ghost 6.53.0 → 6.54.1

package/core/server/adapters/storage/LocalStorageBase.ts

@@ -0,0 +1,342 @@
+// # Local File Base Storage module
+// The (default) module for storing files using the local file system
+import fs from 'fs-extra';
+import path from 'path';
+import type {NextFunction, Request, RequestHandler, Response} from 'express';
+import type express from 'express';
+import tpl from '@tryghost/tpl';
+import errors from '@tryghost/errors';
+import {StorageBase, type ReadOptions, type StorageFile} from 'ghost-storage-base';
+import urlUtils from '../../../shared/url-utils';
+import {errify} from '../../../shared/errify';
+
+const serveStatic: typeof express.static = require('../../../shared/express').static;
+
+const messages = {
+    notFound: 'File not found',
+    notFoundWithRef: 'File not found: {file}',
+    cannotRead: 'Could not read file: {file}',
+    invalidUrlParameter: `The URL "{url}" is not a valid URL for this site.`,
+    invalidPathParameter: 'The path "{path}" is not valid for this storage.'
+};
+
+export interface LocalStorageBaseErrorMessages {
+    notFound: string;
+    notFoundWithRef: string;
+    cannotRead: string;
+}
+
+export interface LocalStorageBaseOptions {
+    storagePath: string;
+    siteUrl?: string;
+    staticFileURLPrefix?: string;
+    errorMessages?: LocalStorageBaseErrorMessages;
+}
+
+/**
+ * Errors thrown by `serve-static` carry an HTTP status alongside the standard
+ * Error fields.
+ */
+interface ServeStaticError extends Error {
+    statusCode?: number;
+    path?: string;
+}
+
+class LocalStorageBase extends StorageBase {
+    readonly staticFileURLPrefix: string | undefined;
+
+    readonly siteUrl: string | undefined;
+
+    readonly staticFileUrl: string;
+
+    readonly errorMessages: LocalStorageBaseErrorMessages;
+
+    constructor({storagePath, staticFileURLPrefix, siteUrl, errorMessages}: LocalStorageBaseOptions) {
+        super();
+
+        this.storagePath = storagePath;
+        this.staticFileURLPrefix = staticFileURLPrefix;
+        this.siteUrl = siteUrl;
+        this.staticFileUrl = `${siteUrl}${staticFileURLPrefix}`;
+        this.errorMessages = errorMessages || messages;
+    }
+
+    /**
+     * Normalizes a relative storage path and rejects traversal outside the storage root.
+     */
+    _normalizeStorageRelativePath(filePath?: string): string {
+        const normalized = path.posix.normalize(String(filePath || '')
+            .replaceAll('\\', '/')
+            .replace(/^\/+/, '')
+            .replace(/\/+$/, ''));
+
+        if (normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: filePath})
+            });
+        }
+
+        return normalized;
+    }
+
+    /**
+     * Resolves a target directory and optional file name into a full path,
+     * validating the result is inside the storage root.
+     *
+     * Supports relative paths (preferred) and absolute paths (legacy).
+     * TODO: remove absolute path support once all callers pass relative paths
+     *
+     * @param targetDir absolute or relative directory
+     * @param fileName file name to normalize and append
+     * @returns resolved absolute path inside storagePath
+     */
+    _resolveAndValidateStoragePath(targetDir?: string, fileName?: string): string {
+        const resolvedRoot = path.resolve(this.storagePath);
+
+        // Resolve targetDir: if already inside storage root use as-is, otherwise treat as relative
+        let resolvedBase;
+        if (targetDir) {
+            const resolvedTargetDir = path.resolve(targetDir);
+            const relToRoot = path.relative(resolvedRoot, resolvedTargetDir);
+            if (relToRoot === '' || (!relToRoot.startsWith('..') && !path.isAbsolute(relToRoot))) {
+                resolvedBase = resolvedTargetDir;
+            } else {
+                resolvedBase = path.resolve(this.storagePath, targetDir);
+            }
+        } else {
+            resolvedBase = resolvedRoot;
+        }
+
+        // If fileName provided, normalize and resolve
+        let resolvedPath;
+        if (fileName) {
+            const normalizedFileName = this._normalizeStorageRelativePath(fileName);
+            resolvedPath = path.resolve(resolvedBase, normalizedFileName);
+        } else {
+            resolvedPath = resolvedBase;
+        }
+
+        // Validate the resolved path is strictly inside the storage root (not equal to it)
+        const relative = path.relative(resolvedRoot, resolvedPath);
+        if (relative === '' || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: fileName || targetDir || ''})
+            });
+        }
+
+        return resolvedPath;
+    }
+
+    /**
+     * Saves the file to storage (the file system)
+     * - returns a promise which ultimately returns the full url to the uploaded file
+     */
+    async save(file: StorageFile, targetDir?: string): Promise<string> {
+        let targetFilename;
+
+        targetDir = targetDir
+            ? this._resolveAndValidateStoragePath(targetDir)
+            : this.getTargetDir(this.storagePath);
+
+        const filename = await this.getUniqueFileName(file, targetDir);
+
+        targetFilename = filename;
+
+        // Verify that we are saving directly under `targetDir` and not outside of it.
+        const expectedPrefix = path.join(path.resolve(targetDir), '/');
+        if (!path.resolve(targetFilename).startsWith(expectedPrefix)) {
+            throw new errors.BadRequestError({message: 'Cannot save to the given filename'});
+        }
+
+        await fs.mkdirs(targetDir);
+
+        try {
+            await fs.copy(file.path, targetFilename);
+        } catch (err) {
+            if ((err as NodeJS.ErrnoException).code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: errify(err)});
