ghost 5.86.2 → 5.87.1

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.86%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22ember-websockets%22%3A%7B%22socketIO%22%3Atrue%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2262f98e1b33%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%224245030234%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%226b8583f4e9%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%22f6cd11e49b%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.87%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2247bfbf88f0%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%229c49d06c68%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2236ec618662%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%22b147b1abae%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-117facae643a21dde076079b84fce471.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-cc31d867156dbb76ec96cdd93bd39d36.css" title="light">
 
     
 </head>
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-232fd88c6ffbd896b34c449112793e93.js"></script>
-<script src="assets/chunk.216.1641331b33471771559d.js"></script>
-<script src="assets/chunk.524.6932df81384274864737.js"></script>
-    <script src="assets/ghost-cc7512accd98e0fa3cc0906c52204a55.js"></script>
+    <script src="assets/vendor-4e0f92ca2b1c0850606b912c70852e32.js"></script>
+<script src="assets/chunk.42.167fc5e3f3a1c1088f2e.js"></script>
+<script src="assets/chunk.524.a032fbf6d6bbe20b0eb3.js"></script>
+    <script src="assets/ghost-b645099f33022aa37d96a2be8d8ddad1.js"></script>
 </body>
 </html>

package/core/frontend/helpers/get.js

@@ -299,7 +299,7 @@ module.exports = async function get(resource, options) {
     try {
         const spanName = `{{#get "${resource}"${apiOptionsString}}} ${data.member ? 'member' : 'public'}`;
         const result = await Sentry.startSpan({
-            op: 'frontend.helpers.get', 
+            op: 'frontend.helpers.get',
             name: spanName,
             tags: {
                 resource,
@@ -313,11 +313,11 @@ module.exports = async function get(resource, options) {
             if (response[resource] && response[resource].length) {
                 response[resource].forEach(prepareContextResource);
             }
-    
+
             // used for logging details of slow requests
             returnedRowsCount = response[resource] && response[resource].length;
             span?.setTag('returnedRows', returnedRowsCount);
-    
+
             // block params allows the theme developer to name the data using something like
             // `{{#get "posts" as |result pageInfo|}}`
             const blockParams = [response[resource]];
@@ -325,7 +325,7 @@ module.exports = async function get(resource, options) {
                 response.pagination = response.meta.pagination;
                 blockParams.push(response.meta.pagination);
             }
-    
+
             // Call the main template function
             const rendered = options.fn(response, {
                 data: data,
@@ -357,7 +357,9 @@ module.exports = async function get(resource, options) {
                         apiOptions,
                         returnedRows: returnedRowsCount
                     }
-                }));
+                }), {
+                    time: totalMs
+                });
             }
         }
     }

package/core/frontend/src/cards/css/bookmark.css

@@ -12,6 +12,7 @@
 .kg-bookmark-card a.kg-bookmark-container,
 .kg-bookmark-card a.kg-bookmark-container:hover {
     display: flex;
+    background: #fff;
     text-decoration: none;
     border-radius: 6px;
     border: 1px solid rgb(124 139 154 / 25%);
@@ -28,6 +29,7 @@
     justify-content: flex-start;
     padding: 20px;
     overflow: hidden;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
 }
 
 .kg-bookmark-title {

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -7,6 +7,7 @@ const slugFilterOrder = require('./utils/slug-filter-order');
 const localUtils = require('../../index');
 const mobiledoc = require('../../../../../lib/mobiledoc');
 const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
+const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
 const sentry = require('../../../../../../shared/sentry');
@@ -24,6 +25,33 @@ function removeSourceFormats(frame) {
     }
 }
 
