ghost 6.53.0 → 6.54.1

package/core/server/api/endpoints/utils/validators/input/members.js

@@ -1,56 +1,6 @@
-const errors = require('@tryghost/errors');
 const jsonSchema = require('../utils/json-schema');
-const labs = require('../../../../../../shared/labs');
-
-// The members JSON schemas live in @tryghost/admin-api-schema and set
-// `additionalProperties: false`, so ajv strips `custom_fields` out of the body
-// before it reaches the service — silently, with no error to explain where the
-// values went. Stash the key across validation and restore it afterwards, so
-// values can ride the member body while the rest of it stays schema-validated.
-//
-// Gated on the flag: with the flag off, the key is stripped exactly as it is
-// today. The lasting fix is declaring `custom_fields` in the schema package
-// upstream, which is a separate release; this holds the seam until then.
-function preserveCustomFields(validate) {
-    return async function validateWithCustomFields(apiConfig, frame) {
-        if (!labs.isSet('membersCustomFields') || !Array.isArray(frame.data.members)) {
-            return validate(apiConfig, frame);
-        }
-
-        const stashed = frame.data.members.map(member => member && member.custom_fields);
-
-        await validate(apiConfig, frame);
-
-        frame.data.members.forEach((member, index) => {
-            if (member && stashed[index] !== undefined) {
-                member.custom_fields = stashed[index];
-            }
-        });
-    };
-}
-
-// Setting values while *creating* a member is a later vertical, not this one. On
-// add, ajv would silently strip `custom_fields` (a value that appears to vanish),
-// so reject it explicitly instead — the gap is then legible rather than a mystery.
-// Flag-gated, so with the flag off the key is stripped exactly as before.
-function rejectCustomFieldsOnAdd(validate) {
-    return function validateWithoutCustomFields(apiConfig, frame) {
-        const hasCustomFields = labs.isSet('membersCustomFields')
-            && Array.isArray(frame.data.members)
-            && frame.data.members.some(member => member && member.custom_fields !== undefined);
-
-        if (hasCustomFields) {
-            throw new errors.ValidationError({
-                message: 'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
-                property: 'custom_fields'
-            });
-        }
-
-        return validate(apiConfig, frame);
-    };
-}
 
 module.exports = {
-    add: rejectCustomFieldsOnAdd(jsonSchema.validate),
-    edit: preserveCustomFields(jsonSchema.validate)
+    add: jsonSchema.validate,
+    edit: jsonSchema.validate
 };

package/core/server/data/db/backup.js

@@ -5,7 +5,7 @@ const fs = require('fs-extra');
 const path = require('path');
 const config = require('../../../shared/config');
 const logging = require('@tryghost/logging');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const exporter = require('../exporter');
 
 /**

package/core/server/data/exporter/export-filename.js

@@ -3,6 +3,7 @@ const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
 const models = require('../../models');
+const path = require('path');
 
 const modelOptions = {context: {internal: true}};
 
@@ -14,7 +15,7 @@ const exportFileName = async function exportFileName(options) {
 
     // custom filename
     if (options.filename) {
-        return options.filename + '.json';
+        return path.basename(options.filename) + '.json';
     }
 
     try {

package/core/server/data/importer/handlers/image.js

@@ -1,8 +1,8 @@
 const _ = require('lodash');
 const path = require('path');
 const config = require('../../../../shared/config');
-const urlUtils = require('../../../../shared/url-utils');
-const storage = require('../../../adapters/storage');
+const urlUtils = require('../../../../shared/url-utils').default;
+const adapterManager = require('../../../services/adapter-manager').default;
 let ImageHandler;
 
