ghost 6.54.0 → 6.55.0

package/core/server/api/endpoints/members.js

@@ -3,14 +3,27 @@
 const moment = require('moment-timezone');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
-const models = require('../../models');
 const membersService = require('../../services/members');
 
-const settingsCache = require('../../../shared/settings-cache');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 
+// Shape the import service's outcome into the API response envelope: an inline import
+// reports its stats and label, a deferred one only how much it accepted.
+function importCSVResponse(outcome) {
+    if (outcome.deferred) {
+        return {meta: {originalImportSize: outcome.originalImportSize}};
+    }
+    return {
+        meta: {
+            originalImportSize: outcome.originalImportSize,
+            stats: {imported: outcome.result.imported, invalid: outcome.result.errors},
+            import_label: outcome.result.importLabel || null
+        }
+    };
+}
+
 const messages = {
     memberNotFound: 'Member not found.',
     notSendingWelcomeEmail: 'Email verification required, welcome email is disabled',
@@ -418,33 +431,17 @@ const controller = {
             method: 'add'
         },
         async query(frame) {
-            const siteTimezone = settingsCache.get('timezone');
-
-            const importLabel = {
-                name: `Import ${moment().tz(siteTimezone).format('YYYY-MM-DD HH:mm')}`
-            };
-
-            const globalLabels = [importLabel].concat(frame.data.labels);
-            const pathToCSV = frame.file.path;
-            const headerMapping = frame.data.mapping;
-
-            let email;
-            if (frame.user) {
-                email = frame.user.get('email');
-            } else {
-                email = (await models.User.getOwnerUser()).get('email');
-            }
-
-            return membersService.processImport({
-                pathToCSV,
-                headerMapping,
-                globalLabels,
-                importLabel,
-                LabelModel: models.Label,
-                user: {
-                    email: email
-                }
+            // The endpoint adapts the request frame into the import service's arguments
+            // and shapes its outcome into the response envelope, so neither the frame nor
+            // the meta shape crosses into the domain. The recipient is the request user;
+            // the service falls back to the site owner when there is none.
+            const outcome = await membersService.importCSV({
+                filePath: frame.file.path,
+                mapping: frame.data.mapping,
+                extraLabels: frame.data.labels || [],
+                requestUserEmail: frame.user ? frame.user.get('email') : null
             });
+            return importCSVResponse(outcome);
         }
     },
 

package/core/server/api/endpoints/pages.js

@@ -2,6 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.paid_conversions', 'post_revisions', 'post_revisions.author'];
 const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];
 
@@ -44,7 +45,11 @@ const controller = {
             unsafeAttrs: UNSAFE_ATTRS
         },
         query(frame) {
-            return models.Post.findPage(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return models.Post.findPage(options);
         }
     },
 

package/core/server/api/endpoints/posts.js

@@ -2,6 +2,7 @@ const urlUtils = require('../../../shared/url-utils').default;
 const models = require('../../models');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const allowedIncludes = [
     'tags',
     'authors',
@@ -78,7 +79,11 @@ const controller = {
             unsafeAttrs: unsafeAttrs
         },
         query(frame) {
-            return postsService.browsePosts(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return postsService.browsePosts(options);
         }
     },
 
@@ -106,8 +111,12 @@ const controller = {
         },
         validation: {},
         async query(frame) {
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
             return {
-                data: await postsService.export(frame),
+                data: await postsService.export(options),
                 filename: getCSVExportFileName('analytics')
             };
         }

package/core/server/api/endpoints/settings.js

@@ -174,8 +174,6 @@ const controller = {
         async query(frame) {
             const content = await fs.readFile(frame.file.path, 'utf8');
             await routeSettings.api.upload(content);
-            const getRoutesHash = () => routeSettings.api.getCurrentHash();
-            await settingsService.syncRoutesHash(getRoutesHash);
         }
     },
 

package/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -120,7 +120,10 @@ const commentMapper = (model, frame) => {
 
     if (jsonModel.post) {
         // We could use the post mapper here, but we need less field + don't need all the async behavior support
-        url.forPost(jsonModel.post.id, jsonModel.post, frame);
+        // Comments live on pages as well as posts; the URL service routes by
+        // the passed type, so a page typed 'posts' resolves to /404/.
+        const routerType = jsonModel.post.type === 'page' ? 'pages' : 'posts';
+        url.forPost(jsonModel.post.id, jsonModel.post, frame, routerType);
         response.post = _.pick(jsonModel.post, postFields);
 
         // Compute excerpt from custom_excerpt or plaintext (same logic as post serializer)