+/**
+ * Selects all allowed columns for the given frame.
+ * 
+ * This removes the lexical and mobiledoc columns from the query. This is a performance improvement as we never intend
+ *  to expose those columns in the content API and they are very large datasets to be passing around and de/serializing.
+ * 
+ * NOTE: This is only intended for the Content API. We need these fields within Admin API responses.
+ *
+ * @param {Object} frame - The frame object.
+ */
+function selectAllAllowedColumns(frame) {
+    if (!frame.options.columns && !frame.options.selectRaw) {
+        // Because we're returning columns directly from the schema we need to remove info columns like @@UNIQUE_CONSTRAINTS@@ and @@INDEXES@@
+        frame.options.selectRaw = _.keys(_.omit(postsSchema, ['lexical','mobiledoc','@@INDEXES@@','@@UNIQUE_CONSTRAINTS@@'])).join(',');
+    } else if (frame.options.columns) {
+        frame.options.columns = frame.options.columns.filter((column) => {
+            return !['mobiledoc', 'lexical'].includes(column);
+        });
+    } else if (frame.options.selectRaw) {
+        frame.options.selectRaw = frame.options.selectRaw.split(',').map((column) => {
+            return column.trim();
+        }).filter((column) => {
+            return !['mobiledoc', 'lexical'].includes(column);
+        }).join(',');
+    }
+}
+
 function defaultRelations(frame) {
     if (frame.options.withRelated) {
         return;
@@ -97,7 +125,10 @@ module.exports = {
         forcePageFilter(frame);
 
         if (localUtils.isContentAPI(frame)) {
-            removeSourceFormats(frame);
+            // CASE: the content api endpoint for posts should not return mobiledoc or lexical
+            removeSourceFormats(frame); // remove from the format field
+            selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options            
+
             setDefaultOrder(frame);
             forceVisibilityColumn(frame);
         }

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -47,8 +47,8 @@ function removeSourceFormats(frame) {
  */
 function selectAllAllowedColumns(frame) {
     if (!frame.options.columns && !frame.options.selectRaw) {
-        // Because we're returning columns directly from the table we need to remove info columns like @@UNIQUE_CONSTRAINTS@@
-        frame.options.selectRaw = _.keys(_.omit(postsSchema, ['lexical','mobiledoc','@@UNIQUE_CONSTRAINTS@@'])).join(',');
+        // Because we're returning columns directly from the schema we need to remove info columns like @@UNIQUE_CONSTRAINTS@@ and @@INDEXES@@
+        frame.options.selectRaw = _.keys(_.omit(postsSchema, ['lexical','mobiledoc','@@INDEXES@@','@@UNIQUE_CONSTRAINTS@@'])).join(',');
     } else if (frame.options.columns) {
         frame.options.columns = frame.options.columns.filter((column) => {
             return !['mobiledoc', 'lexical'].includes(column);

package/core/server/api/endpoints/utils/serializers/output/authentication.js

@@ -4,7 +4,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output
 
 const messages = {
     checkEmailForInstructions: 'Check your email for further instructions.',
-    passwordChanged: 'Password changed successfully.',
+    passwordChanged: 'Password updated',
     invitationAccepted: 'Invitation accepted.'
 };
 

package/core/server/data/migrations/versions/5.87/2024-06-25-12-08-20-add-posts-tags-post-tag-index.js

@@ -0,0 +1,26 @@
+const logging = require('@tryghost/logging');
+const {createNonTransactionalMigration} = require('../../utils');
+const {addIndex, dropIndex} = require('../../../schema/commands');
+
+module.exports = createNonTransactionalMigration(
+    async function up(knex) {
+        await addIndex('posts_tags', ['post_id', 'tag_id'], knex);
+    },
+    async function down(knex) {
+        try {
+            await dropIndex('posts_tags', ['post_id', 'tag_id'], knex);
+        } catch (err) {
+            if (err.code === 'ER_DROP_INDEX_FK') {
+                logging.error({
+                    message: 'Error dropping index over posts_tags(post_id, tag_id), re-adding index for post_id'
+                });
+
+                await addIndex('posts_tags', ['post_id'], knex);
+                await dropIndex('posts_tags', ['post_id', 'tag_id'], knex);
+                return;
+            }
+
+            throw err;
+        }
+    }
+);

package/core/server/data/migrations/versions/5.87/2024-06-25-12-08-45-add-posts-type-status-updated-at-index.js

@@ -0,0 +1,4 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+const {createAddIndexMigration} = require('../../utils');
+
+module.exports = createAddIndexMigration('posts',['type','status','updated_at']);

