ghost 6.63.0 → 6.64.0

package/core/server/api/endpoints/automations.js

@@ -1,54 +1,82 @@
-const automationsApi = require('../../services/automations/automations-api');
-
-/** @type {import('@tryghost/api-framework').Controller} */
-const controller = {
-  docName: 'automations',
-
-  browse: {
-    headers: {
-      cacheInvalidate: false,
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.controller = void 0;
+const automationsApi = __importStar(require("../../services/automations/automations-api"));
+exports.controller = {
+    docName: 'automations',
+    browse: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: true,
+        async query() {
+            return await automationsApi.browse();
+        },
     },
-    permissions: true,
-    async query() {
-      return await automationsApi.browse();
+    read: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        data: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.read(frame.data.id);
+        },
     },
-  },
-
-  read: {
-    headers: {
-      cacheInvalidate: false,
+    edit: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        options: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
+        },
     },
-    data: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.read(frame.data.id);
+    poll: {
+        statusCode: 204,
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'poll',
+        },
+        query() {
+            automationsApi.requestPoll();
+        },
     },
-  },
-
-  edit: {
-    headers: {
-      cacheInvalidate: false,
-    },
-    options: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
-    },
-  },
-
-  poll: {
-    statusCode: 204,
-    headers: {
-      cacheInvalidate: false,
-    },
-    permissions: {
-      docName: 'automations',
-      method: 'poll',
-    },
-    query() {
-      automationsApi.requestPoll();
-    },
-  },
 };
-
-module.exports = controller;

package/core/server/api/endpoints/emails.js

@@ -3,6 +3,7 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const emailService = require('../../services/email-service');
 const emailAnalytics = require('../../services/email-analytics');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   emailNotFound: 'Email not found.',
@@ -23,7 +24,7 @@ const controller = {
     options: ['limit', 'fields', 'filter', 'order', 'page'],
     permissions: true,
     async query(frame) {
-      return await models.Email.findPage(frame.options);
+      return await models.Email.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -94,7 +95,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailBatch.findPage({ ...frame.options, filter });
+      return await models.EmailBatch.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 
@@ -117,7 +120,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailRecipientFailure.findPage({ ...frame.options, filter });
+      return await models.EmailRecipientFailure.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 

package/core/server/api/endpoints/index.js

@@ -8,7 +8,7 @@ const localUtils = require('./utils');
 
 module.exports = {
   get automations() {
-    return apiFramework.pipeline(require('./automations'), localUtils);
+    return apiFramework.pipeline(require('./automations').controller, localUtils);
   },
 
   get automationActionLinks() {

package/core/server/api/endpoints/invites.js

@@ -3,6 +3,7 @@ const errors = require('@tryghost/errors');
 const invites = require('../../services/invites');
 const models = require('../../models');
 const api = require('./index');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = [];
 const UNSAFE_ATTRS = ['role_id'];
 
@@ -26,7 +27,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Invite.findPage(frame.options);
+      return models.Invite.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/labels.js

@@ -1,6 +1,7 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   labelNotFound: 'Label not found.',
@@ -42,7 +43,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Label.findPage(frame.options);
+      return models.Label.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -61,7 +62,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.Label.findOne(frame.data, frame.options);
+      const model = await models.Label.findOne(
+        frame.data,
+        restrictAdminApiQueryOptions(frame.options),
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.labelNotFound),

package/core/server/api/endpoints/member-metafields.js

@@ -37,7 +37,7 @@ const controller = {
             return members_metafields_1.definitions.browse({
                 namespace: frame.options.namespace,
                 filter: frame.options.filter,
-            });
+            }, members_metafields_1.ADMIN);
         },
     },
     read: {
@@ -46,7 +46,7 @@ const controller = {
         validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions: false,
         query(frame) {
-            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key);
+            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key, members_metafields_1.ADMIN);
         },
     },
     add: {

package/core/server/api/endpoints/members.js

@@ -8,6 +8,8 @@ const membersService = require('../../services/members');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const { getCSVExportFileName } = require('./utils/csv-export-filename');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
+const { ADMIN } = require('../../services/members-metafields');
 