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -1,10 +1,12 @@
 //@ts-check
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:members');
-const {unparse} = require('../../../../../services/members/csv');
+const {serialize: serializeCSV} = require('../../../../../services/members/import-export/csv');
+// The export CSV row shape and its encode live in the domain (typed against the export
+// row) rather than here, so a change to the export row is caught by the compiler.
+const {toExportCsvRow} = require('../../../../../services/members/import-export/export/exporter');
 const mappers = require('./mappers');
 const {Transform} = require('stream');
-const papaparse = require('papaparse');
 const {createCSVStreamResponse} = require('./stream-csv-response');
 module.exports = {
     browse: createSerializer('browse', paginatedMembers),
@@ -25,56 +27,6 @@ module.exports = {
     activityFeed: createSerializer('activityFeed', activityFeed)
 };
 
-/**
- * Formats a single member for CSV export
- * @param {Object} member - Member object
- * @returns {Object} Formatted member
- */
-function formatMemberForCSV(member) {
-    let labels = '';
-    if (Array.isArray(member.labels)) {
-        labels = member.labels.map((l) => {
-            return typeof l === 'string' ? l : l.name;
-        }).join(',');
-    }
-
-    let tiers = '';
-    if (Array.isArray(member.tiers)) {
-        tiers = member.tiers.map((tier) => {
-            return tier.name;
-        }).join(',');
-    }
-
-    // Convert boolean 'false' to empty string for tests to pass
-    // Only comped = true should result in 'true', otherwise empty string
-    const complimentaryPlan = member.comped === true ? 'true' : '';
-
-    // Gift members carry the gift id so an exported CSV can be re-imported and reassigned
-    // back to a (possibly new) member record via the gifts table
-    const giftId = member.gift_id || '';
-
-    // Convert subscribed boolean to string representation
-    const subscribedToEmails = member.subscribed === true ? 'true' : 'false';
-
-    return {
-        id: member.id,
-        email: member.email,
-        name: member.name,
-        note: member.note,
-        subscribed_to_emails: subscribedToEmails,
-        complimentary_plan: complimentaryPlan,
-        stripe_customer_id: member.stripe_customer_id,
-        created_at: member.created_at,
-        deleted_at: member.deleted_at || null,
-        labels: labels,
-        tiers: tiers,
-        gift_id: giftId,
-        // The exporter flattens custom field values into their CSV columns, since
-        // which columns exist is a per-site question only the database can answer.
-        ...member.custom_field_cells
-    };
-}
-
 /**
  * @template PageMeta
  *
@@ -426,30 +378,16 @@ function createCSVTransform() {
         transform(member, encoding, callback) {
             try {
                 // Format the member data for CSV
-                const formattedMember = formatMemberForCSV(member);
+                const formattedMember = toExportCsvRow(member);
 
                 // For first chunk, include the headers
                 if (fields === null) {
                     fields = Object.keys(formattedMember);
-                    const csv = papaparse.unparse({
-                        fields,
-                        data: [formattedMember]
-                    }, {
-                        header: true,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: true});
                     callback(null, csv);
                 } else {
                     // For subsequent chunks, don't include headers, just the data
-                    const csv = papaparse.unparse({
-                        fields,
-                        data: [formattedMember]
-                    }, {
-                        header: false,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: false});
 
                     // Make sure each row starts with a newline to ensure separation between rows
                     // Ensure consistent line endings by using explicit CR+LF sequence
@@ -465,28 +403,21 @@ function createCSVTransform() {
 /**
  * @template PageMeta
  *
- * @param {{data: any[]|Object, filename?: string}} data
+ * @param {{data: NodeJS.ReadableStream, filename?: string}} data
  *
- * @returns {string|Function} - A CSV string or response handler function
+ * @returns {Function} - A response handler that streams the CSV
  */
 function exportCSV(data) {
     debug('exportCSV');
 
-    // Check if data.data is a stream (has the pipe method)
-    if (data.data && typeof data.data.pipe === 'function') {
-        debug('CSV stream response');
+    // The export endpoint always yields a stream (response.stream: true), so there is
+    // only ever a stream to pipe.
+    const datetime = (new Date()).toJSON().substring(0, 10);
+    const filename = data.filename || `members.${datetime}.csv`;
 