package/core/server/data/schema/schema.js

@@ -93,6 +93,9 @@ module.exports = {
         canonical_url: {type: 'text', maxlength: 2000, nullable: true},
         newsletter_id: {type: 'string', maxlength: 24, nullable: true, references: 'newsletters.id'},
         show_title_and_feature_image: {type: 'boolean', nullable: false, defaultTo: true},
+        '@@INDEXES@@': [
+            ['type','status','updated_at']
+        ],
         '@@UNIQUE_CONSTRAINTS@@': [
             ['slug', 'type']
         ]
@@ -295,7 +298,10 @@ module.exports = {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         post_id: {type: 'string', maxlength: 24, nullable: false, references: 'posts.id'},
         tag_id: {type: 'string', maxlength: 24, nullable: false, references: 'tags.id'},
-        sort_order: {type: 'integer', nullable: false, unsigned: true, defaultTo: 0}
+        sort_order: {type: 'integer', nullable: false, unsigned: true, defaultTo: 0},
+        '@@INDEXES@@': [
+            ['post_id','tag_id']
+        ]
     },
     invites: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},

package/core/server/models/base/plugins/crud.js

@@ -120,6 +120,11 @@ module.exports = function (Bookshelf) {
                 });
             }
 
+            //option param to skip distinct from count query, distinct adds a lot of latency and in this case the result set will always be unique.
+            if (unfilteredOptions.useBasicCount) {
+                options.useBasicCount = unfilteredOptions.useBasicCount;
+            }
+
             const response = await itemCollection.fetchPage(options);
             // Attributes are being filtered here, so they are not leaked into calling layer
             // where models are serialized to json and do not do more filtering.

package/core/server/services/custom-redirects/validation.js

@@ -1,6 +1,7 @@
 const _ = require('lodash');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const {isSafePattern} = require('redos-detector');
 
 const messages = {
     redirectsWrongFormat: 'Incorrect redirects file format.',
@@ -33,18 +34,35 @@ const validate = (redirects) => {
         if (!redirect.from || !redirect.to) {
             throw new errors.ValidationError({
                 message: tpl(messages.redirectsWrongFormat),
-                context: redirect,
                 help: tpl(messages.redirectsHelp)
             });
         }
 
+        // Ensure valid regex
         try {
-            // each 'from' property should be a valid RegExp string
             new RegExp(redirect.from);
         } catch (error) {
             throw new errors.ValidationError({
                 message: tpl(messages.invalidRedirectsFromRegex),
-                context: redirect,
+                errorDetails: {
+                    redirect,
+                    invalid: true
+                },
+                help: tpl(messages.redirectsHelp)
+            });
+        }
+
+        // Ensure safe regex
+        const analysis = isSafePattern(redirect.from);
+
+        if (analysis.safe === false) {
+            throw new errors.ValidationError({
+                message: tpl(messages.invalidRedirectsFromRegex),
+                errorDetails: {
+                    redirect,
+                    unsafe: true,
+                    reason: analysis.error
+                },
                 help: tpl(messages.redirectsHelp)
             });
         }

package/core/server/services/webhooks/WebhookTrigger.js

@@ -87,6 +87,7 @@ class WebhookTrigger {
             const reqPayload = JSON.stringify(hookPayload);
             const url = webhook.get('target_url');
             const secret = webhook.get('secret') || '';
+            const ts = Date.now();
 
             const headers = {
                 'Content-Length': Buffer.byteLength(reqPayload),
@@ -95,7 +96,7 @@ class WebhookTrigger {
             };
 
             if (secret !== '') {
-                headers['X-Ghost-Signature'] = `sha256=${crypto.createHmac('sha256', secret).update(reqPayload).digest('hex')}, t=${Date.now()}`;
+                headers['X-Ghost-Signature'] = `sha256=${crypto.createHmac('sha256', secret).update(`${reqPayload}${ts}`).digest('hex')}, t=${ts}`;
             }
 
             const opts = {

package/core/server/web/parent/app.js

@@ -29,7 +29,7 @@ module.exports = function setupParentApp() {
     // Enable request queuing if configured
     const queueConfig = config.get('optimization:requestQueue');
 
-    if (queueConfig?.enabled === true) {
+    if (queueConfig) {
         parentApp.use(mw.queueRequest(queueConfig));
     }
 

package/core/shared/labs.js

@@ -24,8 +24,6 @@ const GA_FEATURES = [
     'listUnsubscribeHeader',
     'filterEmailDisabled',
     'newEmailAddresses',
-    'portalImprovements',
-    'newsletterExcerpt',
     'internalLinking'
 ];
 
@@ -45,7 +43,6 @@ const ALPHA_FEATURES = [
     'NestPlayground',
     'urlCache',
     'lexicalMultiplayer',
-    'websockets',
     'emailCustomization',
     'mailEvents',
     'collectionsCard',