 ImageHandler = {
@@ -12,7 +12,7 @@ ImageHandler = {
     directories: ['images', 'content'],
 
     loadFile: function (files, baseDir) {
-        const store = storage.getStorage('images');
+        const store = adapterManager.getAdapter('storage:images');
         const baseDirRegex = baseDir ? new RegExp('^' + baseDir + '/') : new RegExp('');
 
         const imageFolderRegexes = _.map(store.staticFileURLPrefix.split('/'), function (dir) {

package/core/server/data/importer/import-manager.js

@@ -18,12 +18,14 @@ const MarkdownHandler = require('./handlers/markdown');
 const ContentFileImporter = require('./importers/content-file-importer');
 const RevueImporter = require('./importers/importer-revue');
 const DataImporter = require('./importers/data');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const {GhostMailer} = require('../../services/mail');
 const jobManager = require('../../services/jobs');
-const mediaStorage = require('../../adapters/storage').getStorage('media');
-const imageStorage = require('../../adapters/storage').getStorage('images');
-const fileStorage = require('../../adapters/storage').getStorage('files');
+const adapterManager = require('../../services/adapter-manager').default;
+
+const mediaStorage = adapterManager.getAdapter('storage:media');
+const imageStorage = adapterManager.getAdapter('storage:images');
+const fileStorage = adapterManager.getAdapter('storage:files');
 
 const {emailTemplate} = require('./email-template');
 const ghostMailer = new GhostMailer();

package/core/server/data/importer/importers/content-file-importer.js

@@ -57,14 +57,14 @@ class ContentFileImporter {
     /** @property {string} */
     type;
 
-    /** @property {import('ghost-storage-base')} */
+    /** @property {import('ghost-storage-base').StorageBase} */
     #store;
 
     /**
      *
      * @param {Object} deps
      * @param {'images' | 'media' | 'files'} deps.type - importer type
-     * @param {import('ghost-storage-base')} deps.store
+     * @param {import('ghost-storage-base').StorageBase} deps.store
      */
     constructor(deps) {
         this.type = deps.type;

package/core/server/data/importer/importers/data/revue-subscriber-importer.js

@@ -6,7 +6,6 @@ const path = require('path');
 const fs = require('fs-extra');
 
 const config = require('../../../../../shared/config');
-const models = require('../../../../models');
 
 class RevueSubscriberImporter extends BaseImporter {
     constructor(allDataFromFile) {
@@ -38,17 +37,14 @@ class RevueSubscriberImporter extends BaseImporter {
         const outputFilePath = path.join(config.getContentPath('data'), '/', outputFileName);
         const csvData = papaparse.unparse(this.dataToImport);
 
-        const memberImporterOptions = {
-            pathToCSV: outputFilePath,
-            globalLabels: [{name: importLabel}],
-            importLabel: {name: importLabel},
-            LabelModel: models.Label,
-            forceInline: true
-        };
-
         await fs.writeFile(outputFilePath, csvData);
 
-        return membersService.processImport(memberImporterOptions);
+        // Inline: the data import has no request to hold open and needs the result now.
+        return membersService.importInline({
+            filePath: outputFilePath,
+            extraLabels: [{name: importLabel}],
+            requestUserEmail: null
+        });
     }
 }
 

package/core/server/data/importer/importers/json-to-html.js

@@ -4,6 +4,25 @@ const {cards} = require('@tryghost/kg-default-cards');
 const imageCard = cards.find(c => c.name === 'image');
 const embedCard = cards.find(c => c.name === 'embed');
 
+const getValidURL = (url) => {
+    const normalizedURL = typeof url === 'string' ? url.trim() : '';
+
+    if (!normalizedURL) {
+        return '';
+    }
+
+    try {
+        const parsedURL = new URL(normalizedURL, 'https://example.com');
+        if (parsedURL.protocol === 'http:' || parsedURL.protocol === 'https:') {
+            return normalizedURL;
+        }
+    } catch {
+        // Invalid URLs are omitted from imported links
+    }
+
+    return '';
+};
+
 // Take the array of items for a specific post and return the converted HTML
 const itemsToHtml = (items) => {
     let itemHTMLChunks = [];
@@ -30,22 +49,23 @@ const itemsToHtml = (items) => {
         } else if (type === 'link') {
             // This could be a bookmark, or it could be a paragraph of text with a linked header, there's no way to tell
             // The safest option here is to output an image with text under it
+            const itemURL = getValidURL(item.url);
             let cardOpts = {
                 env: {dom: new SimpleDom.Document()},
                 payload: {
                     src: item.image,
                     caption: item.title,
-                    href: item.url
+                    href: itemURL
                 }
             };
             itemHTMLChunks.push(serializer.serialize(imageCard.render(cardOpts)));
-
-            let linkHTML = `<h4><a href="${item.url}">${item.title}</a></h4>${item.description}`;
+            const linkTitleHTML = itemURL ? `<a href="${serializer.escapeAttrValue(itemURL)}">${item.title}</a>` : item.title;
+            let linkHTML = `<h4>${linkTitleHTML}</h4>${item.description}`;
             itemHTMLChunks.push(linkHTML);
         } else if (type === 'tweet') {
             // Should this be an oEmbed call? Probably.
             itemHTMLChunks.push(`<figure class="kg-card kg-embed-card">
-                <blockquote class="twitter-tweet"><a href="${item.url}"></a></blockquote>
+                <blockquote class="twitter-tweet"><a href="${serializer.escapeAttrValue(item.url)}"></a></blockquote>
                 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
                 </figure>`);
         } else if (type === 'video') {

