ghost 5.80.5 → 5.81.1

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.80%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22c1a8c8a94f%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2224dcc6aee2%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2233f4aa4a54%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.81%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a4b7e8c0f1%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2276d88862ac%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%225793443e3b%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-71cfcdf9410af9b3aec11a28f9a4130f.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-85d66247f3eb43a3d462b89c9280e805.css" title="light">
 
     
 </head>
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-43a631b7c834235c4ff0b2186b5ca27d.js"></script>
-<script src="assets/chunk.763.7849440ec6494d2449e9.js"></script>
-<script src="assets/chunk.524.3d8d7c3975612d38f35d.js"></script>
-    <script src="assets/ghost-1c39a8a5afc462b8b49fe2e99cdc4f2c.js"></script>
+    <script src="assets/vendor-f9bad0b8c0149699f84c0bd9d325068e.js"></script>
+<script src="assets/chunk.682.597be201dde4abdd4e68.js"></script>
+<script src="assets/chunk.524.a8bf57854398790b354d.js"></script>
+    <script src="assets/ghost-c3ba0161decd868a3a79d6f4264c3286.js"></script>
 </body>
 </html>

package/core/frontend/public/robots.txt

@@ -2,5 +2,6 @@ User-agent: *
 Sitemap: {{blog-url}}/sitemap.xml
 Disallow: /ghost/
 Disallow: /email/
+Disallow: /members/api/comments/counts/
 Disallow: /r/
 Disallow: /webmentions/receive/

package/core/frontend/web/middleware/handle-image-sizes.js

@@ -139,6 +139,11 @@ module.exports = function handleImageSizes(req, res, next) {
         if (err.code === 'SHARP_INSTALLATION' || err.code === 'IMAGE_PROCESSING' || err.errorType === 'NoContentError') {
             return redirectToOriginal();
         }
+
+        if (err.errorType === 'NotFoundError') {
+            return next();
+        }
+
         next(err);
     });
 };

package/core/server/data/db/ConnectionPoolInstrumentation.js

@@ -24,7 +24,7 @@ class ConnectionPoolInstrumentation {
         this.createStartTimes[eventId] = Date.now();
         const poolMetrics = this.getPoolMetrics();
         this.logging.debug(`[ConnectionPool] Creating a connection. EventID: ${eventId} Pending Creates: ${poolMetrics.numPendingCreates} Free: ${poolMetrics.numFree} Used: ${poolMetrics.numUsed}`);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'create-request',
             eventId,
             ...poolMetrics
@@ -37,7 +37,7 @@ class ConnectionPoolInstrumentation {
         // Delete the start time so we don't leak memory
         delete this.createStartTimes[eventId];
         this.logging.debug(`[ConnectionPool] Created a connection. EventID: ${eventId} Connection ID: ${resource.connectionId} Knex ID: ${resource.__knexUid} Time to Create: ${timeToCreate}ms`);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'create-success',
             eventId,
             connectionId: resource.connectionId,
@@ -53,7 +53,7 @@ class ConnectionPoolInstrumentation {
         delete this.createStartTimes[eventId];
         const poolMetrics = this.getPoolMetrics();
         this.logging.error(`[ConnectionPool] Failed to create a connection. EventID: ${eventId} Time to Create: ${timeToFail}ms`, err);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'create-fail',
             eventId,
             timeToFail,
@@ -66,7 +66,7 @@ class ConnectionPoolInstrumentation {
         this.requestStartTimes[eventId] = Date.now();
         const poolMetrics = this.getPoolMetrics();
         this.logging.debug(`[ConnectionPool] Acquiring a connection. EventID: ${eventId} Pending Acquires: ${poolMetrics.numPendingAcquires} Free: ${poolMetrics.numFree} Used: ${poolMetrics.numUsed}`);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'acquire-request',
             eventId,
             ...poolMetrics
@@ -81,7 +81,7 @@ class ConnectionPoolInstrumentation {
         // Track when the connection was acquired for calculating lifetime upon release
         resource.connectionAcquired = Date.now();
         this.logging.debug(`[ConnectionPool] Acquired a connection. EventID: ${eventId} Connection ID: ${resource.connectionId} Knex Id: ${resource.__knexUid} Time to Acquire: ${timeToAcquire}ms`);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'acquire-success',
             eventId,
             connectionId: resource.connectionId,
@@ -97,7 +97,7 @@ class ConnectionPoolInstrumentation {
         delete this.requestStartTimes[eventId];
         const poolMetrics = this.getPoolMetrics();
         this.logging.error(`[ConnectionPool] Failed to acquire a connection. EventID: ${eventId} Time to Acquire: ${timeToFail}ms`, err);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'acquire-fail',
             eventId,
             timeToFail,
@@ -108,7 +108,7 @@ class ConnectionPoolInstrumentation {
     handleRelease(resource) {
         const lifetime = Date.now() - resource.connectionAcquired;
         this.logging.debug(`[ConnectionPool] Released a connection. Connection ID: ${resource.connectionId} Lifetime: ${lifetime}ms`);
-        this.metrics.metric('metrics-connection-pool', {
+        this.metrics.metric('connection-pool', {
             event: 'release',
             connectionId: resource.connectionId,
             knexUid: resource.__knexUid,
@@ -139,4 +139,4 @@ class ConnectionPoolInstrumentation {
     }
 }
 