 // Shape the import service's outcome into the API response envelope: an inline import
 // reports its stats and label, a deferred one only how much it accepted.
@@ -67,7 +69,9 @@ const controller = {
       },
     },
     async query(frame) {
-      const page = await membersService.api.memberBREADService.browse(frame.options);
+      const page = await membersService.api.memberBREADService.browse(
+        restrictAdminApiQueryOptions(frame.options),
+      );
 
       return page;
     },
@@ -88,7 +92,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const member = await membersService.api.memberBREADService.read(frame.data, frame.options);
+      const member = await membersService.api.memberBREADService.read(frame.data, {
+        ...frame.options,
+        metafieldsFor: ADMIN,
+      });
 
       if (!member) {
         throw new errors.NotFoundError({
@@ -223,7 +230,10 @@ const controller = {
           },
         });
       }
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      let model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -263,7 +273,10 @@ const controller = {
           stripe_price_id: frame.data.stripe_price_id,
         },
       });
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      let model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -373,7 +386,7 @@ const controller = {
     validation: {},
     async query(frame) {
       return {
-        data: await membersService.export(frame.options),
+        data: await membersService.export(restrictAdminApiQueryOptions(frame.options)),
         filename: getCSVExportFileName('members'),
       };
     },
@@ -500,7 +513,10 @@ const controller = {
       const emailSuppressionList = require('../../services/email-suppression-list');
 
       // Get the member first to retrieve their email
-      const member = await membersService.api.memberBREADService.read({ id: frame.options.id }, {});
+      const member = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
 
       if (!member) {
         throw new errors.NotFoundError({

package/core/server/api/endpoints/pages.js

@@ -2,7 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = [
   'tags',
   'authors',
@@ -54,11 +54,7 @@ const controller = {
       unsafeAttrs: UNSAFE_ATTRS,
     },
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return models.Post.findPage(options);
+      return models.Post.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/posts.js

@@ -3,7 +3,7 @@ const models = require('../../models');
 const { getCSVExportFileName } = require('./utils/csv-export-filename');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const contentImportService = require('../../services/content-import');
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const allowedIncludes = [
   'tags',
   'authors',
@@ -80,11 +80,7 @@ const controller = {
       unsafeAttrs: unsafeAttrs,
     },
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return postsService.browsePosts(options);
+      return postsService.browsePosts(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -108,12 +104,8 @@ const controller = {
     },
     validation: {},
     async query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
       return {
-        data: await postsService.export(options),
+        data: await postsService.export(restrictAdminApiQueryOptions(frame.options)),
         filename: getCSVExportFileName('analytics'),
       };
     },

package/core/server/api/endpoints/snippets.js

@@ -1,6 +1,7 @@
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   snippetNotFound: 'Snippet not found.',
@@ -25,7 +26,7 @@ const controller = {
       },
     },
     query(frame) {
-      return models.Snippet.findPage(frame.options);
+      return models.Snippet.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/tags.js

@@ -1,6 +1,7 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
 
@@ -26,7 +27,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Tag.findPage(frame.options);
+      return models.Tag.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -45,7 +46,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.Tag.findOne(frame.data, frame.options);
+      const model = await models.Tag.findOne(
+        frame.data,
+        restrictAdminApiQueryOptions(frame.options),
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.tagNotFound),