package/core/server/data/migrations/utils/schema.js

@@ -191,12 +191,14 @@ function createSetNullableMigration(table, column, options = {}) {
 /**
  * @param {string} table
  * @param {string[]|string} columns One or multiple columns (in case the index should be for multiple columns)
+ * @param {object} [options]
+ * @param {number} [options.length] MySQL only: create a prefix index of this many characters
  * @returns {Migration}
  */
-function createAddIndexMigration(table, columns) {
+function createAddIndexMigration(table, columns, options = {}) {
     return createTransactionalMigration(
         async function up(knex) {
-            await commands.addIndex(table, columns, knex);
+            await commands.addIndex(table, columns, knex, options);
         },
         async function down(knex) {
             await commands.dropIndex(table, columns, knex);

package/core/server/data/migrations/versions/6.54/2026-07-19-16-59-00-add-content-import-permission.js

@@ -0,0 +1,10 @@
+const {addPermissionWithRoles} = require('../../utils');
+
+// Content import (the CSV posts importer) is restricted to Administrators
+// (the Owner bypasses permission checks) and the self-serve migrator's
+// integration, mirroring the existing db importContent permissions.
+module.exports = addPermissionWithRoles({
+    name: 'Import content',
+    action: 'importContent',
+    object: 'content_import'
+}, ['Administrator', 'Self-Serve Migration Integration']);

package/core/server/data/migrations/versions/6.54/2026-07-20-13-59-21-drop-email-tracked-sent-count-from-automation-action-revisions.js

@@ -0,0 +1,7 @@
+const {createDropColumnMigration} = require('../../utils');
+
+module.exports = createDropColumnMigration('automation_action_revisions', 'email_tracked_sent_count', {
+    type: 'integer',
+    nullable: true,
+    unsigned: true
+}, {algorithm: 'auto'});

package/core/server/data/migrations/versions/6.54/2026-07-21-01-58-20-add-automation-run-steps-poller-index.js

@@ -0,0 +1,3 @@
+const {createAddIndexMigration} = require('../../utils');
+
+module.exports = createAddIndexMigration('automation_run_steps', ['status', 'ready_at', 'created_at', 'id']);

package/core/server/data/migrations/versions/6.54/2026-07-21-21-08-15-add-automated-email-recipients-mailgun-message-id-index.js

@@ -0,0 +1,3 @@
+const {createAddIndexMigration} = require('../../utils');
+
+module.exports = createAddIndexMigration('automated_email_recipients', ['mailgun_message_id'], {length: 31});

package/core/server/data/migrations/versions/6.54/2026-07-22-10-41-08-add-click-tracking-to-automated-email-recipients.js

@@ -0,0 +1,13 @@
+const {combineNonTransactionalMigrations, createAddColumnMigration} = require('../../utils');
+
+module.exports = combineNonTransactionalMigrations(
+    createAddColumnMigration('automated_email_recipients', 'track_clicks', {
+        type: 'boolean',
+        nullable: false,
+        defaultTo: false
+    }, {algorithm: 'auto'}),
+    createAddColumnMigration('automated_email_recipients', 'clicked_at', {
+        type: 'dateTime',
+        nullable: true
+    }, {algorithm: 'auto'})
+);

package/core/server/data/migrations/versions/6.54/2026-07-22-15-10-30-add-email-clicked-count-to-automation-action-revisions.js

