ghost 5.81.1 → 5.82.1

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.81%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a4b7e8c0f1%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%2276d88862ac%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%225793443e3b%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.82%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%22a4b7e8c0f1%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%22c95f5407a8%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22d20f997405%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-85d66247f3eb43a3d462b89c9280e805.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-f84b3f229da06680df6c13ebd46ab671.css" title="light">
 
     
 </head>
@@ -57,8 +57,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-f9bad0b8c0149699f84c0bd9d325068e.js"></script>
-<script src="assets/chunk.682.597be201dde4abdd4e68.js"></script>
-<script src="assets/chunk.524.a8bf57854398790b354d.js"></script>
-    <script src="assets/ghost-c3ba0161decd868a3a79d6f4264c3286.js"></script>
+<script src="assets/chunk.682.d7ae35ab7054f9997ce6.js"></script>
+<script src="assets/chunk.524.326ea641bd5fcb846f80.js"></script>
+    <script src="assets/ghost-de0cb83d4074a8874313e5f81872406b.js"></script>
 </body>
 </html>

package/core/frontend/services/routing/RouterManager.js

@@ -8,6 +8,7 @@ const PreviewRouter = require('./PreviewRouter');
 const ParentRouter = require('./ParentRouter');
 const EmailRouter = require('./EmailRouter');
 const UnsubscribeRouter = require('./UnsubscribeRouter');
+const SubscribeRouter = require('./SubscribeRouter');
 
 // This emits its own routing events
 const events = require('../../../server/lib/common/events');
@@ -109,6 +110,10 @@ class RouterManager {
         this.siteRouter.mountRouter(unsubscribeRouter.router());
         this.registry.setRouter('unsubscribeRouter', unsubscribeRouter);
 
+        const subscribeRouter = new SubscribeRouter();
+        this.siteRouter.mountRouter(subscribeRouter.router());
+        this.registry.setRouter('subscribeRouter', subscribeRouter);
+        
         if (RESOURCE_CONFIG.QUERY.email) {
             const emailRouter = new EmailRouter(RESOURCE_CONFIG);
             this.siteRouter.mountRouter(emailRouter.router());

package/core/frontend/services/routing/SubscribeRouter.js

@@ -0,0 +1,27 @@
+const ParentRouter = require('./ParentRouter');
+const controllers = require('./controllers');
+
+/**
+ * @description Subscribe Router.
+ *
+ * "/subscribe/" -> Subscribe Router
+ */
+class SubscribeRouter extends ParentRouter {
+    constructor() {
+        super('SubscribeRouter');
+
+        // @NOTE: hardcoded, not configurable
+        this.route = {value: '/confirm_signup/'};
+        this._registerRoutes();
+    }
+
+    /**
+     * @description Register all routes of this router.
+     * @private
+     */
+    _registerRoutes() {
+        this.mountRoute(this.route.value, controllers.subscribe);
+    }
+}
+
+module.exports = SubscribeRouter;

package/core/frontend/services/routing/controllers/index.js

@@ -29,5 +29,9 @@ module.exports = {
 
     get unsubscribe() {
         return require('./unsubscribe');
+    },
+
+    get subscribe() {
+        return require('./subscribe');
     }
 };

package/core/frontend/services/routing/controllers/subscribe.js

@@ -0,0 +1,35 @@
+const debug = require('@tryghost/debug')('services:routing:controllers:subscribe');
+const path = require('path');
+const fs = require('fs');
+const handlebars = require('handlebars');
+const assetHelper = require('../../../helpers/asset');
+const {settingsCache} = require('../../../services/proxy');
+
+handlebars.registerHelper('asset', assetHelper);
+
+module.exports = async function subscribeController(req, res) {
+    debug('subscribeController');
+
+    // Get the query params
+    const {query} = req;
+    const token = query.token || null;
+    const action = query.action || null;
+    const ref = query.r || null;
+
+    if (!token || !action) {
+        return res.send(404);
+    }
+
+    // Prepare context for rendering template
+    const context = {
+        token,
+        action,
+        r: ref,
+        meta_title: settingsCache.get('title'),
+        accent_color: settingsCache.get('accent_color')
+    };
+    // Compile and render the template
+    const rawTemplate = fs.readFileSync(path.resolve(path.join(__dirname, '../../../views/subscribe.hbs'))).toString();
+    const template = handlebars.compile(rawTemplate);
+    return res.send(template(context));
+};