+            }
+
+            throw err;
+        }
+
+        // The src for the image must be in URI format, not a file system path, which in Windows uses \
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/',
+                urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                path.relative(this.storagePath, targetFilename))
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * Saves a buffer in the targetPath
+     *
+     * @param buffer is an instance of Buffer
+     * @param targetPath relative path NOT including storage path to which the buffer should be written
+     * @returns a URL to retrieve the data
+     */
+    async saveRaw(buffer: Buffer, targetPath: string): Promise<string> {
+        const storagePath = path.join(this.storagePath, this._normalizeStorageRelativePath(targetPath));
+        const targetDir = path.dirname(storagePath);
+
+        await fs.mkdirs(targetDir);
+        await fs.writeFile(storagePath, buffer);
+
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/', urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                targetPath)
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * @param url full url under which the stored content is served, result of save method
+     * @returns relative path under which the content is stored
+     */
+    urlToPath(url: string): string {
+        let relativePath;
+
+        const prefix = urlUtils.urlJoin('/',
+            urlUtils.getSubdir(),
+            this.staticFileURLPrefix as string
+        );
+
+        if (url.startsWith(this.staticFileUrl)) {
+            // CASE: full path that includes the site url
+            relativePath = url.replace(this.staticFileUrl, '');
+        } else if (url.startsWith(prefix)) {
+            // CASE: The result of the save method doesn't include the site url. So we need to handle this case.
+            relativePath = url.replace(prefix, '');
+        } else {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+
+        try {
+            return this._normalizeStorageRelativePath(relativePath);
+        } catch (err) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+    }
+
+    async exists(fileName: string, targetDir?: string): Promise<boolean> {
+        let filePath;
+
+        try {
+            filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        } catch (err) {
+            if (err instanceof errors.IncorrectUsageError) {
+                return false;
+            }
+
+            throw err;
+        }
+
+        try {
+            await fs.stat(filePath);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * For some reason send divides the max age number by 1000
+     * Fallthrough: false ensures that if an image isn't found, it automatically 404s
+     * Wrap server static errors
+     */
+    serve(): RequestHandler {
+        const {storagePath, errorMessages} = this;
+
+        return function serveStaticContent(req: Request, res: Response, next: NextFunction) {
+            return serveStatic(
+                storagePath,
+                {
+                    maxAge: (365 * 24 * 60 * 60 * 1000), // 1 year in ms
+                    fallthrough: false
+                }
+            )(req, res, (err?: ServeStaticError) => {
+                if (err) {
+                    if (err.statusCode === 404) {
+                        return next(new errors.NotFoundError({
+                            message: tpl(errorMessages.notFound),
+                            code: 'STATIC_FILE_NOT_FOUND',
+                            property: err.path
+                        }));
+                    }
+
+                    if (err.statusCode === 400) {
+                        return next(new errors.BadRequestError({err: err}));
+                    }
+
+                    if (err.statusCode === 403) {
+                        return next(new errors.NoPermissionError({err: err}));
+                    }
+
+                    if (err.name === 'RangeNotSatisfiableError') {
+                        return next(new errors.RangeNotSatisfiableError({err}));
+                    }
+
+                    return next(new errors.InternalServerError({err: err}));
+                }
+
+                next();
+            });
+        };
+    }
+
+    async delete(fileName: string, targetDir?: string): Promise<void> {
+        const filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        return await fs.remove(filePath);
+    }
+
+    /**
+     * Reads bytes from disk for a target file
+     * - path of target file (without content path!)
+     */
+    async read(options?: Partial<ReadOptions>): Promise<Buffer> {
+        options = options || {};
+
+        const normalizedPath = this._normalizeStorageRelativePath(options.path);
+        const targetPath = path.join(this.storagePath, normalizedPath);
+
+        try {
+            return await fs.readFile(targetPath);
+        } catch (rawError) {
+            const err = errify(rawError);
+            const code = (rawError as NodeJS.ErrnoException).code;
+
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                throw new errors.NotFoundError({
+                    err: err,
+                    message: tpl(this.errorMessages.notFoundWithRef, {file: options.path})
+                });
+            }
+
+            if (code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: err});
+            }
+
+            if (code === 'EACCES') {
+                throw new errors.NoPermissionError({err: err});
+            }
+
+            throw new errors.InternalServerError({
+                err: err,
+                message: tpl(this.errorMessages.cannotRead, {file: options.path})
+            });
+        }
+    }
+}
+
+export default LocalStorageBase;

