ghost 6.62.0 → 6.64.0

package/core/server/adapters/storage/LocalStorageBase.js

@@ -197,6 +197,17 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
             return false;
         }
     }
+    /**
+     * Sets response headers for a file about to be served from local storage.
+     * `send` only derives Content-Type from the extension when it hasn't been
+     * set yet, so subclasses can override this to enforce their own type.
+     *
+     * `nosniff` stops browsers from second-guessing the declared Content-Type
+     * based on the file's contents.
+     */
+    setServeHeaders(res, _filePath) {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+    }
     /**
      * For some reason send divides the max age number by 1000
      * Fallthrough: false ensures that if an image isn't found, it automatically 404s
@@ -204,10 +215,12 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
      */
     serve() {
         const { storagePath, errorMessages } = this;
+        const setHeaders = (res, filePath) => this.setServeHeaders(res, filePath);
         return function serveStaticContent(req, res, next) {
             return serveStatic(storagePath, {
                 maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year in ms
                 fallthrough: false,
+                setHeaders,
             })(req, res, (err) => {
                 if (err) {
                     if (err.statusCode === 404) {

package/core/server/api/endpoints/actions.js

@@ -1,4 +1,5 @@
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +12,7 @@ const controller = {
     options: ['page', 'limit', 'fields', 'include', 'filter'],
     permissions: true,
     query(frame) {
-      return models.Action.findPage(frame.options);
+      return models.Action.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 };

package/core/server/api/endpoints/authentication.js

@@ -7,11 +7,10 @@ const web = require('../../web');
 const models = require('../../models');
 const auth = require('../../services/auth');
 const invitations = require('../../services/invitations');
-const dbBackup = require('../../data/db/backup');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const UsersService = require('../../services/users');
-const userService = new UsersService({ dbBackup, models, auth, apiMail, apiSettings });
+const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const adapterManager = require('../../services/adapter-manager').default;
 const schedulerAdapter = adapterManager.getAdapter('scheduling');
 

package/core/server/api/endpoints/authors-public.js

@@ -1,12 +1,15 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectAuthorsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
+const ALLOWED_READ_FIELDS = ['id', 'slug'];
 
 const messages = {
   notFound: 'Author not found.',
+  missingIdentifier: 'An author id or slug is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -29,7 +32,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectAuthorsContentApiRestrictedFieldsTransformer,
       };
       return models.Author.findPage(options);
     },
@@ -40,7 +43,7 @@ const controller = {
       cacheInvalidate: false,
     },
     options: ['include', 'filter', 'fields'],
-    data: ['id', 'slug', 'email', 'role'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -50,12 +53,19 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectAuthorsContentApiRestrictedFieldsTransformer,
       };
 
-      const model = await models.Author.findOne(frame.data, options);
+      const model = await models.Author.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.notFound),

package/core/server/api/endpoints/automated-emails.js

@@ -8,6 +8,7 @@ const {
   DEFAULT_EMAIL_DESIGN_SETTING_SLUG,
 } = require('../../services/member-welcome-emails/constants');
 const { validateEmailSenderFields } = require('./utils/validate-email-sender-fields');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   automatedEmailNotFound: 'Automated email not found.',
@@ -97,7 +98,7 @@ const controller = {
     permissions: true,
     async query(frame) {
       const result = await models.Automation.findPage({
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',
@@ -122,7 +123,7 @@ const controller = {
     permissions: true,
     async query(frame) {
       const model = await models.Automation.findOne(frame.data, {
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',