-        // Fall back to the legacy filename if the endpoint didn't provide one
-        const datetime = (new Date()).toJSON().substring(0, 10);
-        const filename = data.filename || `members.${datetime}.csv`;
-
-        return createCSVStreamResponse({
-            source: data.data,
-            transform: createCSVTransform(),
-            filename
-        });
-    }
-
-    // Otherwise use the unparse function for array data
-    return unparse(data.data);
+    return createCSVStreamResponse({
+        source: data.data,
+        transform: createCSVTransform(),
+        filename
+    });
 }

package/core/server/api/endpoints/utils/serializers/output/utils/url.js

@@ -24,7 +24,17 @@ const forPost = (id, attrs, frame, type = 'posts') => {
         return attrs;
     }
 
-    attrs.url = urlService.facade.getUrlForResource({...attrs, id, type}, {absolute: true});
+    // Diagnostic only: hand the compare-mode URL service the producing api
+    // endpoint. The parity/thin-resource logs capture a caller stack, but it
+    // truncates at the async api-framework boundary and never names the
+    // endpoint; the api-framework Frame carries it, so pass it through. Omitted
+    // for non-api callers (mentions, email) whose frame has no endpoint fields.
+    const options = {absolute: true};
+    if (frame && (frame.docName || frame.method)) {
+        options.serializerContext = {apiType: frame.apiType, docName: frame.docName, method: frame.method};
+    }
+
+    attrs.url = urlService.facade.getUrlForResource({...attrs, id, type}, options);
 
     /**
      * CASE: admin api should serve preview urls

package/core/server/data/exporter/export-filename.js

@@ -3,6 +3,7 @@ const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
 const models = require('../../models');
+const path = require('path');
 
 const modelOptions = {context: {internal: true}};
 
@@ -14,7 +15,7 @@ const exportFileName = async function exportFileName(options) {
 
     // custom filename
     if (options.filename) {
-        return options.filename + '.json';
+        return path.basename(options.filename) + '.json';
     }
 
     try {

package/core/server/data/importer/importers/data/revue-subscriber-importer.js

@@ -6,7 +6,6 @@ const path = require('path');
 const fs = require('fs-extra');
 
 const config = require('../../../../../shared/config');
-const models = require('../../../../models');
 
 class RevueSubscriberImporter extends BaseImporter {
     constructor(allDataFromFile) {
@@ -38,17 +37,14 @@ class RevueSubscriberImporter extends BaseImporter {
         const outputFilePath = path.join(config.getContentPath('data'), '/', outputFileName);
         const csvData = papaparse.unparse(this.dataToImport);
 
-        const memberImporterOptions = {
-            pathToCSV: outputFilePath,
-            globalLabels: [{name: importLabel}],
-            importLabel: {name: importLabel},
-            LabelModel: models.Label,
-            forceInline: true
-        };
-
         await fs.writeFile(outputFilePath, csvData);
 
-        return membersService.processImport(memberImporterOptions);
+        // Inline: the data import has no request to hold open and needs the result now.
+        return membersService.importInline({
+            filePath: outputFilePath,
+            extraLabels: [{name: importLabel}],
+            requestUserEmail: null
+        });
     }
 }
 

package/core/server/data/importer/importers/json-to-html.js

@@ -4,6 +4,25 @@ const {cards} = require('@tryghost/kg-default-cards');
 const imageCard = cards.find(c => c.name === 'image');
 const embedCard = cards.find(c => c.name === 'embed');
 
+const getValidURL = (url) => {
+    const normalizedURL = typeof url === 'string' ? url.trim() : '';
+
+    if (!normalizedURL) {
+        return '';
+    }
+
+    try {
+        const parsedURL = new URL(normalizedURL, 'https://example.com');
+        if (parsedURL.protocol === 'http:' || parsedURL.protocol === 'https:') {
+            return normalizedURL;
+        }
+    } catch {
+        // Invalid URLs are omitted from imported links
+    }
+
+    return '';
+};
+
 // Take the array of items for a specific post and return the converted HTML
 const itemsToHtml = (items) => {
     let itemHTMLChunks = [];
@@ -30,22 +49,23 @@ const itemsToHtml = (items) => {
         } else if (type === 'link') {
             // This could be a bookmark, or it could be a paragraph of text with a linked header, there's no way to tell
             // The safest option here is to output an image with text under it
+            const itemURL = getValidURL(item.url);
             let cardOpts = {
                 env: {dom: new SimpleDom.Document()},
                 payload: {
                     src: item.image,
                     caption: item.title,
-                    href: item.url
+                    href: itemURL
                 }
             };
             itemHTMLChunks.push(serializer.serialize(imageCard.render(cardOpts)));
-
-            let linkHTML = `<h4><a href="${item.url}">${item.title}</a></h4>${item.description}`;
+            const linkTitleHTML = itemURL ? `<a href="${serializer.escapeAttrValue(itemURL)}">${item.title}</a>` : item.title;
+            let linkHTML = `<h4>${linkTitleHTML}</h4>${item.description}`;
             itemHTMLChunks.push(linkHTML);
         } else if (type === 'tweet') {
             // Should this be an oEmbed call? Probably.
             itemHTMLChunks.push(`<figure class="kg-card kg-embed-card">
-                <blockquote class="twitter-tweet"><a href="${item.url}"></a></blockquote>
+                <blockquote class="twitter-tweet"><a href="${serializer.escapeAttrValue(item.url)}"></a></blockquote>
                 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
                 </figure>`);
         } else if (type === 'video') {

