ghost 6.33.0 → 6.34.0

package/core/server/lib/get-inbox-links.js

@@ -48,12 +48,16 @@ const buildUrl = (baseHref, key, value) => {
     result.searchParams.set(key, value);
     return result.toString();
 };
-const encodeRecipientForGmailUrl = (recipient) => (encodeURIComponent(recipient).replaceAll('%40', '@'));
 const PROVIDERS = [
     {
         name: 'gmail',
         domains: ['gmail.com', 'googlemail.com', 'google.com'],
-        getDesktopLink: ({ recipient, sender }) => (`https://mail.google.com/mail/u/${encodeRecipientForGmailUrl(recipient)}/#search/from%3A(${encodeURIComponent(sender)})+in%3Aanywhere+newer_than%3A1h`),
+        // Gmail's `/mail/u/<X>/` path expects a numeric account index. Passing a
+        // raw email only resolves when that account happens to be signed in at
+        // that slot; Workspace accounts and signed-out users hit a 404 before
+        // the `#search` fragment runs. `authuser` is Gmail's own account
+        // resolver and falls through to sign-in instead of erroring.
+        getDesktopLink: ({ recipient, sender }) => (`https://mail.google.com/mail/u/0/?authuser=${encodeURIComponent(recipient)}#search/from%3A(${encodeURIComponent(sender)})+in%3Aanywhere+newer_than%3A1h`),
         getAndroidLink: () => getAndroidIntentUrl('com.google.android.gm', 'https://mail.google.com/')
     },
     {

package/core/server/lib/get-inbox-links.ts

@@ -61,18 +61,19 @@ const buildUrl = (baseHref: string, key: string, value: string): string => {
     return result.toString();
 };
 
-const encodeRecipientForGmailUrl = (recipient: string) => (
-    encodeURIComponent(recipient).replaceAll('%40', '@')
-);
-
 const PROVIDERS: ReadonlyArray<Provider> = [
     {
         name: 'gmail',
         domains: ['gmail.com', 'googlemail.com', 'google.com'],
+        // Gmail's `/mail/u/<X>/` path expects a numeric account index. Passing a
+        // raw email only resolves when that account happens to be signed in at
+        // that slot; Workspace accounts and signed-out users hit a 404 before
+        // the `#search` fragment runs. `authuser` is Gmail's own account
+        // resolver and falls through to sign-in instead of erroring.
         getDesktopLink: ({recipient, sender}) => (
-            `https://mail.google.com/mail/u/${encodeRecipientForGmailUrl(
+            `https://mail.google.com/mail/u/0/?authuser=${encodeURIComponent(
                 recipient
-            )}/#search/from%3A(${encodeURIComponent(
+            )}#search/from%3A(${encodeURIComponent(
                 sender
             )})+in%3Aanywhere+newer_than%3A1h`
         ),

package/core/server/models/session.js

@@ -40,12 +40,13 @@ const Session = ghostBookshelf.Model.extend({
         }
         const options = this.filterOptions(unfilteredOptions, 'destroy');
 
-        // Fetch the object before destroying it, so that the changed data is available to events
+        // Fetch the object before destroying it, so that the changed data is available to events.
+        // A missing row is treated as success: password-change flows destroy
+        // every session for the user, then call req.session.regenerate(), which
+        // asks the store to destroy the same session_id a second time.
         return this.forge({session_id: options.session_id})
             .fetch(options)
-            .then((obj) => {
-                return obj.destroy(options);
-            });
+            .then(obj => obj?.destroy(options));
     },
 
     destroyAll() {

package/core/server/models/user.js

@@ -1056,7 +1056,6 @@ User = ghostBookshelf.Model.extend({
         const userId = object.user_id;
         const oldPassword = object.oldPassword;
         const isLoggedInUser = userId === options.context.user;
-        const skipSessionID = unfilteredOptions.skipSessionID;
 
         options.require = true;
         options.withRelated = ['sessions'];
@@ -1072,11 +1071,13 @@ User = ghostBookshelf.Model.extend({
 
         const updatedUser = await user.save({password: newPassword});
 
+        // Destroy every active session for this user. The caller must mint a
+        // fresh session (with a new session_id) for self password-changes so
+        // that stolen or cloned cookies are invalidated alongside distinct
+        // concurrent sessions.
         const sessions = user.related('sessions');
         for (const session of sessions) {
-            if (session.get('session_id') !== skipSessionID) {
-                await session.destroy(options);
-            }
+            await session.destroy(options);
         }
 
         return updatedUser;

package/core/server/services/auth/session/session-service.js

@@ -258,6 +258,34 @@ module.exports = function createSessionService({
         invalidateAuthCodeChallenge(session);
     }
 