package/core/server/api/endpoints/automations.js

@@ -1,54 +1,82 @@
-const automationsApi = require('../../services/automations/automations-api');
-
-/** @type {import('@tryghost/api-framework').Controller} */
-const controller = {
-  docName: 'automations',
-
-  browse: {
-    headers: {
-      cacheInvalidate: false,
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.controller = void 0;
+const automationsApi = __importStar(require("../../services/automations/automations-api"));
+exports.controller = {
+    docName: 'automations',
+    browse: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: true,
+        async query() {
+            return await automationsApi.browse();
+        },
     },
-    permissions: true,
-    async query() {
-      return await automationsApi.browse();
+    read: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        data: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.read(frame.data.id);
+        },
     },
-  },
-
-  read: {
-    headers: {
-      cacheInvalidate: false,
+    edit: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        options: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
+        },
     },
-    data: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.read(frame.data.id);
+    poll: {
+        statusCode: 204,
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'poll',
+        },
+        query() {
+            automationsApi.requestPoll();
+        },
     },
-  },
-
-  edit: {
-    headers: {
-      cacheInvalidate: false,
-    },
-    options: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
-    },
-  },
-
-  poll: {
-    statusCode: 204,
-    headers: {
-      cacheInvalidate: false,
-    },
-    permissions: {
-      docName: 'automations',
-      method: 'poll',
-    },
-    query() {
-      automationsApi.requestPoll();
-    },
-  },
 };
-
-module.exports = controller;

package/core/server/api/endpoints/emails.js

@@ -3,6 +3,7 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const emailService = require('../../services/email-service');
 const emailAnalytics = require('../../services/email-analytics');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   emailNotFound: 'Email not found.',
@@ -23,7 +24,7 @@ const controller = {
     options: ['limit', 'fields', 'filter', 'order', 'page'],
     permissions: true,
     async query(frame) {
-      return await models.Email.findPage(frame.options);
+      return await models.Email.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -51,6 +52,19 @@ const controller = {
     },
   },
 
+  sendingStatus: {
+    headers: {
+      cacheInvalidate: false,
+    },
+    data: ['id'],
+    permissions: {
+      method: 'read',
+    },
+    async query(frame) {
+      return await emailService.controller.getSendingStatus(frame);
+    },
+  },
+
   retry: {
     headers: {
       cacheInvalidate: false,
@@ -81,7 +95,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailBatch.findPage({ ...frame.options, filter });
+      return await models.EmailBatch.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 
@@ -104,7 +120,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailRecipientFailure.findPage({ ...frame.options, filter });
+      return await models.EmailRecipientFailure.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 

package/core/server/api/endpoints/index.js

@@ -8,7 +8,7 @@ const localUtils = require('./utils');
 
 module.exports = {
   get automations() {
-    return apiFramework.pipeline(require('./automations'), localUtils);
+    return apiFramework.pipeline(require('./automations').controller, localUtils);
   },
 
   get automationActionLinks() {
@@ -312,6 +312,14 @@ module.exports = {
     return apiFramework.pipeline(require('./feedback-members'), localUtils, 'members');
   },
 
+  get membersAccount() {
+    return apiFramework.pipeline(require('./members-account'), localUtils, 'members');
+  },
+
+  get memberMetafieldsMembers() {
+    return apiFramework.pipeline(require('./member-metafields-members'), localUtils, 'members');
+  },
+
   get giftsMembers() {
     return apiFramework.pipeline(require('./gifts-members'), localUtils, 'members');
   },

package/core/server/api/endpoints/invites.js

@@ -3,6 +3,7 @@ const errors = require('@tryghost/errors');
 const invites = require('../../services/invites');
 const models = require('../../models');
 const api = require('./index');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = [];
 const UNSAFE_ATTRS = ['role_id'];
 
@@ -26,7 +27,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Invite.findPage(frame.options);
+      return models.Invite.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/labels.js

@@ -1,6 +1,7 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   labelNotFound: 'Label not found.',
@@ -42,7 +43,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Label.findPage(frame.options);
+      return models.Label.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -61,7 +62,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.Label.findOne(frame.data, frame.options);
+      const model = await models.Label.findOne(
+        frame.data,
+        restrictAdminApiQueryOptions(frame.options),
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.labelNotFound),

