16 @@ module.exports = {
                     width: config.get('imageOptimization:defaultMaxWidth')
                 }, imageOptimizationOptions);
 
-                await imageTransform.resizeFromPath(options);
+                try {
+                    await imageTransform.resizeFromPath(options);
+                } catch (err) {
+                    // If the image processing fails, we don't want to store the image because it's corrupted/invalid
+                    throw new errors.BadRequestError({
+                        message: 'Image processing failed',
+                        context: err.message,
+                        help: 'Please verify that the image is valid'
+                    });
+                }
 
                 // Store the processed/optimized image
                 const processedImageUrl = await store.save({

package/core/server/api/endpoints/utils/serializers/input/tiers.js

@@ -1,10 +1,26 @@
+const {BadRequestError} = require('@tryghost/errors');
 const localUtils = require('../../index');
+const nql = require('@tryghost/nql-lang');
+const tpl = require('@tryghost/tpl');
+
+const messages = {
+    invalidNQLFilter: 'The NQL filter you passed was invalid.'
+};
 
 const forceActiveFilter = (frame) => {
     if (frame.options.filter) {
-        frame.options.filter = `(${frame.options.filter})+active:true`;
+        frame.options.filter = {
+            $and: [
+                {
+                    active: true
+                },
+                frame.options.filter
+            ]
+        };
     } else {
-        frame.options.filter = 'active:true';
+        frame.options.filter = {
+            active: true
+        };
     }
 };
 
@@ -41,6 +57,18 @@ function convertTierInput(input) {
 
 module.exports = {
     all(_apiConfig, frame) {
+        if (frame.options.filter) {
+            try {
+                frame.options.filter = nql.parse(frame.options.filter);
+            } catch (err) {
+                throw new BadRequestError({
+                    message: tpl(messages.invalidNQLFilter)
+                });
+            }
+        } else {
+            frame.options.filter = null;
+        }
+
         if (localUtils.isContentAPI(frame)) {
             // CASE: content api can only have active tiers
             forceActiveFilter(frame);