+    /**
+     * rotateAndAssignVerifiedUserToSession
+     * Regenerates the Express session (issuing a new session_id) and then
+     * assigns the verified user to the new session. Used after a password
+     * change or reset so that any cloned or stolen copy of the pre-change
+     * cookie is rejected on its next request.
+     *
+     * @param {{req: Req, user: User, ip?: string}} options
+     * @returns {Promise<void>}
+     */
+    async function rotateAndAssignVerifiedUserToSession({req, user, ip}) {
+        await new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                resolve();
+            });
+        });
+        await assignVerifiedUserToSession({
+            session: req.session,
+            user,
+            origin: getOriginOfRequest(req),
+            ip
+        });
+    }
+
     /**
      * generateAuthCodeForUser
      *
@@ -494,6 +522,7 @@ module.exports = function createSessionService({
         createSessionForUser,
         createVerifiedSessionForUser,
         assignVerifiedUserToSession,
+        rotateAndAssignVerifiedUserToSession,
         removeUserForSession,
         verifySession,
         isVerifiedSession,

package/core/server/services/email-suppression-list/mailgun-email-suppression-list.js

@@ -117,31 +117,35 @@ class MailgunEmailSuppressionList extends AbstractEmailSuppressionList {
     async init() {
         this.Suppression = models.Suppression;
         const handleEvent = reason => async (event) => {
-            try {
-                if (reason === 'bounce') {
-                    if (!Number.isInteger(event.error?.code)) {
-                        return;
-                    }
-                    if (event.error.code !== 607 && event.error.code !== 605) {
-                        return;
-                    }
+            if (reason === 'bounce') {
+                if (!Number.isInteger(event.error?.code)) {
+                    return;
+                }
+                if (event.error.code !== 607 && event.error.code !== 605) {
+                    return;
                 }
+            }
+            try {
                 await this.Suppression.add({
                     email: event.email,
                     email_id: event.emailId,
                     reason: reason,
                     created_at: event.timestamp
                 });
-                DomainEvents.dispatch(EmailSuppressedEvent.create({
-                    emailAddress: event.email,
-                    emailId: event.emailId,
-                    reason: reason
-                }, event.timestamp));
             } catch (err) {
-                if (err.code !== 'ER_DUP_ENTRY') {
+                if (err.code !== 'ER_DUP_ENTRY' && err.code !== 'SQLITE_CONSTRAINT') {
                     logging.error(err);
+                    return;
                 }
+                // Suppression already exists — still dispatch so any drifted
+                // member state (e.g. email_disabled=false) gets corrected.
+                logging.info(`Re-dispatching EmailSuppressedEvent for existing suppression (${reason}): ${event.email}`);
             }
+            DomainEvents.dispatch(EmailSuppressedEvent.create({
+                emailAddress: event.email,
+                emailId: event.emailId,
+                reason: reason
+            }, event.timestamp));
         };
         DomainEvents.subscribe(EmailBouncedEvent, handleEvent('bounce'));
         DomainEvents.subscribe(SpamComplaintEvent, handleEvent('spam'));

package/core/server/services/gifts/gift-service-wrapper.js

@@ -16,6 +16,9 @@ class GiftServiceWrapper {
         const tiersService = require('../tiers');
         const staffService = require('../staff');
         const labsService = require('../../../shared/labs');
+        const DomainEvents = require('@tryghost/domain-events');
+        const logging = require('@tryghost/logging');
+        const {SubscriptionActivatedEvent} = require('../../../shared/events');
 
         const {GhostMailer} = require('../mail');
         const settingsCache = require('../../../shared/settings-cache');
@@ -53,6 +56,20 @@ class GiftServiceWrapper {
             tiersService,
             labsService: labsService
         });
+
+        DomainEvents.subscribe(SubscriptionActivatedEvent, async (event) => {
+            try {
+                const gift = await this.service.getActiveByMember(event.data.memberId);
+
+                if (!gift) {
+                    return;
+                }
+
+                await this.service.consume(gift.token);
+            } catch (err) {
+                logging.error(err, 'Failed to consume gift on paid subscription activation');
+            }
+        });
     }
 }
 

package/core/server/services/gifts/gift-service.js

@@ -237,6 +237,24 @@ class GiftService {
         });
         return true;
     }
+    async consume(token, options = {}) {
+        const run = async (transacting) => {
+            // Fetch with a row lock to prevent race conditions under concurrency
+            const gift = await this.deps.giftRepository.getByToken(token, { transacting, forUpdate: true });
+            if (!gift || gift.status !== 'redeemed') {
+                return null;
+            }
+            const consumed = gift.consume();
+            if (!consumed) {
+                return null;
+            }
+            await this.deps.giftRepository.update(consumed, { transacting });
+            return consumed;
+        };
+        return options.transacting
+            ? await run(options.transacting)
+            : await this.deps.giftRepository.transaction(run);
+    }
     async processConsumed() {
         const toConsume = await this.deps.giftRepository.findPendingConsumption();
         if (toConsume.length === 0) {
@@ -246,24 +264,18 @@ class GiftService {
         let updatedMemberCount = 0;
         for (const gift of toConsume) {
             await this.deps.giftRepository.transaction(async (transacting) => {
-                // Re-fetch with a row lock to prevent races with concurrent refunds
-                const locked = await this.deps.giftRepository.getByToken(gift.token, { transacting, forUpdate: true });
-                if (locked?.status !== 'redeemed') {
-                    return;
-                }
-                const consumed = locked.consume();
+                const consumed = await this.consume(gift.token, { transacting });
                 if (!consumed) {
                     return;
                 }
-                const member = await this.deps.memberRepository.get({ id: locked.redeemerMemberId }, { transacting, forUpdate: true });
+                const member = await this.deps.memberRepository.get({ id: consumed.redeemerMemberId }, { transacting, forUpdate: true });
                 if (member && member.get('status') === 'gift') {
                     await this.deps.memberRepository.update({
                         products: [],
                         status: 'free'
-                    }, { id: locked.redeemerMemberId, transacting });
+                    }, { id: consumed.redeemerMemberId, transacting });
                     updatedMemberCount += 1;
                 }
-                await this.deps.giftRepository.update(consumed, { transacting });
                 consumedCount += 1;
             });
         }