package/core/server/api/endpoints/member-metafields-members.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const members_metafields_1 = require("../../services/members-metafields");
+const controller = {
+    // The Admin resource's name, so the response Portal reads is the one Admin's
+    // serializer already produces. Only who may ask differs, and that is the route's
+    // business rather than the response's.
+    docName: 'members_metafields',
+    browse: {
+        headers: { cacheInvalidate: false },
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
+        permissions: false,
+        query(frame) {
+            // No `filter`, which Admin offers: whether a field is archived is a
+            // publisher's business, and a member is only ever shown what they can still
+            // fill in.
+            return members_metafields_1.definitions.browse({ namespace: frame.options.namespace }, members_metafields_1.MEMBERS);
+        },
+    },
+};
+exports.default = controller;
+module.exports = controller;

package/core/server/api/endpoints/member-metafields.js

@@ -1,13 +1,30 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const members_custom_fields_1 = require("../../services/members-custom-fields");
+const members_metafields_1 = require("../../services/members-metafields");
+const namespaces_1 = require("../../services/members-metafields/namespaces");
 const permissionsService = require('../../services/permissions');
-// With `permissions: true` the framework checks against the Bookshelf model named after
-// the resource. These fields have no Bookshelf model, so each handler asks the permissions
-// service directly.
+// Reading a definition needs no permission. A definition says only that the site collects
+// a shoe size, and every signed-in member is already shown the whole list, so there is
+// nothing here to keep from staff. Defining one is the publisher's own, and with
+// `permissions: true` the framework would check against the Bookshelf model named after
+// the resource — these fields have no Bookshelf model, so each writing handler asks the
+// permissions service directly.
 function canThis(frame) {
     return permissionsService.canThis(frame.options.context);
 }
+/**
+ * Settle the namespace before the caller.
+ *
+ * Which namespace is being written to decides whose authority applies, so it is resolved
+ * first; only once the publisher turns out to own it does a staff role become the
+ * question. The other order answers a request to define a field somewhere nobody owns
+ * with "you lack a permission", which sends the caller after a permission that would not
+ * have helped.
+ */
+async function canDefine(frame, action) {
+    (0, namespaces_1.assertDefinable)(frame.options.namespace);
+    return action(frame);
+}
 const noCacheInvalidation = { cacheInvalidate: false };
 const controller = {
     docName: 'members_metafields',
@@ -15,25 +32,21 @@ const controller = {
         headers: noCacheInvalidation,
         options: ['namespace', 'filter'],
         validation: { options: { namespace: { required: true } } },
-        permissions(frame) {
-            return canThis(frame).browse.member_custom_field();
-        },
+        permissions: false,
         query(frame) {
-            return members_custom_fields_1.definitions.browse({
+            return members_metafields_1.definitions.browse({
                 namespace: frame.options.namespace,
                 filter: frame.options.filter,
-            });
+            }, members_metafields_1.ADMIN);
         },
     },
     read: {
         headers: noCacheInvalidation,
         options: ['namespace', 'key'],
         validation: { options: { namespace: { required: true }, key: { required: true } } },
-        permissions(frame) {
-            return canThis(frame).read.member_custom_field(frame.options.key);
-        },
+        permissions: false,
         query(frame) {
-            return members_custom_fields_1.definitions.read(frame.options.namespace, frame.options.key);
+            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key, members_metafields_1.ADMIN);
         },
     },
     add: {
@@ -42,10 +55,10 @@ const controller = {
         options: ['namespace'],
         validation: { options: { namespace: { required: true } } },
         permissions(frame) {
-            return canThis(frame).add.member_custom_field();
+            return canDefine(frame, (f) => canThis(f).add.member_custom_field());
         },
         query(frame) {
-            return members_custom_fields_1.definitions.add((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
+            return members_metafields_1.definitions.add((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
         },
     },
     reorder: {
@@ -53,10 +66,10 @@ const controller = {
         options: ['namespace'],
         validation: { options: { namespace: { required: true } } },
         permissions(frame) {
-            return canThis(frame).edit.member_custom_field();
+            return canDefine(frame, (f) => canThis(f).edit.member_custom_field());
         },
         query(frame) {
-            return members_custom_fields_1.definitions.reorder((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
+            return members_metafields_1.definitions.reorder((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
         },
     },
     edit: {
@@ -64,10 +77,10 @@ const controller = {
         options: ['namespace', 'key'],
         validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions(frame) {
-            return canThis(frame).edit.member_custom_field(frame.options.key);
+            return canDefine(frame, (f) => canThis(f).edit.member_custom_field(f.options.key));
         },
         query(frame) {
-            return members_custom_fields_1.definitions.edit((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key, frame.data.members_metafields[0]);
+            return members_metafields_1.definitions.edit((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key, frame.data.members_metafields[0]);
         },
     },
     destroy: {
@@ -76,10 +89,10 @@ const controller = {
         options: ['namespace', 'key'],
         validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions(frame) {
-            return canThis(frame).destroy.member_custom_field(frame.options.key);
+            return canDefine(frame, (f) => canThis(f).destroy.member_custom_field(f.options.key));
         },
         async query(frame) {
-            await members_custom_fields_1.definitions.destroy((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key);
+            await members_metafields_1.definitions.destroy((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key);
             return null;
         },
     },