-module.exports = ConnectionPoolInstrumentation;
+module.exports = ConnectionPoolInstrumentation;

package/core/server/data/migrations/versions/5.81/2024-03-18-16-20-add-missing-post-permissions.js

@@ -0,0 +1,20 @@
+const {combineTransactionalMigrations, addPermissionToRole} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    addPermissionToRole({
+        permission: 'Edit posts',
+        role: 'Author'
+    }),
+    addPermissionToRole({
+        permission: 'Edit posts',
+        role: 'Contributor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete posts',
+        role: 'Author'
+    }),
+    addPermissionToRole({
+        permission: 'Delete posts',
+        role: 'Contributor'
+    })
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -929,7 +929,7 @@
                     "recommendation": ["browse", "read"]
                 },
                 "Author": {
-                    "post": ["browse", "read", "add"],
+                    "post": ["browse", "read", "edit", "add", "destroy"],
                     "setting": ["browse", "read"],
                     "slug": "all",
                     "tag": ["browse", "read", "add"],
@@ -946,7 +946,7 @@
                     "recommendation": ["browse", "read"]
                 },
                 "Contributor": {
-                    "post": ["browse", "read", "add"],
+                    "post": ["browse", "read", "edit", "add", "destroy"],
                     "setting": ["browse", "read"],
                     "slug": "all",
                     "tag": ["browse", "read"],

package/core/server/models/invite.js

@@ -93,8 +93,7 @@ Invite = ghostBookshelf.Model.extend({
                     } else if (_.some(loadedPermissions.user.roles, {name: 'Editor'})) {
                         allowed = ['Author', 'Contributor'];
                     }
-                }
-                if (loadedPermissions.apiKey) {
+                } else if (loadedPermissions.apiKey) {
                     allowed = ['Editor', 'Author', 'Contributor'];
                 }
 

package/core/server/models/settings.js

@@ -324,16 +324,6 @@ Settings = ghostBookshelf.Model.extend({
         return allSettings;
     },
 
-    permissible: function permissible(modelId, action, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission) {
-        if (hasUserPermission && hasApiKeyPermission) {
-            return Promise.resolve();
-        }
-
-        return Promise.reject(new errors.NoPermissionError({
-            message: tpl(messages.notEnoughPermission)
-        }));
-    },
-
     validators: {
         async all(model) {
             const settingName = model.get('key');

package/core/server/services/permissions/can-this.js

@@ -59,26 +59,12 @@ class CanThisResult {
                     let hasMemberPermission = false;
 
                     const checkPermission = function (perm) {
-                        let permObjId;
-
                         // Look for a matching action type and object type first
                         if (perm.get('action_type') !== actType || perm.get('object_type') !== objType) {
                             return false;
                         }
 