package/core/server/data/migrations/versions/6.55/2026-07-27-11-25-44-add-to-hash-to-redirects.js

@@ -0,0 +1,51 @@
+const logging = require('@tryghost/logging');
+const {combineNonTransactionalMigrations, createAddColumnMigration, createNonTransactionalMigration} = require('../../utils');
+const {addIndex, addUnique, dropIndex, dropUnique, getIndexes} = require('../../../schema/commands');
+
+const uniqueColumns = ['automation_action_revision_id', 'to_hash'];
+const leftoverIndexName = 'redirects_automation_action_revision_id_index';
+
+module.exports = combineNonTransactionalMigrations(
+    createAddColumnMigration('redirects', 'to_hash', {
+        type: 'binary',
+        maxlength: 32,
+        nullable: true
+    }, {algorithm: 'auto'}),
+    createNonTransactionalMigration(
+        async function up(knex) {
+            await addUnique('redirects', uniqueColumns, knex);
+
+            // A previous down() leaves a standalone index behind (see below).
+            // InnoDB drops the index it created for the foreign key itself once
+            // the composite unique can serve the constraint, but not one we
+            // created, so drop it here to keep a rolled-back-and-remigrated
+            // database in the same shape as every other one.
+            const indexes = await getIndexes('redirects', knex);
+
+            if (indexes.includes(leftoverIndexName)) {
+                await dropIndex('redirects', ['automation_action_revision_id'], knex);
+            }
+        },
+        async function down(knex) {
+            try {
+                await dropUnique('redirects', uniqueColumns, knex);
+            } catch (err) {
+                // The composite unique ends up as the only index covering the
+                // automation_action_revision_id FK: fresh installs create it
+                // that way, and on upgrades InnoDB drops the FK's own index
+                // once the composite can serve the constraint. MySQL won't
+                // drop the last index a foreign key depends on, so re-add a
+                // single-column one when it objects.
+                if (err.code === 'ER_DROP_INDEX_FK') {
+                    logging.warn('Cannot drop unique constraint over redirects(automation_action_revision_id, to_hash) while it backs the foreign key, re-adding index for automation_action_revision_id');
+
+                    await addIndex('redirects', ['automation_action_revision_id'], knex);
+                    await dropUnique('redirects', uniqueColumns, knex);
+                    return;
+                }
+
+                throw err;
+            }
+        }
+    )
+);

package/core/server/data/migrations/versions/6.55/2026-07-28-12-08-00-remove-routes-hash-from-settings.js

@@ -0,0 +1,5 @@
+const {combineTransactionalMigrations, removeSetting} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    removeSetting('routes_hash')
+);

package/core/server/data/schema/commands.js

@@ -25,6 +25,11 @@ function addTableColumn(tableName, tableBuilder, columnName, columnSpec = schema
     // creation distinguishes between text with fieldtype, string with maxlength and all others
     if (columnSpec.type === 'text' && Object.prototype.hasOwnProperty.call(columnSpec, 'fieldtype')) {
         column = tableBuilder[columnSpec.type](columnName, columnSpec.fieldtype);
+    } else if (columnSpec.type === 'binary' && Object.prototype.hasOwnProperty.call(columnSpec, 'maxlength')) {
+        // knex emits an unbounded `blob` for a length-less binary column, which
+        // MySQL can only index with a prefix. Passing the length gives us
+        // `varbinary(N)`, which is indexable in full.
+        column = tableBuilder[columnSpec.type](columnName, columnSpec.maxlength);
     } else if (columnSpec.type === 'string') {
         if (Object.prototype.hasOwnProperty.call(columnSpec, 'maxlength')) {
             column = tableBuilder[columnSpec.type](columnName, columnSpec.maxlength);

package/core/server/data/schema/default-settings/default-settings.json

@@ -8,10 +8,6 @@
             "defaultValue": null,
             "type": "string"
         },
-        "routes_hash": {
-            "defaultValue": null,
-            "type": "string"
-        },
         "next_update_check": {
             "defaultValue": null,
             "type": "number"

