ghost 6.54.0 → 6.54.1

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -1,10 +1,12 @@
 //@ts-check
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:members');
-const {unparse} = require('../../../../../services/members/csv');
+const {serialize: serializeCSV} = require('../../../../../services/members/import-export/csv');
+// The export CSV row shape and its encode live in the domain (typed against the export
+// row) rather than here, so a change to the export row is caught by the compiler.
+const {toExportCsvRow} = require('../../../../../services/members/import-export/export/exporter');
 const mappers = require('./mappers');
 const {Transform} = require('stream');
-const papaparse = require('papaparse');
 const {createCSVStreamResponse} = require('./stream-csv-response');
 module.exports = {
     browse: createSerializer('browse', paginatedMembers),
@@ -25,56 +27,6 @@ module.exports = {
     activityFeed: createSerializer('activityFeed', activityFeed)
 };
 
-/**
- * Formats a single member for CSV export
- * @param {Object} member - Member object
- * @returns {Object} Formatted member
- */
-function formatMemberForCSV(member) {
-    let labels = '';
-    if (Array.isArray(member.labels)) {
-        labels = member.labels.map((l) => {
-            return typeof l === 'string' ? l : l.name;
-        }).join(',');
-    }
-
-    let tiers = '';
-    if (Array.isArray(member.tiers)) {
-        tiers = member.tiers.map((tier) => {
-            return tier.name;
-        }).join(',');
-    }
-
-    // Convert boolean 'false' to empty string for tests to pass
-    // Only comped = true should result in 'true', otherwise empty string
-    const complimentaryPlan = member.comped === true ? 'true' : '';
-
-    // Gift members carry the gift id so an exported CSV can be re-imported and reassigned
-    // back to a (possibly new) member record via the gifts table
-    const giftId = member.gift_id || '';
-
-    // Convert subscribed boolean to string representation
-    const subscribedToEmails = member.subscribed === true ? 'true' : 'false';
-
-    return {
-        id: member.id,
-        email: member.email,
-        name: member.name,
-        note: member.note,
-        subscribed_to_emails: subscribedToEmails,
-        complimentary_plan: complimentaryPlan,
-        stripe_customer_id: member.stripe_customer_id,
-        created_at: member.created_at,
-        deleted_at: member.deleted_at || null,
-        labels: labels,
-        tiers: tiers,
-        gift_id: giftId,
-        // The exporter flattens custom field values into their CSV columns, since
-        // which columns exist is a per-site question only the database can answer.
-        ...member.custom_field_cells
-    };
-}
-
 /**
  * @template PageMeta
  *
@@ -426,30 +378,16 @@ function createCSVTransform() {
         transform(member, encoding, callback) {
             try {
                 // Format the member data for CSV
-                const formattedMember = formatMemberForCSV(member);
+                const formattedMember = toExportCsvRow(member);
 
                 // For first chunk, include the headers
                 if (fields === null) {
                     fields = Object.keys(formattedMember);
-                    const csv = papaparse.unparse({
-                        fields,
-                        data: [formattedMember]
-                    }, {
-                        header: true,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: true});
                     callback(null, csv);
                 } else {
                     // For subsequent chunks, don't include headers, just the data
-                    const csv = papaparse.unparse({
-                        fields,
-                        data: [formattedMember]
-                    }, {
-                        header: false,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: false});
 
                     // Make sure each row starts with a newline to ensure separation between rows
                     // Ensure consistent line endings by using explicit CR+LF sequence
@@ -465,28 +403,21 @@ function createCSVTransform() {
 /**
  * @template PageMeta
  *
- * @param {{data: any[]|Object, filename?: string}} data
+ * @param {{data: NodeJS.ReadableStream, filename?: string}} data
  *
- * @returns {string|Function} - A CSV string or response handler function
+ * @returns {Function} - A response handler that streams the CSV
  */
 function exportCSV(data) {
     debug('exportCSV');
 
