ghost 5.87.1 → 5.87.3

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.87%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2247bfbf88f0%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%229c49d06c68%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2236ec618662%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%22b147b1abae%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.87%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2208854be47b%22%2C%22adminXDemoFilename%22%3A%22admin-x-demo.js%22%2C%22adminXDemoHash%22%3A%220539de3930%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22e8dff6adeb%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%22a94b140a1a%22%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-0ede59da8efb5e28fa929557f7ff7154.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-cc31d867156dbb76ec96cdd93bd39d36.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-cb98187b163a0d8b42d752ab890e039a.css" title="light">
 
     
 </head>
@@ -56,9 +56,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-4e0f92ca2b1c0850606b912c70852e32.js"></script>
-<script src="assets/chunk.42.167fc5e3f3a1c1088f2e.js"></script>
-<script src="assets/chunk.524.a032fbf6d6bbe20b0eb3.js"></script>
-    <script src="assets/ghost-b645099f33022aa37d96a2be8d8ddad1.js"></script>
+    <script src="assets/vendor-051d43ec47258b77ffd2fcc21a6d8c50.js"></script>
+<script src="assets/chunk.42.0879e40a4de3db25b177.js"></script>
+<script src="assets/chunk.524.036bdde7e8805a7ab0a7.js"></script>
+    <script src="assets/ghost-07422c98448d7259d957d65c6737a274.js"></script>
 </body>
 </html>

package/core/frontend/services/routing/controllers/unsubscribe.js

@@ -2,7 +2,6 @@ const debug = require('@tryghost/debug')('services:routing:controllers:unsubscri
 const url = require('url');
 const members = require('../../../../server/services/members');
 const urlUtils = require('../../../../shared/url-utils');
-const labs = require('../../../../shared/labs');
 const logging = require('@tryghost/logging');
 
 module.exports = async function unsubscribeController(req, res) {
@@ -15,7 +14,7 @@ module.exports = async function unsubscribeController(req, res) {
         return res.end('Email address not found.');
     }
 
-    if (req.method === 'POST' && labs.isSet('listUnsubscribeHeader')) {
+    if (req.method === 'POST') {
         logging.info('[List-Unsubscribe] Received POST unsubscribe for ' + query.uuid + ', newsletter: ' + (query.newsletter ?? 'null') + ', comments: ' + (query.comments ?? 'false'));
 
         // Do an actual unsubscribe

package/core/frontend/src/cards/css/bookmark.css

@@ -17,7 +17,7 @@
     border-radius: 6px;
     border: 1px solid rgb(124 139 154 / 25%);
     overflow: hidden;
-    color: inherit;
+    color: #222;
 }
 
 .kg-bookmark-content {

package/core/frontend/src/member-attribution/member-attribution.js

@@ -76,6 +76,8 @@ const LIMIT = 15;
         let sourceParam;
         let utmSourceParam;
         let utmMediumParam;
+        let referrerSource;
+
         try {
             // Fetch source/medium from query param
             const url = new URL(window.location.href);
@@ -83,11 +85,23 @@ const LIMIT = 15;
             sourceParam = url.searchParams.get('source');
             utmSourceParam = url.searchParams.get('utm_source');
             utmMediumParam = url.searchParams.get('utm_medium');
+
+            referrerSource = refParam || sourceParam || utmSourceParam || null;
+
+            // if referrerSource is not set, check to see if the url contains a hash like ghost.org/#/portal/signup?ref=ghost and pull the ref from the hash
+            if (!referrerSource && url.hash && url.hash.includes('#/portal')) {
+                const hashUrl = new URL(window.location.href.replace('/#/portal', ''));
+                refParam = hashUrl.searchParams.get('ref');
+                sourceParam = hashUrl.searchParams.get('source');
+                utmSourceParam = hashUrl.searchParams.get('utm_source');
+                utmMediumParam = hashUrl.searchParams.get('utm_medium');
+    
+                referrerSource = refParam || sourceParam || utmSourceParam || null;
+            }
         } catch (e) {
             console.error('[Member Attribution] Parsing referrer from querystring failed', e);
         }
 