package/core/server/data/schema/schema.js

@@ -1263,8 +1263,12 @@ module.exports = {
         to: {type: 'string', maxlength: 2000, nullable: false},
         post_id: {type: 'string', maxlength: 24, nullable: true, unique: false, references: 'posts.id', setNullDelete: true},
         automation_action_revision_id: {type: 'string', maxlength: 24, nullable: true, references: 'automation_action_revisions.id', setNullDelete: true},
+        to_hash: {type: 'binary', maxlength: 32, nullable: true},
         created_at: {type: 'dateTime', nullable: false},
-        updated_at: {type: 'dateTime', nullable: true}
+        updated_at: {type: 'dateTime', nullable: true},
+        '@@UNIQUE_CONSTRAINTS@@': [
+            ['automation_action_revision_id', 'to_hash']
+        ]
     },
     members_click_events: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},

package/core/server/lib/image/image-size.js

@@ -17,29 +17,15 @@ const FETCH_ONLY_FORMATS = [
 ];
 
 class ImageSize {
-    constructor({config, imageStore, storageUtils, validator, urlUtils, request, probe}) {
+    constructor({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe}) {
         this.config = config;
         this.imageStore = imageStore;
         this.storageUtils = storageUtils;
         this.validator = validator;
         this.urlUtils = urlUtils;
-        this.request = request;
+        this.fetchExternal = fetchExternal;
         this.probe = probe;
 
-        this.REQUEST_OPTIONS = {
-            // we need the user-agent, otherwise some https request may fail (e.g. cloudfare)
-            headers: {
-                'User-Agent': 'Mozilla/5.0 Safari/537.36'
-            },
-            timeout: {
-                request: this.config.get('times:getImageSizeTimeoutInMS') || 10000
-            },
-            retry: {
-                limit: 0 // for `got`, used with image-size
-            },
-            responseType: 'buffer'
-        };
-
         this.NEEDLE_OPTIONS = {
             // we need the user-agent, otherwise some https request may fail (e.g. cloudflare)
             headers: {
@@ -107,7 +93,7 @@ class ImageSize {
     // download full image then use image-size to get it's dimensions
     // returns promise which resolves dimensions
     _fetchImageSizeFromUrl(imageUrl) {
-        return this.request(imageUrl, this.REQUEST_OPTIONS).then((response) => {
+        return this.fetchExternal(imageUrl, this.NEEDLE_OPTIONS).then((response) => {
             return this._imageSizeFromBuffer(response.body);
         });
     }

package/core/server/lib/image/image-utils.js

@@ -24,10 +24,23 @@ function probe(url, options = {}, {probeImageSize: probeImageSizeFn = probeImage
     return promise;
 }
 
+// For image formats that require a full fetch. This function ensures that
+// SSRF protections are in place by using the externalRequest `got` client.
+function fetchExternal(url, options = {}) {
+    return externalRequest.get(url, {
+        headers: options.headers,
+        timeout: {
+            request: options.response_timeout || 10000
+        },
+        responseType: 'buffer',
+        retry: {limit: 0}
+    });
+}
+
 class ImageUtils {
     constructor({config, urlUtils, settingsCache, storageUtils, imageStore, validator, request, cacheStore}) {
         this.blogIcon = new BlogIcon({config, urlUtils, settingsCache, storageUtils});
-        this.imageSize = new ImageSize({config, imageStore, storageUtils, validator, urlUtils, request, probe});
+        this.imageSize = new ImageSize({config, imageStore, storageUtils, validator, urlUtils, fetchExternal, probe});
         this.cachedImageSizeFromUrl = new CachedImageSizeFromUrl({
             getImageSizeFromUrl: this.imageSize.getImageSizeFromUrl.bind(this.imageSize),
             cache: cacheStore
@@ -38,3 +51,4 @@ class ImageUtils {
 
 module.exports = ImageUtils;
 module.exports.probe = probe;
+module.exports.fetchExternal = fetchExternal;

package/core/server/lib/request-external.js

@@ -248,7 +248,7 @@ function installSafeDnsLookup(options) {
     const requestHref = options.url.href;
     // Use 'lookup' (the native http.request option) rather than 'dnsLookup'
     // (got's public API property which doesn't flow to the native request).
-    options.lookup = (hostname, dnsOpts, callback) => {
+    options.dnsLookup = (hostname, dnsOpts, callback) => {
         if (typeof dnsOpts === 'function') {
             callback = dnsOpts;
             dnsOpts = {};