-    // Check if data.data is a stream (has the pipe method)
-    if (data.data && typeof data.data.pipe === 'function') {
-        debug('CSV stream response');
+    // The export endpoint always yields a stream (response.stream: true), so there is
+    // only ever a stream to pipe.
+    const datetime = (new Date()).toJSON().substring(0, 10);
+    const filename = data.filename || `members.${datetime}.csv`;
 
-        // Fall back to the legacy filename if the endpoint didn't provide one
-        const datetime = (new Date()).toJSON().substring(0, 10);
-        const filename = data.filename || `members.${datetime}.csv`;
-
-        return createCSVStreamResponse({
-            source: data.data,
-            transform: createCSVTransform(),
-            filename
-        });
-    }
-
-    // Otherwise use the unparse function for array data
-    return unparse(data.data);
+    return createCSVStreamResponse({
+        source: data.data,
+        transform: createCSVTransform(),
+        filename
+    });
 }

package/core/server/data/exporter/export-filename.js

@@ -3,6 +3,7 @@ const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
 const models = require('../../models');
+const path = require('path');
 
 const modelOptions = {context: {internal: true}};
 
@@ -14,7 +15,7 @@ const exportFileName = async function exportFileName(options) {
 
     // custom filename
     if (options.filename) {
-        return options.filename + '.json';
+        return path.basename(options.filename) + '.json';
     }
 
     try {

package/core/server/data/importer/importers/data/revue-subscriber-importer.js

@@ -6,7 +6,6 @@ const path = require('path');
 const fs = require('fs-extra');
 
 const config = require('../../../../../shared/config');
-const models = require('../../../../models');
 
 class RevueSubscriberImporter extends BaseImporter {
     constructor(allDataFromFile) {
@@ -38,17 +37,14 @@ class RevueSubscriberImporter extends BaseImporter {
         const outputFilePath = path.join(config.getContentPath('data'), '/', outputFileName);
         const csvData = papaparse.unparse(this.dataToImport);
 
-        const memberImporterOptions = {
-            pathToCSV: outputFilePath,
-            globalLabels: [{name: importLabel}],
-            importLabel: {name: importLabel},
-            LabelModel: models.Label,
-            forceInline: true
-        };
-
         await fs.writeFile(outputFilePath, csvData);
 
-        return membersService.processImport(memberImporterOptions);
+        // Inline: the data import has no request to hold open and needs the result now.
+        return membersService.importInline({
+            filePath: outputFilePath,
+            extraLabels: [{name: importLabel}],
+            requestUserEmail: null
+        });
     }
 }
 

package/core/server/data/importer/importers/json-to-html.js

@@ -4,6 +4,25 @@ const {cards} = require('@tryghost/kg-default-cards');
 const imageCard = cards.find(c => c.name === 'image');
 const embedCard = cards.find(c => c.name === 'embed');
 