@@ -0,0 +1,7 @@
+const {createAddColumnMigration} = require('../../utils');
+
+module.exports = createAddColumnMigration('automation_action_revisions', 'email_clicked_count', {
+    type: 'integer',
+    nullable: true,
+    unsigned: true
+}, {algorithm: 'auto'});

package/core/server/data/migrations/versions/6.54/2026-07-23-10-24-18-add-automation-action-revision-to-redirects.js

@@ -0,0 +1,9 @@
+const {createAddColumnMigration} = require('../../utils');
+
+module.exports = createAddColumnMigration('redirects', 'automation_action_revision_id', {
+    type: 'string',
+    maxlength: 24,
+    nullable: true,
+    references: 'automation_action_revisions.id',
+    setNullDelete: true
+}, {algorithm: 'auto'});

package/core/server/data/schema/commands.js

@@ -5,6 +5,7 @@ const tpl = require('@tryghost/tpl');
 const db = require('../db');
 const DatabaseInfo = require('@tryghost/database-info');
 const schema = require('./schema');
+const {defaultIndexName} = require('./lib/default-index-name');
 
 const messages = {
     hasPrimaryKeySQLiteError: 'Must use hasPrimaryKeySQLite on an SQLite3 database',
@@ -191,19 +192,38 @@ async function renameColumn(tableName, from, to, transaction = db.knex) {
     });
 }
 
+/**
+ * Builds the column arguments for a MySQL index prefix, such as `col(123)`.
+ *
+ * @param {import('knex').Knex} knex
+ * @param {string|string[]} columns
+ * @param {number} length
+ * @returns {import('knex').Knex.Raw[]}
+ */
+function prefixIndexColumns(knex, columns, length) {
+    return (Array.isArray(columns) ? columns : [columns])
+        .map(col => knex.raw('?? (?)', [col, length]));
+}
+
 /**
  * Adds an non-unique index to a table over the given columns.
  *
  * @param {string} tableName - name of the table to add indexes to
  * @param {string|string[]} columns - column(s) to add indexes for
  * @param {import('knex').Knex} [transaction] - connection object containing knex reference
+ * @param {object} [options]
+ * @param {number} [options.length] - MySQL only: create a prefix index of this many characters
  */
-async function addIndex(tableName, columns, transaction = db.knex) {
+async function addIndex(tableName, columns, transaction = db.knex, options = {}) {
     try {
         logging.info(`Adding index for '${columns}' in table '${tableName}'`);
 
         return await transaction.schema.table(tableName, function (table) {
-            table.index(columns);
+            if (options.length && DatabaseInfo.isMySQL(transaction)) {
+                table.index(prefixIndexColumns(transaction, columns, options.length), defaultIndexName(tableName, columns));
+            } else {
+                table.index(columns);
+            }
         });
     } catch (err) {
         if (err.code === 'SQLITE_ERROR') {
@@ -500,7 +520,21 @@ function createTable(table, transaction = db.knex, tableSpec = schema[table]) {
             .forEach(column => addTableColumn(table, t, column, tableSpec[column]));
 
         if (tableSpec['@@INDEXES@@']) {
-            tableSpec['@@INDEXES@@'].forEach(index => t.index(index));
+            tableSpec['@@INDEXES@@'].forEach((index) => {
+                if (index && typeof index === 'object' && !Array.isArray(index)) {
+                    if (index.length && DatabaseInfo.isMySQL(transaction)) {
+                        t.index(
+                            prefixIndexColumns(transaction, index.columns, index.length),
+                            defaultIndexName(table, index.columns)
+                        );
+                    } else {
+                        // SQLite doesn't support prefix indexes, so we index the whole thing.
+                        t.index(index.columns);
+                    }
+                } else {
+                    t.index(index);
+                }
+            });
         }
         if (tableSpec['@@UNIQUE_CONSTRAINTS@@']) {
             tableSpec['@@UNIQUE_CONSTRAINTS@@'].forEach(unique => t.unique(unique));