package/core/server/adapters/storage/S3Storage.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const zod_1 = require("zod");
-const ghost_storage_base_1 = __importDefault(require("ghost-storage-base"));
+const ghost_storage_base_1 = require("ghost-storage-base");
 const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
@@ -81,7 +81,7 @@ const configSchema = zod_1.z.object({
     const hasCredentialPair = hasAccessKey && hasSecretKey;
     return !((hasAccessKey || hasSecretKey || hasSessionToken) && !hasCredentialPair);
 }, { error: (0, tpl_1.default)(messages.partialCredentials) });
-class S3Storage extends ghost_storage_base_1.default {
+class S3Storage extends ghost_storage_base_1.StorageBase {
     client;
     bucket;
     tenantPrefix;

package/core/server/adapters/storage/S3Storage.ts

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import type {Request, Response, NextFunction, RequestHandler} from 'express';
 import {z} from 'zod';
-import StorageBase from 'ghost-storage-base';
+import {StorageBase} from 'ghost-storage-base';
 import tpl from '@tryghost/tpl';
 import errors from '@tryghost/errors';
 import logging from '@tryghost/logging';

package/core/server/adapters/storage/utils.js

@@ -1,68 +1,54 @@
-const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils');
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalImagesStoragePath = getLocalImagesStoragePath;
+exports.isLocalImage = isLocalImage;
+exports.isInternalImage = isInternalImage;
+const config_1 = __importDefault(require("../../../shared/config"));
+const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
 /**
  * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
  */
-
 /**
- * Sanitizes a given URL or path for an image to be readable by the local file storage
- * as storage needs the path without `/content/images/` prefix
- * Always returns {string} url
- * @param {string} imagePath
- * @returns {string} imagePath
- * @description Takes a url or filepath and returns a filepath with is readable
- * for the local file storage.
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
  */
-exports.getLocalImagesStoragePath = function getLocalImagesStoragePath(imagePath) {
+function getLocalImagesStoragePath(imagePath) {
     // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
-    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.urlFor('home', true),
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
-    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
+    const urlRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.urlFor('home', true), url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
+    const filePathRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
     if (imagePath.match(urlRegExp)) {
         return imagePath.replace(urlRegExp, '');
-    } else if (imagePath.match(filePathRegExp)) {
+    }
+    else if (imagePath.match(filePathRegExp)) {
         return imagePath.replace(filePathRegExp, '');
-    } else {
+    }
+    else {
         return imagePath;
     }
-};
-
+}
 /**
- * @description compares the imagePath with a regex that reflects our local file storage
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
  */
-
-exports.isLocalImage = function isLocalImage(imagePath) {
-    const localImagePath = this.getLocalImagesStoragePath(imagePath);
-
-    if (localImagePath !== imagePath) {
-        return true;
-    } else {
-        return false;
-    }
-};
-
+function isLocalImage(imagePath) {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
 /**
- * @description Checks whether the image is managed by Ghost storage (local or CDN)
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
  */
-exports.isInternalImage = function isInternalImage(imagePath) {
-    if (this.isLocalImage(imagePath)) {
+function isInternalImage(imagePath) {
+    if (isLocalImage(imagePath)) {
         return true;
     }
-
-    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    const imageBaseUrl = (config_1.default.get('urls:image') || '').replace(/\/+$/, '');
     return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
-};
+}

package/core/server/adapters/storage/utils.ts

@@ -0,0 +1,60 @@
+import config from '../../../shared/config';
+import urlUtils from '../../../shared/url-utils';
+
+/**
+ * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
+ */
+
+/**
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
+ */
+export function getLocalImagesStoragePath(imagePath: string): string {
+    // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
+    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.urlFor('home', true),
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    if (imagePath.match(urlRegExp)) {
+        return imagePath.replace(urlRegExp, '');
+    } else if (imagePath.match(filePathRegExp)) {
+        return imagePath.replace(filePathRegExp, '');
+    } else {
+        return imagePath;
+    }
+}
+
+/**
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isLocalImage(imagePath: string): boolean {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
+
+/**
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isInternalImage(imagePath: string): boolean {
+    if (isLocalImage(imagePath)) {
+        return true;
+    }
+
+    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
+}

