ghost 6.54.0 → 6.54.1

package/core/server/adapters/storage/LocalStorageBase.ts

@@ -0,0 +1,342 @@
+// # Local File Base Storage module
+// The (default) module for storing files using the local file system
+import fs from 'fs-extra';
+import path from 'path';
+import type {NextFunction, Request, RequestHandler, Response} from 'express';
+import type express from 'express';
+import tpl from '@tryghost/tpl';
+import errors from '@tryghost/errors';
+import {StorageBase, type ReadOptions, type StorageFile} from 'ghost-storage-base';
+import urlUtils from '../../../shared/url-utils';
+import {errify} from '../../../shared/errify';
+
+const serveStatic: typeof express.static = require('../../../shared/express').static;
+
+const messages = {
+    notFound: 'File not found',
+    notFoundWithRef: 'File not found: {file}',
+    cannotRead: 'Could not read file: {file}',
+    invalidUrlParameter: `The URL "{url}" is not a valid URL for this site.`,
+    invalidPathParameter: 'The path "{path}" is not valid for this storage.'
+};
+
+export interface LocalStorageBaseErrorMessages {
+    notFound: string;
+    notFoundWithRef: string;
+    cannotRead: string;
+}
+
+export interface LocalStorageBaseOptions {
+    storagePath: string;
+    siteUrl?: string;
+    staticFileURLPrefix?: string;
+    errorMessages?: LocalStorageBaseErrorMessages;
+}
+
+/**
+ * Errors thrown by `serve-static` carry an HTTP status alongside the standard
+ * Error fields.
+ */
+interface ServeStaticError extends Error {
+    statusCode?: number;
+    path?: string;
+}
+
+class LocalStorageBase extends StorageBase {
+    readonly staticFileURLPrefix: string | undefined;
+
+    readonly siteUrl: string | undefined;
+
+    readonly staticFileUrl: string;
+
+    readonly errorMessages: LocalStorageBaseErrorMessages;
+
+    constructor({storagePath, staticFileURLPrefix, siteUrl, errorMessages}: LocalStorageBaseOptions) {
+        super();
+
+        this.storagePath = storagePath;
+        this.staticFileURLPrefix = staticFileURLPrefix;
+        this.siteUrl = siteUrl;
+        this.staticFileUrl = `${siteUrl}${staticFileURLPrefix}`;
+        this.errorMessages = errorMessages || messages;
+    }
+
+    /**
+     * Normalizes a relative storage path and rejects traversal outside the storage root.
+     */
+    _normalizeStorageRelativePath(filePath?: string): string {
+        const normalized = path.posix.normalize(String(filePath || '')
+            .replaceAll('\\', '/')
+            .replace(/^\/+/, '')
+            .replace(/\/+$/, ''));
+
+        if (normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: filePath})
+            });
+        }
+
+        return normalized;
+    }
+
+    /**
+     * Resolves a target directory and optional file name into a full path,
+     * validating the result is inside the storage root.
+     *
+     * Supports relative paths (preferred) and absolute paths (legacy).
+     * TODO: remove absolute path support once all callers pass relative paths
+     *
+     * @param targetDir absolute or relative directory
+     * @param fileName file name to normalize and append
+     * @returns resolved absolute path inside storagePath
+     */
+    _resolveAndValidateStoragePath(targetDir?: string, fileName?: string): string {
+        const resolvedRoot = path.resolve(this.storagePath);
+
+        // Resolve targetDir: if already inside storage root use as-is, otherwise treat as relative
+        let resolvedBase;
+        if (targetDir) {
+            const resolvedTargetDir = path.resolve(targetDir);
+            const relToRoot = path.relative(resolvedRoot, resolvedTargetDir);
+            if (relToRoot === '' || (!relToRoot.startsWith('..') && !path.isAbsolute(relToRoot))) {
+                resolvedBase = resolvedTargetDir;
+            } else {
+                resolvedBase = path.resolve(this.storagePath, targetDir);
+            }
+        } else {
+            resolvedBase = resolvedRoot;
+        }
+
+        // If fileName provided, normalize and resolve
+        let resolvedPath;
+        if (fileName) {
+            const normalizedFileName = this._normalizeStorageRelativePath(fileName);
+            resolvedPath = path.resolve(resolvedBase, normalizedFileName);
+        } else {
+            resolvedPath = resolvedBase;
+        }
+
+        // Validate the resolved path is strictly inside the storage root (not equal to it)
+        const relative = path.relative(resolvedRoot, resolvedPath);
+        if (relative === '' || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: fileName || targetDir || ''})
+            });
+        }
+
+        return resolvedPath;
+    }
+
+    /**
+     * Saves the file to storage (the file system)
+     * - returns a promise which ultimately returns the full url to the uploaded file
+     */
+    async save(file: StorageFile, targetDir?: string): Promise<string> {
+        let targetFilename;
+
+        targetDir = targetDir
+            ? this._resolveAndValidateStoragePath(targetDir)
+            : this.getTargetDir(this.storagePath);
+
+        const filename = await this.getUniqueFileName(file, targetDir);
+
+        targetFilename = filename;
+
+        // Verify that we are saving directly under `targetDir` and not outside of it.
+        const expectedPrefix = path.join(path.resolve(targetDir), '/');
+        if (!path.resolve(targetFilename).startsWith(expectedPrefix)) {
+            throw new errors.BadRequestError({message: 'Cannot save to the given filename'});
+        }
+
+        await fs.mkdirs(targetDir);
+
+        try {
+            await fs.copy(file.path, targetFilename);
+        } catch (err) {
+            if ((err as NodeJS.ErrnoException).code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: errify(err)});