package/core/server/data/schema/fixtures/fixtures.json

@@ -144,6 +144,11 @@
                     "action_type": "deleteAllContent",
                     "object_type": "db"
                 },
+                {
+                    "name": "Import content",
+                    "action_type": "importContent",
+                    "object_type": "content_import"
+                },
                 {
                     "name": "Send mail",
                     "action_type": "send",
@@ -966,6 +971,7 @@
             "entries": {
                 "Administrator": {
                     "db": "all",
+                    "content_import": "all",
                     "mail": "all",
                     "notification": "all",
                     "post": "all",
@@ -1020,6 +1026,7 @@
                 },
                 "Self-Serve Migration Integration": {
                     "db": "importContent",
+                    "content_import": "importContent",
                     "member": "add",
                     "tag": "read"
                 },

package/core/server/data/schema/lib/default-index-name.js

@@ -0,0 +1,20 @@
+/**
+ * Normally, we use Knex for index names. But in some cases, we need to derive
+ * them because Knex won't get it right. We try to match [Knex's code][0] as
+ * closely as possible.
+ *
+ * [0]: https://github.com/knex/knex/blob/e25d54bcb707714a17f5a5744eba5c4246bb4d1d/lib/schema/tablecompiler.js#L401-L415
+ *
+ * @param {string} tableName
+ * @param {string|string[]} columns
+ * @returns {string}
+ */
+function defaultIndexName(tableName, columns) {
+    if (!Array.isArray(columns)) {
+        columns = columns ? [columns] : [];
+    }
+    const table = tableName.replace(/\.|-/g, '_');
+    return (table + '_' + columns.join('_') + '_index').toLowerCase();
+}
+
+exports.defaultIndexName = defaultIndexName;