+const getValidURL = (url) => {
+    const normalizedURL = typeof url === 'string' ? url.trim() : '';
+
+    if (!normalizedURL) {
+        return '';
+    }
+
+    try {
+        const parsedURL = new URL(normalizedURL, 'https://example.com');
+        if (parsedURL.protocol === 'http:' || parsedURL.protocol === 'https:') {
+            return normalizedURL;
+        }
+    } catch {
+        // Invalid URLs are omitted from imported links
+    }
+
+    return '';
+};
+
 // Take the array of items for a specific post and return the converted HTML
 const itemsToHtml = (items) => {
     let itemHTMLChunks = [];
@@ -30,22 +49,23 @@ const itemsToHtml = (items) => {
         } else if (type === 'link') {
             // This could be a bookmark, or it could be a paragraph of text with a linked header, there's no way to tell
             // The safest option here is to output an image with text under it
+            const itemURL = getValidURL(item.url);
             let cardOpts = {
                 env: {dom: new SimpleDom.Document()},
                 payload: {
                     src: item.image,
                     caption: item.title,
-                    href: item.url
+                    href: itemURL
                 }
             };
             itemHTMLChunks.push(serializer.serialize(imageCard.render(cardOpts)));
-
-            let linkHTML = `<h4><a href="${item.url}">${item.title}</a></h4>${item.description}`;
+            const linkTitleHTML = itemURL ? `<a href="${serializer.escapeAttrValue(itemURL)}">${item.title}</a>` : item.title;
+            let linkHTML = `<h4>${linkTitleHTML}</h4>${item.description}`;
             itemHTMLChunks.push(linkHTML);
         } else if (type === 'tweet') {
             // Should this be an oEmbed call? Probably.
             itemHTMLChunks.push(`<figure class="kg-card kg-embed-card">
-                <blockquote class="twitter-tweet"><a href="${item.url}"></a></blockquote>
+                <blockquote class="twitter-tweet"><a href="${serializer.escapeAttrValue(item.url)}"></a></blockquote>
                 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
                 </figure>`);
         } else if (type === 'video') {

package/core/server/lib/image/image-size.js

@@ -17,29 +17,15 @@ const FETCH_ONLY_FORMATS = [
 ];
 
 class ImageSize {
-    constructor({config, imageStore, storageUtils, validator, urlUtils, request, probe}) {
+    constructor({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe}) {
         this.config = config;
         this.imageStore = imageStore;
         this.storageUtils = storageUtils;
         this.validator = validator;
         this.urlUtils = urlUtils;
-        this.request = request;
+        this.fetchExternal = fetchExternal;
         this.probe = probe;
 
-        this.REQUEST_OPTIONS = {
-            // we need the user-agent, otherwise some https request may fail (e.g. cloudfare)
-            headers: {
-                'User-Agent': 'Mozilla/5.0 Safari/537.36'
-            },
-            timeout: {
-                request: this.config.get('times:getImageSizeTimeoutInMS') || 10000
-            },
-            retry: {
-                limit: 0 // for `got`, used with image-size
-            },
-            responseType: 'buffer'
-        };
-
         this.NEEDLE_OPTIONS = {
             // we need the user-agent, otherwise some https request may fail (e.g. cloudflare)
             headers: {
@@ -107,7 +93,7 @@ class ImageSize {
     // download full image then use image-size to get it's dimensions
     // returns promise which resolves dimensions
     _fetchImageSizeFromUrl(imageUrl) {
-        return this.request(imageUrl, this.REQUEST_OPTIONS).then((response) => {
+        return this.fetchExternal(imageUrl, this.NEEDLE_OPTIONS).then((response) => {
             return this._imageSizeFromBuffer(response.body);
         });
     }

package/core/server/lib/image/image-utils.js

@@ -24,10 +24,23 @@ function probe(url, options = {}, {probeImageSize: probeImageSizeFn = probeImage
     return promise;
 }
 
+// For image formats that require a full fetch. This function ensures that
+// SSRF protections are in place by using the externalRequest `got` client.
+function fetchExternal(url, options = {}) {
+    return externalRequest.get(url, {
+        headers: options.headers,
+        timeout: {
+            request: options.response_timeout || 10000
+        },
+        responseType: 'buffer',
+        retry: {limit: 0}
+    });
+}
+
 class ImageUtils {
     constructor({config, urlUtils, settingsCache, storageUtils, imageStore, validator, request, cacheStore}) {
         this.blogIcon = new BlogIcon({config, urlUtils, settingsCache, storageUtils});
-        this.imageSize = new ImageSize({config, imageStore, storageUtils, validator, urlUtils, request, probe});
+        this.imageSize = new ImageSize({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe});
         this.cachedImageSizeFromUrl = new CachedImageSizeFromUrl({
             getImageSizeFromUrl: this.imageSize.getImageSizeFromUrl.bind(this.imageSize),
             cache: cacheStore
@@ -38,3 +51,4 @@ class ImageUtils {
 