+            }
+
+            throw err;
+        }
+
+        // The src for the image must be in URI format, not a file system path, which in Windows uses \
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/',
+                urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                path.relative(this.storagePath, targetFilename))
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * Saves a buffer in the targetPath
+     *
+     * @param buffer is an instance of Buffer
+     * @param targetPath relative path NOT including storage path to which the buffer should be written
+     * @returns a URL to retrieve the data
+     */
+    async saveRaw(buffer: Buffer, targetPath: string): Promise<string> {
+        const storagePath = path.join(this.storagePath, this._normalizeStorageRelativePath(targetPath));
+        const targetDir = path.dirname(storagePath);
+
+        await fs.mkdirs(targetDir);
+        await fs.writeFile(storagePath, buffer);
+
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/', urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                targetPath)
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * @param url full url under which the stored content is served, result of save method
+     * @returns relative path under which the content is stored
+     */
+    urlToPath(url: string): string {
+        let relativePath;
+
+        const prefix = urlUtils.urlJoin('/',
+            urlUtils.getSubdir(),
+            this.staticFileURLPrefix as string
+        );
+
+        if (url.startsWith(this.staticFileUrl)) {
+            // CASE: full path that includes the site url
+            relativePath = url.replace(this.staticFileUrl, '');
+        } else if (url.startsWith(prefix)) {
+            // CASE: The result of the save method doesn't include the site url. So we need to handle this case.
+            relativePath = url.replace(prefix, '');
+        } else {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+
+        try {
+            return this._normalizeStorageRelativePath(relativePath);
+        } catch (err) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+    }
+
+    async exists(fileName: string, targetDir?: string): Promise<boolean> {
+        let filePath;
+
+        try {
+            filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        } catch (err) {
+            if (err instanceof errors.IncorrectUsageError) {
+                return false;
+            }
+
+            throw err;
+        }
+
+        try {
+            await fs.stat(filePath);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * For some reason send divides the max age number by 1000
+     * Fallthrough: false ensures that if an image isn't found, it automatically 404s
+     * Wrap server static errors
+     */
+    serve(): RequestHandler {
+        const {storagePath, errorMessages} = this;
+
+        return function serveStaticContent(req: Request, res: Response, next: NextFunction) {
+            return serveStatic(
+                storagePath,
+                {
+                    maxAge: (365 * 24 * 60 * 60 * 1000), // 1 year in ms
+                    fallthrough: false
+                }
+            )(req, res, (err?: ServeStaticError) => {
+                if (err) {
+                    if (err.statusCode === 404) {
+                        return next(new errors.NotFoundError({
+                            message: tpl(errorMessages.notFound),
+                            code: 'STATIC_FILE_NOT_FOUND',
+                            property: err.path
+                        }));
+                    }
+
+                    if (err.statusCode === 400) {
+                        return next(new errors.BadRequestError({err: err}));
+                    }
+
+                    if (err.statusCode === 403) {
+                        return next(new errors.NoPermissionError({err: err}));
+                    }
+
+                    if (err.name === 'RangeNotSatisfiableError') {
+                        return next(new errors.RangeNotSatisfiableError({err}));
+                    }
+
+                    return next(new errors.InternalServerError({err: err}));
+                }
+
+                next();
+            });
+        };
+    }
+
+    async delete(fileName: string, targetDir?: string): Promise<void> {
+        const filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        return await fs.remove(filePath);
+    }
+
+    /**
+     * Reads bytes from disk for a target file
+     * - path of target file (without content path!)
+     */
+    async read(options?: Partial<ReadOptions>): Promise<Buffer> {
+        options = options || {};
+
+        const normalizedPath = this._normalizeStorageRelativePath(options.path);
+        const targetPath = path.join(this.storagePath, normalizedPath);
+
+        try {
+            return await fs.readFile(targetPath);
+        } catch (rawError) {
+            const err = errify(rawError);
+            const code = (rawError as NodeJS.ErrnoException).code;
+
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                throw new errors.NotFoundError({
+                    err: err,
+                    message: tpl(this.errorMessages.notFoundWithRef, {file: options.path})
+                });
+            }
+
+            if (code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: err});
+            }
+
+            if (code === 'EACCES') {
+                throw new errors.NoPermissionError({err: err});
+            }
+
+            throw new errors.InternalServerError({
+                err: err,
+                message: tpl(this.errorMessages.cannotRead, {file: options.path})
+            });
+        }
+    }
+}
+
+export default LocalStorageBase;