package/core/server/data/schema/schema.js

@@ -1076,20 +1076,6 @@ module.exports = {
         metadata: {type: 'string', maxlength: 2000, nullable: true},
         queue_entry: {type: 'integer', nullable: true, unsigned: true}
     },
-    redirects: {
-        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
-        from: {type: 'string', maxlength: 191, nullable: false, index: true},
-        to: {type: 'string', maxlength: 2000, nullable: false},
-        post_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'posts.id', setNullDelete: true},
-        created_at: {type: 'dateTime', nullable: false},
-        updated_at: {type: 'dateTime', nullable: true}
-    },
-    members_click_events: {
-        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
-        member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
-        redirect_id: {type: 'string', maxlength: 24, nullable: false, references: 'redirects.id', cascadeDelete: true},
-        created_at: {type: 'dateTime', nullable: false}
-    },
     members_feedback: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         score: {type: 'integer', nullable: false, unsigned: true, defaultTo: 0},
@@ -1265,12 +1251,27 @@ module.exports = {
         email_lexical: {type: 'text', maxlength: 1000000000, fieldtype: 'long', nullable: true},
         email_design_setting_id: {type: 'string', maxlength: 24, nullable: true, references: 'email_design_settings.id', setNullDelete: true},
         email_sent_count: {type: 'integer', nullable: true, unsigned: true},
-        email_tracked_sent_count: {type: 'integer', nullable: true, unsigned: true},
         email_opened_count: {type: 'integer', nullable: true, unsigned: true},
+        email_clicked_count: {type: 'integer', nullable: true, unsigned: true},
         '@@UNIQUE_CONSTRAINTS@@': [
             ['created_at', 'action_id']
         ]
     },
+    redirects: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        from: {type: 'string', maxlength: 191, nullable: false, index: true},
+        to: {type: 'string', maxlength: 2000, nullable: false},
+        post_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'posts.id', setNullDelete: true},
+        automation_action_revision_id: {type: 'string', maxlength: 24, nullable: true, references: 'automation_action_revisions.id', setNullDelete: true},
+        created_at: {type: 'dateTime', nullable: false},
+        updated_at: {type: 'dateTime', nullable: true}
+    },
+    members_click_events: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
+        redirect_id: {type: 'string', maxlength: 24, nullable: false, references: 'redirects.id', cascadeDelete: true},
+        created_at: {type: 'dateTime', nullable: false}
+    },
     automation_action_edges: {
         source_action_id: {type: 'string', maxlength: 24, nullable: false, references: 'automation_actions.id', restrictDelete: true},
         target_action_id: {type: 'string', maxlength: 24, nullable: false, references: 'automation_actions.id', restrictDelete: true},
@@ -1296,7 +1297,10 @@ module.exports = {
         finished_at: {type: 'dateTime', nullable: true},
         status: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'pending', validations: {isIn: [['pending', 'automation disabled', 'failed', 'finished', 'member changed status', 'member unsubscribed']]}},
         locked_by: {type: 'string', maxlength: 191, nullable: true},
-        locked_at: {type: 'dateTime', nullable: true}
+        locked_at: {type: 'dateTime', nullable: true},
+        '@@INDEXES@@': [
+            ['status', 'ready_at', 'created_at', 'id']
+        ]
     },
     welcome_email_automated_emails: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
@@ -1338,9 +1342,28 @@ module.exports = {
         mailgun_message_id: {type: 'string', maxlength: 1000, nullable: true},
         delivered_at: {type: 'dateTime', nullable: true},
         opened_at: {type: 'dateTime', nullable: true},
+        clicked_at: {type: 'dateTime', nullable: true},
         track_opens: {type: 'boolean', nullable: false, defaultTo: false},
+        track_clicks: {type: 'boolean', nullable: false, defaultTo: false},
         created_at: {type: 'dateTime', nullable: false},
-        updated_at: {type: 'dateTime', nullable: true}
+        updated_at: {type: 'dateTime', nullable: true},
+        '@@INDEXES@@': [
+            // `mailgun_message_id` is too long for a MySQL index, so we use a
+            // prefix.
+            //
+            // We choose 31 because Mailgun message IDs look like this:
+            //
+            //     20200420080647.ab01cd02ef03ba04@mailgun.domain.example
+            //     YYYYMMDDHHMMSS.RANDOM-HEX-BYTES@DOMAIN
+            //
+            // That first part is unlikely to have conflicts, so let's use
+            // that. This index is for performance, not uniqueness, so it's
+            // okay if there's a conflict.
+            //
+            // Note that this prefix index only happens for MySQL. SQLite
+            // indexes the full value.
+            {columns: ['mailgun_message_id'], length: 31}
+        ]
     },
     gifts: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},

package/core/server/data/seeders/data-generator.js

@@ -59,8 +59,10 @@ class DataGenerator {
             table.dependencies = Object.entries(this.schemaTables[table.name]).reduce((acc, [_col, data]) => {
                 if (data.references) {
                     const referencedTable = data.references.split('.')[0];
-                    // The ghost_subscriptions_id property has a foreign key to the subscriptions table, but we don't use that table yet atm, so don't add it as a dependency
-                    if (!acc.includes(referencedTable) && referencedTable !== 'subscriptions') {
+                    // Some nullable relationships point to tables the generator does not populate.
+                    // Generated redirects belong to posts, so automation revisions are not a seed dependency.
+                    const isUnsupportedOptionalDependency = referencedTable === 'subscriptions' || (referencedTable === 'automation_action_revisions' && data.nullable);
+                    if (!acc.includes(referencedTable) && !isUnsupportedOptionalDependency) {
                         acc.push(referencedTable);
                     }
                 }

package/core/server/lib/image/image-size.js

@@ -17,29 +17,15 @@ const FETCH_ONLY_FORMATS = [
 ];
 
 class ImageSize {
-    constructor({config, storage, storageUtils, validator, urlUtils, request, probe}) {
+    constructor({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe}) {
         this.config = config;
-        this.storage = storage;
+        this.imageStore = imageStore;
         this.storageUtils = storageUtils;
         this.validator = validator;
         this.urlUtils = urlUtils;
-        this.request = request;
+        this.fetchExternal = fetchExternal;
         this.probe = probe;
 