 module.exports = ImageUtils;
 module.exports.probe = probe;
+module.exports.fetchExternal = fetchExternal;

package/core/server/lib/request-external.js

@@ -248,7 +248,7 @@ function installSafeDnsLookup(options) {
     const requestHref = options.url.href;
     // Use 'lookup' (the native http.request option) rather than 'dnsLookup'
     // (got's public API property which doesn't flow to the native request).
-    options.lookup = (hostname, dnsOpts, callback) => {
+    options.dnsLookup = (hostname, dnsOpts, callback) => {
         if (typeof dnsOpts === 'function') {
             callback = dnsOpts;
             dnsOpts = {};

package/core/server/models/user.js

@@ -6,7 +6,6 @@ const limitService = require('../services/limits');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
-const {pipeline} = require('@tryghost/promise');
 const validatePassword = require('../lib/validate-password');
 const permissions = require('../services/permissions');
 const urlUtils = require('../../shared/url-utils').default;
@@ -572,91 +571,68 @@ User = ghostBookshelf.Model.extend({
      * @extends ghostBookshelf.Model.edit to handle returning the full object
      * **See:** [ghostBookshelf.Model.edit](base.js.html#edit)
      */
-    edit: function edit(data, unfilteredOptions) {
+    edit: async function edit(data, unfilteredOptions) {
         const options = this.filterOptions(unfilteredOptions, 'edit');
         const self = this;
-        const ops = [];
 
         if (data.roles && data.roles.length > 1) {
-            return Promise.reject(
-                new errors.ValidationError({
-                    message: tpl(messages.onlyOneRolePerUserSupported)
-                })
-            );
+            throw new errors.ValidationError({
+                message: tpl(messages.onlyOneRolePerUserSupported)
+            });
         }
 
         if (data.email) {
-            ops.push(function checkForDuplicateEmail() {
-                return self.getByEmail(data.email, options).then(function then(user) {
-                    if (user && user.id !== options.id) {
-                        return Promise.reject(new errors.ValidationError({
-                            message: tpl(messages.userUpdateError.emailIsAlreadyInUse)
-                        }));
-                    }
+            const existingUser = await self.getByEmail(data.email, options);
+            if (existingUser && existingUser.id !== options.id) {
+                throw new errors.ValidationError({
+                    message: tpl(messages.userUpdateError.emailIsAlreadyInUse)
                 });
-            });
+            }
         }
 
-        ops.push(function update() {
-            return ghostBookshelf.Model.edit.call(self, data, options).then(async (user) => {
-                let roleId;
+        const user = await ghostBookshelf.Model.edit.call(self, data, options);
 
-                if (!data.roles || !data.roles.length) {
-                    return user;
-                }
-
-                roleId = data.roles[0].id || data.roles[0];
-
-                return user.roles().fetch().then((roles) => {
-                    // return if the role is already assigned
-                    if (roles.models[0].id === roleId) {
-                        return;
-                    }
+        if (!data.roles || !data.roles.length) {
+            return user;
+        }
 
-                    if (ASSIGNABLE_ROLES.includes(roleId)) {
-                        // return if the role is already assigned
-                        if (roles.models[0].get('name') === roleId) {
-                            return;
-                        }
+        const roleId = data.roles[0].id || data.roles[0];
+        const roles = await user.roles().fetch();
+        let roleToAssign;
 