package/core/server/adapters/storage/utils.js

@@ -1,68 +1,54 @@
-const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils').default;
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalImagesStoragePath = getLocalImagesStoragePath;
+exports.isLocalImage = isLocalImage;
+exports.isInternalImage = isInternalImage;
+const config_1 = __importDefault(require("../../../shared/config"));
+const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
 /**
  * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
  */
-
 /**
- * Sanitizes a given URL or path for an image to be readable by the local file storage
- * as storage needs the path without `/content/images/` prefix
- * Always returns {string} url
- * @param {string} imagePath
- * @returns {string} imagePath
- * @description Takes a url or filepath and returns a filepath with is readable
- * for the local file storage.
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
  */
-exports.getLocalImagesStoragePath = function getLocalImagesStoragePath(imagePath) {
+function getLocalImagesStoragePath(imagePath) {
     // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
-    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.urlFor('home', true),
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
-    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
+    const urlRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.urlFor('home', true), url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
+    const filePathRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
     if (imagePath.match(urlRegExp)) {
         return imagePath.replace(urlRegExp, '');
-    } else if (imagePath.match(filePathRegExp)) {
+    }
+    else if (imagePath.match(filePathRegExp)) {
         return imagePath.replace(filePathRegExp, '');
-    } else {
+    }
+    else {
         return imagePath;
     }
-};
-
+}
 /**
- * @description compares the imagePath with a regex that reflects our local file storage
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
  */
-
-exports.isLocalImage = function isLocalImage(imagePath) {
-    const localImagePath = this.getLocalImagesStoragePath(imagePath);
-
-    if (localImagePath !== imagePath) {
-        return true;
-    } else {
-        return false;
-    }
-};
-
+function isLocalImage(imagePath) {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
 /**
- * @description Checks whether the image is managed by Ghost storage (local or CDN)
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
  */
-exports.isInternalImage = function isInternalImage(imagePath) {
-    if (this.isLocalImage(imagePath)) {
+function isInternalImage(imagePath) {
+    if (isLocalImage(imagePath)) {
         return true;
     }
-
-    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    const imageBaseUrl = (config_1.default.get('urls:image') || '').replace(/\/+$/, '');
     return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
-};
+}

package/core/server/adapters/storage/utils.ts

@@ -0,0 +1,60 @@
+import config from '../../../shared/config';
+import urlUtils from '../../../shared/url-utils';
+
+/**
+ * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
+ */
+
+/**
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
+ */
+export function getLocalImagesStoragePath(imagePath: string): string {
+    // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
+    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.urlFor('home', true),
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    if (imagePath.match(urlRegExp)) {
+        return imagePath.replace(urlRegExp, '');
+    } else if (imagePath.match(filePathRegExp)) {
+        return imagePath.replace(filePathRegExp, '');
+    } else {
+        return imagePath;
+    }
+}
+
+/**
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isLocalImage(imagePath: string): boolean {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
+
+/**
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isInternalImage(imagePath: string): boolean {
+    if (isLocalImage(imagePath)) {
+        return true;
+    }
+
+    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
+}

package/core/server/api/endpoints/db.js

@@ -1,4 +1,5 @@
 const moment = require('moment-timezone');
+const path = require('path');
 const dbBackup = require('../../data/db/backup');
 const exporter = require('../../data/exporter');
 const importer = require('../../data/importer');
@@ -29,6 +30,11 @@ const controller = {
             }
         },
         query(frame) {
+            const filename = frame.options.filename;
+            if (filename && path.basename(filename) !== filename) {
+                throw new errors.ValidationError({message: 'Export filename must not contain path separators'});
+            }
+
             // NOTE: we need to have `include` property available as backupDatabase uses it internally
             Object.assign(frame.options, {include: frame.options.withRelated});
 

package/core/server/api/endpoints/members.js

@@ -3,14 +3,27 @@
 const moment = require('moment-timezone');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
-const models = require('../../models');
 const membersService = require('../../services/members');
 