-        this.REQUEST_OPTIONS = {
-            // we need the user-agent, otherwise some https request may fail (e.g. cloudfare)
-            headers: {
-                'User-Agent': 'Mozilla/5.0 Safari/537.36'
-            },
-            timeout: {
-                request: this.config.get('times:getImageSizeTimeoutInMS') || 10000
-            },
-            retry: {
-                limit: 0 // for `got`, used with image-size
-            },
-            responseType: 'buffer'
-        };
-
         this.NEEDLE_OPTIONS = {
             // we need the user-agent, otherwise some https request may fail (e.g. cloudflare)
             headers: {
@@ -107,7 +93,7 @@ class ImageSize {
     // download full image then use image-size to get it's dimensions
     // returns promise which resolves dimensions
     _fetchImageSizeFromUrl(imageUrl) {
-        return this.request(imageUrl, this.REQUEST_OPTIONS).then((response) => {
+        return this.fetchExternal(imageUrl, this.NEEDLE_OPTIONS).then((response) => {
             return this._imageSizeFromBuffer(response.body);
         });
     }
@@ -248,8 +234,7 @@ class ImageSize {
         // get the storage readable filePath
         filePath = this.storageUtils.getLocalImagesStoragePath(imagePath);
 
-        return this.storage.getStorage('images')
-            .read({path: filePath})
+        return this.imageStore.read({path: filePath})
             .then((buf) => {
                 debug('Image fetched (storage):', filePath);
                 return this._imageSizeFromBuffer(buf);
@@ -298,10 +283,9 @@ class ImageSize {
      */
     async getOriginalImagePath(imagePath) {
         const {dir, name, ext} = path.parse(imagePath);
-        const storageInstance = this.storage.getStorage('images');
 
         const preferredUnoptimizedImagePath = path.join(dir, `${name}_o${ext}`);
-        const preferredUnoptimizedImagePathExists = await storageInstance.exists(preferredUnoptimizedImagePath);
+        const preferredUnoptimizedImagePathExists = await this.imageStore.exists(preferredUnoptimizedImagePath);
         if (preferredUnoptimizedImagePathExists) {
             return preferredUnoptimizedImagePath;
         }
@@ -315,7 +299,7 @@ class ImageSize {
         }
 
         const legacyOriginalImagePath = path.join(dir, `${imageName}_o${imageNumber || ''}${ext}`);
-        const legacyOriginalImageExists = await storageInstance.exists(legacyOriginalImagePath);
+        const legacyOriginalImageExists = await this.imageStore.exists(legacyOriginalImagePath);
 
         return legacyOriginalImageExists ? legacyOriginalImagePath : imagePath;
     }

package/core/server/lib/image/image-utils.js

@@ -24,10 +24,23 @@ function probe(url, options = {}, {probeImageSize: probeImageSizeFn = probeImage
     return promise;
 }
 
+// For image formats that require a full fetch. This function ensures that
+// SSRF protections are in place by using the externalRequest `got` client.
+function fetchExternal(url, options = {}) {
+    return externalRequest.get(url, {
+        headers: options.headers,
+        timeout: {
+            request: options.response_timeout || 10000
+        },
+        responseType: 'buffer',
+        retry: {limit: 0}
+    });
+}
+
 class ImageUtils {
-    constructor({config, urlUtils, settingsCache, storageUtils, storage, validator, request, cacheStore}) {
+    constructor({config, urlUtils, settingsCache, storageUtils, imageStore, validator, request, cacheStore}) {
         this.blogIcon = new BlogIcon({config, urlUtils, settingsCache, storageUtils});
-        this.imageSize = new ImageSize({config, storage, storageUtils, validator, urlUtils, request, probe});
+        this.imageSize = new ImageSize({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe});
         this.cachedImageSizeFromUrl = new CachedImageSizeFromUrl({
             getImageSizeFromUrl: this.imageSize.getImageSizeFromUrl.bind(this.imageSize),
             cache: cacheStore
@@ -38,3 +51,4 @@ class ImageUtils {
 
 module.exports = ImageUtils;
 module.exports.probe = probe;
+module.exports.fetchExternal = fetchExternal;