package/core/server/api/endpoints/authentication.js

@@ -12,7 +12,7 @@ const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const UsersService = require('../../services/users');
 const userService = new UsersService({dbBackup, models, auth, apiMail, apiSettings});
-const adapterManager = require('../../services/adapter-manager');
+const adapterManager = require('../../services/adapter-manager').default;
 const schedulerAdapter = adapterManager.getAdapter('scheduling');
 
 async function destroyRequestSession(req) {

package/core/server/api/endpoints/db.js

@@ -1,4 +1,5 @@
 const moment = require('moment-timezone');
+const path = require('path');
 const dbBackup = require('../../data/db/backup');
 const exporter = require('../../data/exporter');
 const importer = require('../../data/importer');
@@ -29,6 +30,11 @@ const controller = {
             }
         },
         query(frame) {
+            const filename = frame.options.filename;
+            if (filename && path.basename(filename) !== filename) {
+                throw new errors.ValidationError({message: 'Export filename must not contain path separators'});
+            }
+
             // NOTE: we need to have `include` property available as backupDatabase uses it internally
             Object.assign(frame.options, {include: frame.options.withRelated});
 

package/core/server/api/endpoints/featurebase.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const errors = require('@tryghost/errors');
 const config = require('../../../shared/config');
 const settingsCache = require('../../../shared/settings-cache');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 
 function generateJWTToken(frame) {
     const userData = {

package/core/server/api/endpoints/files.js

@@ -1,5 +1,5 @@
-const storage = require('../../adapters/storage');
 const {getStorageContentType} = require('../../services/files/file-type-utils');
+const adapterManager = require('../../services/adapter-manager').default;
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +11,7 @@ const controller = {
         },
         permissions: false,
         async query(frame) {
-            const filePath = await storage.getStorage('files').save({
+            const filePath = await adapterManager.getAdapter('storage:files').save({
                 name: frame.file.originalname,
                 path: frame.file.path,
                 type: getStorageContentType(frame.file.originalname)

package/core/server/api/endpoints/images.js

@@ -3,7 +3,7 @@ const path = require('path');
 const errors = require('@tryghost/errors');
 const imageTransform = require('@tryghost/image-transform');
 
-const storage = require('../../adapters/storage');
+const adapterManager = require('../../services/adapter-manager').default;
 const config = require('../../../shared/config');
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -16,7 +16,7 @@ const controller = {
         },
         permissions: false,
         async query(frame) {
-            const store = storage.getStorage('images');
+            const store = adapterManager.getAdapter('storage:images');
 
             // Normalize
             const imageOptimizationOptions = config.get('imageOptimization');

package/core/server/api/endpoints/libraries.d.ts

@@ -1,3 +1,2 @@
 // Type declarations for untyped modules used by TypeScript endpoints
 declare module '@tryghost/api-framework';
-declare module '@tryghost/tpl';

package/core/server/api/endpoints/media.js

@@ -1,5 +1,6 @@
 const path = require('path');
-const storage = require('../../adapters/storage');
+
+const adapterManager = require('../../services/adapter-manager').default;
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,12 +12,14 @@ const controller = {
         },
         permissions: false,
         async query(frame) {
+            const storage = adapterManager.getAdapter('storage:media');
+
             let thumbnailPath = null;
             if (frame.files.thumbnail && frame.files.thumbnail[0]) {
-                thumbnailPath = await storage.getStorage('media').save(frame.files.thumbnail[0]);
+                thumbnailPath = await storage.save(frame.files.thumbnail[0]);
             }
 
-            const filePath = await storage.getStorage('media').save(frame.files.file[0]);
+            const filePath = await storage.save(frame.files.file[0]);
 
             return {
                 filePath,
@@ -35,12 +38,12 @@ const controller = {
             'ref'
         ],
         async query(frame) {
-            const mediaStorage = storage.getStorage('media');
+            const mediaStorage = adapterManager.getAdapter('storage:media');
             const targetDir = path.dirname(mediaStorage.urlToPath(frame.data.url));
 
             // NOTE: need to cleanup otherwise the parent media name won't match thumb name
             //       due to "unique name" generation during save
-            if (mediaStorage.exists(frame.file.name, targetDir)) {
+            if (await mediaStorage.exists(frame.file.name, targetDir)) {
                 await mediaStorage.delete(frame.file.name, targetDir);
             }
 

package/core/server/api/endpoints/member-custom-fields.js

@@ -53,8 +53,11 @@ const controller = {
         permissions(frame) {
             return canThis(frame).add.member_custom_field();
         },
+        // The whole array is passed through: create is a batch, applied
+        // all-or-nothing. A client sending a single definition (as Admin does)
+        // is just the one-item case and sees no change.
         query(frame) {
-            return members_custom_fields_1.definitions.add(requestContextFromFrame(frame), frame.data.members_custom_fields[0]);
+            return members_custom_fields_1.definitions.add(requestContextFromFrame(frame), frame.data.members_custom_fields);
         }
     },
     edit: {