package/core/frontend/views/subscribe.hbs

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="ie=edge">
+    <title>{{title}}</title>
+    <link rel="stylesheet" href="{{asset "public/ghost.css" hasMinFile="true"}}" />
+</head>
+<body>
+    <div class="gh-app">
+        <div class="gh-viewport">
+            <main class="gh-main" role="main" id="main">
+                <div class="gh-flow">
+                    <div class="gh-flow-content-wrap">
+                        <h1>Subscribing to {{meta_title}}</h1>
+                        <p>If you are not redirected automatically, please click the "Subscribe" button below.</p>
+                        <form id="gh-subscribe-form" action="/members/api/member" method="POST">
+                            <input type="hidden" name="token" value="{{token}}" />
+                            <input type="hidden" name="action" value="{{action}}" />
+                            <input type="hidden" name="r" value="{{r}}" />
+                            <button class="gh-btn" style="background-color: {{accent_color}}; color: #FFFFFF" type="submit"><span>Subscribe</span></button>
+                        </form>
+                    </div>
+                </div>
+            </main>
+        </div>
+    </div>
+    <script>
+        const main = document.getElementById('main');
+        main.style.display = 'none';
+        const form = document.getElementById('gh-subscribe-form');
+        form.submit();
+    </script>
+</body>
+</html>

package/core/server/data/migrations/versions/5.82/2024-03-25-16-46-10-add-email-recipients-email-id-indexes.js

@@ -0,0 +1,17 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const {createNonTransactionalMigration} = require('../../utils');
+const commands = require('../../../schema/commands');
+
+module.exports = createNonTransactionalMigration(
+    async function up(knex) {
+        await commands.addIndex('email_recipients', ['email_id', 'delivered_at'], knex);
+        await commands.addIndex('email_recipients', ['email_id', 'opened_at'], knex);
+        await commands.addIndex('email_recipients', ['email_id', 'failed_at'], knex);
+    },
+    async function down(knex) {
+        await commands.dropIndex('email_recipients', ['email_id', 'delivered_at'], knex);
+        await commands.dropIndex('email_recipients', ['email_id', 'opened_at'], knex);
+        await commands.dropIndex('email_recipients', ['email_id', 'failed_at'], knex);
+    }
+);

package/core/server/data/migrations/versions/5.82/2024-03-25-16-51-29-drop-email-recipients-non-email-id-indexes.js

@@ -0,0 +1,17 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const {createNonTransactionalMigration} = require('../../utils');
+const commands = require('../../../schema/commands');
+
+module.exports = createNonTransactionalMigration(
+    async function up(knex) {
+        await commands.dropIndex('email_recipients', ['delivered_at'], knex);
+        await commands.dropIndex('email_recipients', ['opened_at'], knex);
+        await commands.dropIndex('email_recipients', ['failed_at'], knex);
+    },
+    async function down(knex) {
+        await commands.addIndex('email_recipients', ['delivered_at'], knex);
+        await commands.addIndex('email_recipients', ['opened_at'], knex);
+        await commands.addIndex('email_recipients', ['failed_at'], knex);
+    }
+);

package/core/server/data/schema/schema.js

@@ -865,14 +865,17 @@ module.exports = {
         member_id: {type: 'string', maxlength: 24, nullable: false, index: true},
         batch_id: {type: 'string', maxlength: 24, nullable: false, references: 'email_batches.id'},
         processed_at: {type: 'dateTime', nullable: true},
-        delivered_at: {type: 'dateTime', nullable: true, index: true},
-        opened_at: {type: 'dateTime', nullable: true, index: true},
-        failed_at: {type: 'dateTime', nullable: true, index: true},
+        delivered_at: {type: 'dateTime', nullable: true},
+        opened_at: {type: 'dateTime', nullable: true},
+        failed_at: {type: 'dateTime', nullable: true},
         member_uuid: {type: 'string', maxlength: 36, nullable: false},
         member_email: {type: 'string', maxlength: 191, nullable: false},
         member_name: {type: 'string', maxlength: 191, nullable: true},
         '@@INDEXES@@': [
-            ['email_id', 'member_email']
+            ['email_id', 'member_email'],
+            ['email_id', 'delivered_at'],
+            ['email_id', 'opened_at'],
+            ['email_id', 'failed_at']
         ]
     },
     email_recipient_failures: {

package/core/server/services/email-analytics/lib/queries.js

@@ -41,10 +41,16 @@ module.exports = {
     },
 
     async aggregateEmailStats(emailId) {
+        const {totalCount} = await db.knex('emails').select(db.knex.raw('email_count as totalCount')).where('id', emailId).first() || {totalCount: 0};
+        // use IS NULL here because that will typically match far fewer rows than IS NOT NULL making the query faster
+        const [undeliveredCount] = await db.knex('email_recipients').count('id as count').whereRaw('email_id = ? AND delivered_at IS NULL', [emailId]);
+        const [openedCount] = await db.knex('email_recipients').count('id as count').whereRaw('email_id = ? AND opened_at IS NOT NULL', [emailId]);
+        const [failedCount] = await db.knex('email_recipients').count('id as count').whereRaw('email_id = ? AND failed_at IS NOT NULL', [emailId]);
+
         await db.knex('emails').update({
-            delivered_count: db.knex.raw(`(SELECT COUNT(id) FROM email_recipients WHERE email_id = ? AND delivered_at IS NOT NULL)`, [emailId]),
-            opened_count: db.knex.raw(`(SELECT COUNT(id) FROM email_recipients WHERE email_id = ? AND opened_at IS NOT NULL)`, [emailId]),
-            failed_count: db.knex.raw(`(SELECT COUNT(id) FROM email_recipients WHERE email_id = ? AND failed_at IS NOT NULL)`, [emailId])
+            delivered_count: totalCount - undeliveredCount.count,
+            opened_count: openedCount.count,
+            failed_count: failedCount.count
         }).where('id', emailId);
     },
 