package/core/server/api/endpoints/members-account.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const membersService = require('../../services/members');
+const memberOf = (frame) => frame.options?.context?.member ?? null;
+const controller = {
+    docName: 'members_account',
+    read: {
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            return membersService.api.account.read(memberOf(frame).id);
+        },
+    },
+    /**
+     * Let Ghost email this member again.
+     *
+     * Under the account rather than as a resource of its own: being emailable is a
+     * fact about a member, and the only person who can restore it here is the member
+     * themselves.
+     */
+    destroySuppression: {
+        statusCode: 204,
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            const member = memberOf(frame);
+            return membersService.api.account.allowEmail(member.id, member.email);
+        },
+    },
+    // `update` rather than `edit`: the framework reserves `edit` for the Admin API's
+    // enveloped bodies, and this request has always carried a bare one. The
+    // members-facing gift endpoints name their own verbs for the same reason.
+    update: {
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            return membersService.api.account.edit(frame.data, memberOf(frame).id);
+        },
+    },
+};
+exports.default = controller;
+module.exports = controller;

package/core/server/api/endpoints/members.js

@@ -8,6 +8,8 @@ const membersService = require('../../services/members');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const { getCSVExportFileName } = require('./utils/csv-export-filename');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
+const { ADMIN } = require('../../services/members-metafields');
 
 // Shape the import service's outcome into the API response envelope: an inline import
 // reports its stats and label, a deferred one only how much it accepted.
@@ -67,7 +69,9 @@ const controller = {
       },
     },
     async query(frame) {
-      const page = await membersService.api.memberBREADService.browse(frame.options);
+      const page = await membersService.api.memberBREADService.browse(
+        restrictAdminApiQueryOptions(frame.options),
+      );
 
       return page;
     },
@@ -88,7 +92,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const member = await membersService.api.memberBREADService.read(frame.data, frame.options);
+      const member = await membersService.api.memberBREADService.read(frame.data, {
+        ...frame.options,
+        metafieldsFor: ADMIN,
+      });
 
       if (!member) {
         throw new errors.NotFoundError({
@@ -223,7 +230,10 @@ const controller = {
           },
         });
       }
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      let model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -263,7 +273,10 @@ const controller = {
           stripe_price_id: frame.data.stripe_price_id,
         },
       });
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      let model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -373,7 +386,7 @@ const controller = {
     validation: {},
     async query(frame) {
       return {
-        data: await membersService.export(frame.options),
+        data: await membersService.export(restrictAdminApiQueryOptions(frame.options)),
         filename: getCSVExportFileName('members'),
       };
     },
@@ -500,7 +513,10 @@ const controller = {
       const emailSuppressionList = require('../../services/email-suppression-list');
 
       // Get the member first to retrieve their email
-      const member = await membersService.api.memberBREADService.read({ id: frame.options.id }, {});
+      const member = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
 
       if (!member) {
         throw new errors.NotFoundError({