-                        return ghostBookshelf.model('Role').findOne({
-                            name: roleId
-                        });
-                    } else if (ObjectId.isValid(roleId)){
-                        return ghostBookshelf.model('Role').findOne({
-                            id: roleId
-                        });
-                    } else {
-                        return Promise.reject(
-                            new errors.ValidationError({
-                                message: tpl(messages.invalidRoleValue.message),
-                                context: tpl(messages.invalidRoleValue.context),
-                                help: tpl(messages.invalidRoleValue.help)
-                            })
-                        );
-                    }
-                }).then((roleToAssign) => {
-                    if (roleToAssign && roleToAssign.get('name') === 'Owner') {
-                        return Promise.reject(
-                            new errors.ValidationError({
-                                message: tpl(messages.methodDoesNotSupportOwnerRole)
-                            })
-                        );
-                    } else if (roleToAssign) {
-                        // assign all other roles
-                        return user.roles().updatePivot({role_id: roleToAssign.id});
-                    }
-                }).then(() => {
-                    options.status = 'all';
-                    return self.findOne({id: user.id}, options);
-                }).then((model) => {
-                    model._changed = user._changed;
-                    return model;
+        if (roles.models[0].id !== roleId) {
+            if (ASSIGNABLE_ROLES.includes(roleId)) {
+                if (roles.models[0].get('name') !== roleId) {
+                    roleToAssign = await ghostBookshelf.model('Role').findOne({
+                        name: roleId
+                    });
+                }
+            } else if (ObjectId.isValid(roleId)) {
+                roleToAssign = await ghostBookshelf.model('Role').findOne({
+                    id: roleId
                 });
+            } else {
+                throw new errors.ValidationError({
+                    message: tpl(messages.invalidRoleValue.message),
+                    context: tpl(messages.invalidRoleValue.context),
+                    help: tpl(messages.invalidRoleValue.help)
+                });
+            }
+        }
+
+        if (roleToAssign && roleToAssign.get('name') === 'Owner') {
+            throw new errors.ValidationError({
+                message: tpl(messages.methodDoesNotSupportOwnerRole)
             });
-        });
+        } else if (roleToAssign) {
+            // assign all other roles
+            await user.roles().updatePivot({role_id: roleToAssign.id});
+        }
 
-        return pipeline(ops);
+        options.status = 'all';
+        const model = await self.findOne({id: user.id}, options);
+        model._changed = user._changed;
+        return model;
     },
 
     /**

package/core/server/services/auth/session/session-service.js

@@ -208,7 +208,34 @@ module.exports = function createSessionService({
      * @returns {Promise<void>}
      */
     async function createSessionForUser(req, res, user) {
-        const session = await getSession(req, res);
+        const previousSession = await getSession(req, res);
+
+        // Carried over to the new session so verification state survives login
+        const {
+            user_id: previousUserId,
+            verified: previousVerified,
+            auth_code_challenge: previousAuthCodeChallenge,
+            auth_code_generated_at: previousAuthCodeGeneratedAt
+        } = previousSession;
+
+        // Ensure a new session is always created
+        await new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                resolve();
+            });
+        });
+
+        const session = req.session;
+        session.user_id = previousUserId;
+        // A different user doesn't inherit the previous user's verification
+        session.verified = previousUserId && previousUserId !== user.id ? undefined : previousVerified;
+        session.auth_code_challenge = previousAuthCodeChallenge;
+        session.auth_code_generated_at = previousAuthCodeGeneratedAt;
+
         const origin = getOriginOfRequest(req);
         await assignUserToSession({
             session,