-        const referrerSource = refParam || sourceParam || utmSourceParam || null;
         const referrerMedium = utmMediumParam || null;
         const referrerUrl = window.document.referrer || null;
 

package/core/server/data/importer/importers/data/ProductsImporter.js

@@ -122,8 +122,26 @@ class ProductsImporter extends BaseImporter {
         this.dataToImport = this.dataToImport.filter(item => !duplicateProducts.includes(item.id));
     }
 
+    preventInvalidFree() {
+        let invalidFreeProducts = [];
+        _.each(this.dataToImport, (product) => {
+            // A free product must not have any pricing data (otherwise it wouldn't be free, duh!)
+            if (product.type === 'free' && product.currency && product.monthly_price && product.yearly_price) {
+                this.problems.push({
+                    message: 'Entry was not imported and ignored. Detected invalid entry.',
+                    help: this.modelName,
+                    context: JSON.stringify({product})
+                });
+                invalidFreeProducts.push(product.id);
+            }
+        });
+        // ignore invalid free products
+        this.dataToImport = this.dataToImport.filter(item => !invalidFreeProducts.includes(item.id));
+    }
+
     beforeImport() {
         this.populatePriceData();
+        this.preventInvalidFree();
         return super.beforeImport();
     }
 

package/core/server/lib/image/ImageSize.js

@@ -1,6 +1,6 @@
 const debug = require('@tryghost/debug')('utils:image-size');
 const sizeOf = require('image-size');
-const probeSizeOf = require('probe-image-size');
+
 const url = require('url');
 const path = require('path');
 const _ = require('lodash');
@@ -17,13 +17,14 @@ const FETCH_ONLY_FORMATS = [
 ];
 
 class ImageSize {
-    constructor({config, storage, storageUtils, validator, urlUtils, request}) {
+    constructor({config, storage, storageUtils, validator, urlUtils, request, probe}) {
         this.config = config;
         this.storage = storage;
         this.storageUtils = storageUtils;
         this.validator = validator;
         this.urlUtils = urlUtils;
         this.request = request;
+        this.probe = probe;
 
         this.REQUEST_OPTIONS = {
             // we need the user-agent, otherwise some https request may fail (e.g. cloudfare)
@@ -82,7 +83,18 @@ class ImageSize {
             }));
         }
 
-        return probeSizeOf(imageUrl, this.NEEDLE_OPTIONS);
+        // wrap probe-image-size in a promise in case it is unresponsive/the timeout itself doesn't work
+        return (Promise.race([
+            this.probe(imageUrl, this.NEEDLE_OPTIONS),
+            new Promise((res, rej) => {
+                setTimeout(() => {
+                    rej(new errors.InternalServerError({
+                        message: 'Probe unresponsive.',
+                        code: 'IMAGE_SIZE_URL'
+                    }));
+                }, this.NEEDLE_OPTIONS.response_timeout);
+            })
+        ]));
     }
 
     // download full image then use image-size to get it's dimensions

package/core/server/lib/image/ImageUtils.js

@@ -2,11 +2,12 @@ const BlogIcon = require('./BlogIcon');
 const CachedImageSizeFromUrl = require('./CachedImageSizeFromUrl');
 const Gravatar = require('./Gravatar');
 const ImageSize = require('./ImageSize');
+const probe = require('probe-image-size');
 
 class ImageUtils {
     constructor({config, urlUtils, settingsCache, storageUtils, storage, validator, request, cacheStore}) {
         this.blogIcon = new BlogIcon({config, urlUtils, settingsCache, storageUtils});
-        this.imageSize = new ImageSize({config, storage, storageUtils, validator, urlUtils, request});
+        this.imageSize = new ImageSize({config, storage, storageUtils, validator, urlUtils, request, probe});
         this.cachedImageSizeFromUrl = new CachedImageSizeFromUrl({
             getImageSizeFromUrl: this.imageSize.getImageSizeFromUrl.bind(this.imageSize),
             cache: cacheStore

package/core/server/services/custom-redirects/CustomRedirectsAPI.js

@@ -211,6 +211,9 @@ class CustomRedirectsAPI {
      */
     async setFromFilePath(filePath, ext = '.json') {
         const redirectsFilePath = await this.getRedirectsFilePath();
+        const content = await readRedirectsFile(filePath);
+        const parsed = parseRedirectsFile(content, ext);
+        this.validate(parsed);
 
         if (redirectsFilePath) {
             const backupRedirectsPath = this.getBackupFilePath(redirectsFilePath);
@@ -223,10 +226,6 @@ class CustomRedirectsAPI {
             await fs.move(redirectsFilePath, backupRedirectsPath);
         }
 