@@ -56,15 +62,16 @@ module.exports = {
             .where('emails.track_opens', true)
             .first() || {};
 
+        const [emailCount] = await db.knex('email_recipients').count('id as count').whereRaw('member_id = ?', [memberId]);
+        const [emailOpenedCount] = await db.knex('email_recipients').count('id as count').whereRaw('member_id = ? AND opened_at IS NOT NULL', [memberId]);
+
         const updateQuery = {
-            email_count: db.knex.raw('(SELECT COUNT(id) FROM email_recipients WHERE member_id = ?)', [memberId]),
-            email_opened_count: db.knex.raw('(SELECT COUNT(id) FROM email_recipients WHERE member_id = ? AND opened_at IS NOT NULL)', [memberId])
+            email_count: emailCount.count,
+            email_opened_count: emailOpenedCount.count
         };
 
         if (trackedEmailCount >= MIN_EMAIL_COUNT_FOR_OPEN_RATE) {
-            updateQuery.email_open_rate = db.knex.raw(`
-                ROUND(((SELECT COUNT(id) FROM email_recipients WHERE member_id = ? AND opened_at IS NOT NULL) * 1.0 / ? * 100), 0)
-            `, [memberId, trackedEmailCount]);
+            updateQuery.email_open_rate = Math.round(emailOpenedCount.count / trackedEmailCount * 100);
         }
 
         await db.knex('members')

package/core/server/services/members/MembersConfigProvider.js

@@ -2,6 +2,7 @@ const logging = require('@tryghost/logging');
 const {URL} = require('url');
 const crypto = require('crypto');
 const createKeypair = require('keypair');
+const labs = require('../../../shared/labs');
 
 class MembersConfigProvider {
     /**
@@ -87,7 +88,8 @@ class MembersConfigProvider {
     }
 
     getSigninURL(token, type, referrer) {
-        const siteUrl = this._urlUtils.urlFor({relativeUrl: '/members/'}, true);
+        const relativeUrl = ['signup', 'subscribe'].includes(type) && labs.isSet('membersSpamPrevention') ? '/confirm_signup/' : '/members/';
+        const siteUrl = this._urlUtils.urlFor({relativeUrl}, true);
         const signinURL = new URL(siteUrl);
         signinURL.searchParams.set('token', token);
         signinURL.searchParams.set('action', type);

package/core/server/services/stripe/service.js

@@ -11,6 +11,7 @@ const {getConfig} = require('./config');
 const settingsHelpers = require('../settings-helpers');
 const donationService = require('../donations');
 const staffService = require('../staff');
+const labs = require('../../../shared/labs');
 
 async function configureApi() {
     const cfg = getConfig({settingsHelpers, config, urlUtils});
@@ -30,6 +31,7 @@ const debouncedConfigureApi = _.debounce(() => {
 }, 600);
 
 module.exports = new StripeService({
+    labs,
     membersService,
     models: _.pick(models, [
         'Product',

package/core/server/web/members/app.js

@@ -37,6 +37,9 @@ module.exports = function setupMembersApp() {
     // Initializes members specific routes as well as assigns members specific data to the req/res objects
     // We don't want to add global bodyParser middleware as that interferes with stripe webhook requests on - `/webhooks`.
 
+    // Double opt-in subscription handling
+    membersApp.post('/api/member', membersService.api.middleware.createMemberFromToken);
+
     // Manage newsletter subscription via unsubscribe link
     membersApp.get('/api/member/newsletters', middleware.getMemberNewsletters);
     membersApp.put('/api/member/newsletters', bodyParser.json({limit: '50mb'}), middleware.updateMemberNewsletters);

package/core/shared/labs.js

@@ -24,12 +24,14 @@ const GA_FEATURES = [
     'listUnsubscribeHeader',
     'filterEmailDisabled',
     'newEmailAddresses',
-    'portalImprovements'
+    'portalImprovements',
+    'onboardingChecklist'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
 //       input for the "labs" setting value
 const BETA_FEATURES = [
+    'additionalPaymentMethods',
     'i18n',
     'activitypub',
     'webmentions'
@@ -49,7 +51,7 @@ const ALPHA_FEATURES = [
     'lexicalIndicators',
     // 'adminXOffers',
     'adminXDemo',
-    'onboardingChecklist'
+    'membersSpamPrevention'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];