package/core/server/services/gifts/gift-service.ts

@@ -383,6 +383,31 @@ export class GiftService {
         return true;
     }
 
+    async consume(token: string, options: {transacting?: unknown} = {}): Promise<Gift | null> {
+        const run = async (transacting: unknown) => {
+            // Fetch with a row lock to prevent race conditions under concurrency
+            const gift = await this.deps.giftRepository.getByToken(token, {transacting, forUpdate: true});
+
+            if (!gift || gift.status !== 'redeemed') {
+                return null;
+            }
+
+            const consumed = gift.consume();
+
+            if (!consumed) {
+                return null;
+            }
+
+            await this.deps.giftRepository.update(consumed, {transacting});
+
+            return consumed;
+        };
+
+        return options.transacting
+            ? await run(options.transacting)
+            : await this.deps.giftRepository.transaction(run);
+    }
+
     async processConsumed(): Promise<{consumedCount: number; updatedMemberCount: number}> {
         const toConsume = await this.deps.giftRepository.findPendingConsumption();
 
@@ -395,32 +420,23 @@ export class GiftService {
 
         for (const gift of toConsume) {
             await this.deps.giftRepository.transaction(async (transacting) => {
-                // Re-fetch with a row lock to prevent races with concurrent refunds
-                const locked = await this.deps.giftRepository.getByToken(gift.token, {transacting, forUpdate: true});
-
-                if (locked?.status !== 'redeemed') {
-                    return;
-                }
-
-                const consumed = locked.consume();
+                const consumed = await this.consume(gift.token, {transacting});
 
                 if (!consumed) {
                     return;
                 }
 
-                const member = await this.deps.memberRepository.get({id: locked.redeemerMemberId}, {transacting, forUpdate: true});
+                const member = await this.deps.memberRepository.get({id: consumed.redeemerMemberId}, {transacting, forUpdate: true});
 
                 if (member && member.get('status') === 'gift') {
                     await this.deps.memberRepository.update({
                         products: [],
                         status: 'free'
-                    }, {id: locked.redeemerMemberId, transacting});
+                    }, {id: consumed.redeemerMemberId, transacting});
 
                     updatedMemberCount += 1;
                 }
 
-                await this.deps.giftRepository.update(consumed, {transacting});
-
                 consumedCount += 1;
             });
         }

package/core/server/services/members/members-api/services/geolocation-service.js

@@ -22,6 +22,10 @@ module.exports = class GeolocationService {
 
         const geojsUrl = `https://get.geojs.io/v1/ip/geo/${encodeURIComponent(ipAddress)}.json`;
         const response = await got(geojsUrl, gotOpts).json();
-        return response;
+        return {
+            country: response.country,
+            country_code: response.country_code,
+            region: response.region
+        };
     }
 };

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -360,6 +360,11 @@ module.exports = class MemberBREADService {
         let model;
 
         try {
+            if (data.email && data.email_disabled === undefined) {
+                const isSuppressed = (await this.emailSuppressionList.getSuppressionData(data.email))?.suppressed;
+                data.email_disabled = !!isSuppressed;
+            }
+
             const attribution = await this.memberAttributionService.getAttributionFromContext(options?.context);
             if (attribution) {
                 data.attribution = attribution;

package/core/server/services/oembed/oembed-service.js

@@ -444,6 +444,18 @@ class OEmbedService {
                     return;
                 }
 
+                // `rich` and `video` responses ship provider-supplied HTML that gets
+                // stored in the post's Lexical payload and rendered into the admin
+                // editor preview (via srcdoc) and into public themes (via innerHTML).
+                // Known providers (YouTube, Twitter, etc.) go through `knownProvider`
+                // with @extractus/oembed-extractor's allowlist — anything reaching
+                // here is an arbitrary site's self-declared oEmbed endpoint, which we
+                // must not trust. Drop the response and let the caller fall back to
+                // a bookmark card.
+                if (oembed.type === 'video' || oembed.type === 'rich') {
+                    return;
+                }
+
                 // return the extracted object, don't pass through the response body
                 return oembed;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.33.0",
+  "version": "6.34.0",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",