-                        // Grab the object id (if specified, could be null)
-                        permObjId = perm.get('object_id');
-
-                        // If we didn't specify a model (any thing)
-                        // or the permission didn't have an id scope set
-                        // then the "thing" has permission
-                        if (!modelId || !permObjId) {
-                            return true;
-                        }
-
-                        // Otherwise, check if the id's match
-                        // TODO: String vs Int comparison possibility here?
-                        return modelId === permObjId;
+                        return true;
                     };
 
                     if (loadedPermissions.user && _.some(loadedPermissions.user.roles, {name: 'Owner'})) {

package/core/server/web/parent/app.js

@@ -23,6 +23,13 @@ module.exports = function setupParentApp() {
     // @TODO: figure out if this is really needed everywhere? Is it not frontend only...
     parentApp.use(mw.ghostLocals);
 
+    // Enable request queuing if configured
+    const queueConfig = config.get('optimization:requestQueue');
+
+    if (queueConfig?.enabled === true) {
+        parentApp.use(mw.queueRequest(queueConfig));
+    }
+
     debug('ParentApp setup end');
 
     return parentApp;

package/core/server/web/parent/middleware/index.js

@@ -2,5 +2,6 @@ module.exports = {
     emitEvents: require('./emit-events'),
     ghostLocals: require('./ghost-locals'),
     logRequest: require('./log-request'),
+    queueRequest: require('./queue-request'),
     requestId: require('./request-id')
 };

package/core/server/web/parent/middleware/queue-request.js

@@ -0,0 +1,60 @@
+const errors = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+const path = require('node:path');
+const expressQueue = require('express-queue');
+
+const debug = (message) => {
+    logging.debug(`[queue-request] ${message}`);
+};
+
+module.exports = function queueRequest(
+    config,
+    queueFactory = expressQueue
+) {
+    if (config.concurrencyLimit === undefined) {
+        throw new errors.IncorrectUsageError({
+            message: 'concurrencyLimit must be defined when using queueRequest middleware'
+        });
+    }
+
+    debug(`Initialising queueRequest middleware with config: ${JSON.stringify(config)}`);
+
+    // @see https://github.com/alykoshin/express-queue#usage
+    const queue = queueFactory({
+        activeLimit: config.concurrencyLimit,
+        queuedLimit: -1 // Do not limit the number of queued requests
+    });
+
+    /**
+     * Available events:
+     * - queue - when a request is queued
+     * - dequeue - when a request is dequeued
+     * - process - when a request is being processed
+     * - reject - when a request is rejected
+     * - cancel - when a request is cancelled
+     * - complete - when a request has completed
+     *
+     * @see https://github.com/search?q=repo:alykoshin/mini-queue%20job._toState&type=code
+     */
+    queue.queue.on('queue', (job) => {
+        debug(`Request queued: ${job.data.req.path}`);
+
+        job.data.req.queueDepth = job.queue.getLength();
+    });
+
+    queue.queue.on('complete', (job) => {
+        debug(`Request completed: ${job.data.req.path}`);
+    });
+
+    return (req, res, next) => {
+        // Do not queue requests for static assets - We assume that any path
+        // with a file extension is a static asset
+        if (path.extname(req.path)) {
+            debug(`Request for assumed static asset skipping queue: ${req.path}`);
+
+            return next();
+        }
+
+        return queue(req, res, next);
+    };
+};

package/core/shared/labs.js

@@ -48,7 +48,8 @@ const ALPHA_FEATURES = [
     'importMemberTier',
     'lexicalIndicators',
     // 'adminXOffers',
-    'adminXDemo'
+    'adminXDemo',
+    'onboardingChecklist'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/index.js

@@ -1,6 +1 @@
-// Load New Relic
-if (process.env.PRO_ENV) {
-    require('newrelic');
-}
-
 require('./ghost');