package/core/server/services/automations/automations-api.js

@@ -47,8 +47,8 @@ const waitActionSchema = zod_1.z.object({
     type: zod_1.z.literal('wait'),
     data: zod_1.z.object({
         wait_hours: zod_1.z.number().int().positive()
-    }).strict()
-}).strict();
+    })
+});
 const sendEmailActionSchema = zod_1.z.object({
     id: objectIdSchema,
     type: zod_1.z.literal('send_email'),
@@ -56,12 +56,12 @@ const sendEmailActionSchema = zod_1.z.object({
         email_subject: zod_1.z.string(),
         email_lexical: zod_1.z.string(),
         email_design_setting_id: zod_1.z.string().min(1)
-    }).strict()
-}).strict();
+    })
+});
 const edgeSchema = zod_1.z.object({
     source_action_id: objectIdSchema,
     target_action_id: objectIdSchema
-}).strict();
+});
 const editAutomationDataSchema = zod_1.z.object({
     status: zod_1.z.enum(['active', 'inactive']),
     actions: zod_1.z.array(zod_1.z.discriminatedUnion('type', [
@@ -69,7 +69,7 @@ const editAutomationDataSchema = zod_1.z.object({
         sendEmailActionSchema
     ])).min(1).max(MAX_AUTOMATION_ACTIONS),
     edges: zod_1.z.array(edgeSchema)
-}).strict();
+});
 const repository = (0, database_automations_repository_1.createDatabaseAutomationsRepository)({
     knex,
     fakeWaitHoursMultiplier: (0, fake_wait_hours_multiplier_1.parseFakeWaitHoursMultiplier)(config.get('automations:fakeWaitHoursMultiplier'))

package/core/server/services/automations/automations-api.ts

@@ -39,8 +39,8 @@ const waitActionSchema = z.object({
     type: z.literal('wait'),
     data: z.object({
         wait_hours: z.number().int().positive()
-    }).strict()
-}).strict();
+    })
+});
 
 const sendEmailActionSchema = z.object({
     id: objectIdSchema,
@@ -49,13 +49,13 @@ const sendEmailActionSchema = z.object({
         email_subject: z.string(),
         email_lexical: z.string(),
         email_design_setting_id: z.string().min(1)
-    }).strict()
-}).strict();
+    })
+});
 
 const edgeSchema = z.object({
     source_action_id: objectIdSchema,
     target_action_id: objectIdSchema
-}).strict();
+});
 
 const editAutomationDataSchema = z.object({
     status: z.enum(['active', 'inactive']),
@@ -64,7 +64,7 @@ const editAutomationDataSchema = z.object({
         sendEmailActionSchema
     ])).min(1).max(MAX_AUTOMATION_ACTIONS),
     edges: z.array(edgeSchema)
-}).strict();
+});
 
 const repository = createDatabaseAutomationsRepository({
     knex,

package/core/server/services/automations/automations-repository.ts

@@ -25,6 +25,7 @@ export interface WaitAction {
 }
 
 export interface AutomationEmailStats {
+    email_clicked_count: number;
     email_sent_count: number;
     email_opened_count: number;
     opened_rate: number | null;

package/core/server/services/automations/database-automations-repository.js

@@ -902,6 +902,7 @@ async function loadActionStats(trx, actionIds) {
     const rows = await trx('automation_action_revisions')
         .select('action_id')
         .sum({
+        email_clicked_count: 'email_clicked_count',
         email_sent_count: 'email_sent_count',
         email_opened_count: 'email_opened_count'
     })
@@ -953,22 +954,26 @@ function buildActionPayload(row, stats) {
     }
 }
 const EMPTY_EMAIL_STATS = {
+    email_clicked_count: 0,
     email_sent_count: 0,
     email_opened_count: 0,
     opened_rate: null,
     clicked_rate: null
 };
 function buildEmailStats(row) {
+    const emailClickedCount = row.email_clicked_count ?? 0;
     const emailSentCount = row.email_sent_count ?? 0;
     const emailOpenedCount = row.email_opened_count ?? 0;
     return {
+        email_clicked_count: emailClickedCount,
         email_sent_count: emailSentCount,
         email_opened_count: emailOpenedCount,
         opened_rate: emailSentCount
             ? Math.round(emailOpenedCount / emailSentCount * 100)
             : null,
-        // TODO(NY-1387) Populate clicked_rate once click tracking is implemented.
-        clicked_rate: null
+        clicked_rate: emailSentCount
+            ? Math.round(emailClickedCount / emailSentCount * 100)
+            : null
     };
 }
 function requireValue(row, field) {