-const settingsCache = require('../../../shared/settings-cache');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 
+// Shape the import service's outcome into the API response envelope: an inline import
+// reports its stats and label, a deferred one only how much it accepted.
+function importCSVResponse(outcome) {
+    if (outcome.deferred) {
+        return {meta: {originalImportSize: outcome.originalImportSize}};
+    }
+    return {
+        meta: {
+            originalImportSize: outcome.originalImportSize,
+            stats: {imported: outcome.result.imported, invalid: outcome.result.errors},
+            import_label: outcome.result.importLabel || null
+        }
+    };
+}
+
 const messages = {
     memberNotFound: 'Member not found.',
     notSendingWelcomeEmail: 'Email verification required, welcome email is disabled',
@@ -418,33 +431,17 @@ const controller = {
             method: 'add'
         },
         async query(frame) {
-            const siteTimezone = settingsCache.get('timezone');
-
-            const importLabel = {
-                name: `Import ${moment().tz(siteTimezone).format('YYYY-MM-DD HH:mm')}`
-            };
-
-            const globalLabels = [importLabel].concat(frame.data.labels);
-            const pathToCSV = frame.file.path;
-            const headerMapping = frame.data.mapping;
-
-            let email;
-            if (frame.user) {
-                email = frame.user.get('email');
-            } else {
-                email = (await models.User.getOwnerUser()).get('email');
-            }
-
-            return membersService.processImport({
-                pathToCSV,
-                headerMapping,
-                globalLabels,
-                importLabel,
-                LabelModel: models.Label,
-                user: {
-                    email: email
-                }
+            // The endpoint adapts the request frame into the import service's arguments
+            // and shapes its outcome into the response envelope, so neither the frame nor
+            // the meta shape crosses into the domain. The recipient is the request user;
+            // the service falls back to the site owner when there is none.
+            const outcome = await membersService.importCSV({
+                filePath: frame.file.path,
+                mapping: frame.data.mapping,
+                extraLabels: frame.data.labels || [],
+                requestUserEmail: frame.user ? frame.user.get('email') : null
             });
+            return importCSVResponse(outcome);
         }
     },
 

package/core/server/api/endpoints/pages.js

@@ -2,6 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.paid_conversions', 'post_revisions', 'post_revisions.author'];
 const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];
 
@@ -44,7 +45,11 @@ const controller = {
             unsafeAttrs: UNSAFE_ATTRS
         },
         query(frame) {
-            return models.Post.findPage(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return models.Post.findPage(options);
         }
     },
 

package/core/server/api/endpoints/posts.js

@@ -2,6 +2,7 @@ const urlUtils = require('../../../shared/url-utils').default;
 const models = require('../../models');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const allowedIncludes = [
     'tags',
     'authors',
@@ -78,7 +79,11 @@ const controller = {
             unsafeAttrs: unsafeAttrs
         },
         query(frame) {
-            return postsService.browsePosts(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return postsService.browsePosts(options);
         }
     },
 
@@ -106,8 +111,12 @@ const controller = {
         },
         validation: {},
         async query(frame) {
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
             return {
-                data: await postsService.export(frame),
+                data: await postsService.export(options),
                 filename: getCSVExportFileName('analytics')
             };
         }

package/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -120,7 +120,10 @@ const commentMapper = (model, frame) => {
 
     if (jsonModel.post) {
         // We could use the post mapper here, but we need less field + don't need all the async behavior support
-        url.forPost(jsonModel.post.id, jsonModel.post, frame);
+        // Comments live on pages as well as posts; the URL service routes by
+        // the passed type, so a page typed 'posts' resolves to /404/.
+        const routerType = jsonModel.post.type === 'page' ? 'pages' : 'posts';
+        url.forPost(jsonModel.post.id, jsonModel.post, frame, routerType);
         response.post = _.pick(jsonModel.post, postFields);
 
         // Compute excerpt from custom_excerpt or plaintext (same logic as post serializer)