-        const content = await readRedirectsFile(filePath);
-        const parsed = parseRedirectsFile(content, ext);
-        this.validate(parsed);
-
         if (ext === '.json') {
             await fs.writeFile(this.createRedirectsFilePath('.json'), JSON.stringify(parsed), 'utf-8');
         } else if (ext === '.yaml') {

package/core/server/services/custom-redirects/validation.js

@@ -1,7 +1,6 @@
 const _ = require('lodash');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
-const {isSafePattern} = require('redos-detector');
 
 const messages = {
     redirectsWrongFormat: 'Incorrect redirects file format.',
@@ -34,35 +33,18 @@ const validate = (redirects) => {
         if (!redirect.from || !redirect.to) {
             throw new errors.ValidationError({
                 message: tpl(messages.redirectsWrongFormat),
+                context: redirect,
                 help: tpl(messages.redirectsHelp)
             });
         }
 
-        // Ensure valid regex
         try {
+            // each 'from' property should be a valid RegExp string
             new RegExp(redirect.from);
         } catch (error) {
             throw new errors.ValidationError({
                 message: tpl(messages.invalidRedirectsFromRegex),
-                errorDetails: {
-                    redirect,
-                    invalid: true
-                },
-                help: tpl(messages.redirectsHelp)
-            });
-        }
-
-        // Ensure safe regex
-        const analysis = isSafePattern(redirect.from);
-
-        if (analysis.safe === false) {
-            throw new errors.ValidationError({
-                message: tpl(messages.invalidRedirectsFromRegex),
-                errorDetails: {
-                    redirect,
-                    unsafe: true,
-                    reason: analysis.error
-                },
+                context: redirect,
                 help: tpl(messages.redirectsHelp)
             });
         }

package/core/server/services/recommendations/RecommendationServiceWrapper.js

@@ -43,7 +43,6 @@ class RecommendationServiceWrapper {
             return;
         }
 
-        const labs = require('../../../shared/labs');
         const config = require('../../../shared/config');
         const urlUtils = require('../../../shared/url-utils');
         const models = require('../../models');
@@ -146,10 +145,8 @@ class RecommendationServiceWrapper {
             service: this.incomingRecommendationService
         });
 
-        if (labs.isSet('recommendations')) {
-            this.service.init().catch(logging.error);
-            this.incomingRecommendationService.init().catch(logging.error);
-        }
+        this.service.init().catch(logging.error);
+        this.incomingRecommendationService.init().catch(logging.error);
 
         const PATH_SUFFIX = '/.well-known/recommendations.json';
 
@@ -169,12 +166,10 @@ class RecommendationServiceWrapper {
 
         // Listen for incoming webmentions
         DomainEvents.subscribe(MentionCreatedEvent, async (event) => {
-            if (labs.isSet('recommendations')) {
-                // Check if this is a recommendation
-                if (event.data.mention.verified && isRecommendationUrl(event.data.mention.source)) {
-                    logging.info('[INCOMING RECOMMENDATION] Received recommendation from ' + event.data.mention.source);
-                    await this.incomingRecommendationService.sendRecommendationEmail(event.data.mention);
-                }
+            // Check if this is a recommendation
+            if (event.data.mention.verified && isRecommendationUrl(event.data.mention.source)) {
+                logging.info('[INCOMING RECOMMENDATION] Received recommendation from ' + event.data.mention.source);
+                await this.incomingRecommendationService.sendRecommendationEmail(event.data.mention);
             }
         });
     }

package/core/shared/labs.js

@@ -19,10 +19,6 @@ const GA_FEATURES = [
     'themeErrorsNotification',
     'outboundLinkTagging',
     'announcementBar',
-    'signupForm',
-    'recommendations',
-    'listUnsubscribeHeader',
-    'filterEmailDisabled',
     'newEmailAddresses',
     'internalLinking'
 ];