package/core/server/api/endpoints/users.js

@@ -5,7 +5,7 @@ const permissionsService = require('../../services/permissions');
 const auth = require('../../services/auth');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const UsersService = require('../../services/users');
 const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const ALLOWED_INCLUDES = ['count.posts', 'permissions', 'roles', 'roles.permissions'];
@@ -121,11 +121,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return models.User.findPage(options);
+      return models.User.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectNewslettersContentApiRestrictedFieldsTransformer = exports.rejectPagesContentApiRestrictedFieldsTransformer = exports.rejectPostsContentApiRestrictedFieldsTransformer = exports.rejectTagsContentApiRestrictedFieldsTransformer = exports.rejectAuthorsContentApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiRestrictedOrderFields = validateAdminApiRestrictedOrderFields;
+exports.restrictAdminApiQueryOptions = restrictAdminApiQueryOptions;
 exports.rejectAuthorsRestrictedOrderFields = rejectAuthorsRestrictedOrderFields;
 exports.rejectTagsRestrictedOrderFields = rejectTagsRestrictedOrderFields;
 exports.rejectPostsContentApiRestrictedOrderFields = rejectPostsContentApiRestrictedOrderFields;
@@ -73,7 +75,10 @@ const CONTENT_API_TAG_RESTRICTED_FIELDS = new Set([
     'parent',
 ]);
 const CONTENT_API_TAG_RELATIONS = new Set(['tag', 'tags', 'primary_tag']);
-const ADMIN_API_RESTRICTED_FIELDS = new Set(['password']);
+// Columns Ghost deliberately withholds from every Admin API response. `filter` and
+// `order` are both compiled to SQL against the raw table, so a column hidden from
+// output is still usable as an oracle unless it is blocked on the way in.
+const ADMIN_API_RESTRICTED_FIELDS = new Set(['password', 'token', 'gift_link_token', 'secret']);
 function getOrderAttributes(tableName) {
     return Object.keys(schema[tableName])
         .map((field) => `${tableName}.${field}`)
@@ -104,6 +109,9 @@ function hasRestrictedTagSegment(key) {
         CONTENT_API_TAG_RELATIONS.has(segments[index - 1]) &&
         CONTENT_API_TAG_RESTRICTED_FIELDS.has(segment));
 }
+function isAdminApiRestrictedKey(key) {
+    return hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS);
+}
 function isContentApiRestrictedKey(key) {
     return (hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS) ||
         hasRestrictedSegment(key, CONTENT_API_RESTRICTED_RELATIONS) ||
@@ -171,11 +179,62 @@ const rejectNewslettersContentApiRestrictedFieldsTransformer = (input) => {
 };
 exports.rejectNewslettersContentApiRestrictedFieldsTransformer = rejectNewslettersContentApiRestrictedFieldsTransformer;
 const rejectAdminApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isAdminApiRestrictedKey);
 };
 exports.rejectAdminApiRestrictedFieldsTransformer = rejectAdminApiRestrictedFieldsTransformer;
+/**
+ * `@tryghost/bookshelf-order` resolves an order field to the first order
+ * attribute that ends with it, so `word` sorts by `users.password` and `oken`
+ * by `invites.token`. An unqualified field is therefore restricted when it is a
+ * suffix of any restricted column name. A qualified field can only match a
+ * whole column name after the dot, so its segments are checked exactly.
+ */
+function isAdminApiRestrictedOrderField(field) {
+    const normalizedField = field.toLowerCase();
+    if (normalizedField.includes('.')) {
+        return isAdminApiRestrictedKey(normalizedField);
+    }
+    return [...ADMIN_API_RESTRICTED_FIELDS].some((restrictedField) => restrictedField.endsWith(normalizedField));
+}
+/**
+ * Every schema column is orderable by default (see the base model's
+ * `orderAttributes`), so `order` reaches the SQL `ORDER BY` clause untouched.
+ * Sorting by a withheld column leaks its relative byte ordering, which the
+ * `filter` guard alone does not prevent.
+ */
+function validateAdminApiRestrictedOrderFields(order) {
+    if (!order) {
+        return order;
+    }
+    const restrictedField = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => String(value).split(','))
+        .map((clause) => clause.trim().split(/\s+/)[0])
+        .filter(Boolean)
+        .find(isAdminApiRestrictedOrderField);
+    if (restrictedField) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Restricted fields cannot be used in order.',
+        });
+    }
+    return order;
+}
+/**
+ * Applies the Admin API restricted-field guard to the query options of a single
+ * endpoint. Both client-supplied query surfaces have to be covered: `filter`
+ * compiles to `WHERE` and `order` to `ORDER BY`, and each is an independent
+ * oracle over columns the serializers strip from the response.
+ */
+function restrictAdminApiQueryOptions(options) {
+    validateAdminApiRestrictedOrderFields(options.order);
+    return {
+        ...options,
+        mongoTransformer: options.mongoTransformer
+            ? (0, mongo_utils_1.chainTransformers)(options.mongoTransformer, exports.rejectAdminApiRestrictedFieldsTransformer)
+            : exports.rejectAdminApiRestrictedFieldsTransformer,
+    };
+}
 const validateAdminApiBulkFilterTransformer = (input) => {
-    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find((key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find(isAdminApiRestrictedKey);
     if (restrictedField) {
         throw new errors_1.default.BadRequestError({
             message: 'Restricted fields cannot be used in bulk operation filters.',

package/core/server/api/endpoints/utils/serializers/output/utils/clean.js

@@ -140,6 +140,8 @@ const post = (attrs, frame) => {
   delete attrs.author;
   delete attrs.type;
   delete attrs.newsletter_id;
+  // Internal stored metadata — not part of the public Posts/Pages API yet
+  delete attrs.auto_excerpt;
 
   return attrs;
 };

package/core/server/api/endpoints/utils/serializers/output/utils/extra-attrs.js

@@ -64,6 +64,9 @@ module.exports.forPost = (options, model, attrs) => {
   }
 
   // 4. Add `reading_time` if no columns were requested, or if `reading_time` was requested via `columns`
+  // reading_time is also a DB column now; drop the raw value so we only expose it when
+  // computed below (avoids leaking `reading_time: null` into APIs/webhooks).
+  delete attrs.reading_time;
   if (noColumnsRequested || columnsIncludesReadingTime) {
     if (attrs.html) {
       let additionalImages = 0;

package/core/server/api/endpoints/utils/validators/input/settings.js

@@ -43,11 +43,25 @@ function isValidNavigationUrl(value) {
   );
 }
 
+// Local installs serve uploaded icons from http://localhost:2368, which has no TLD
+function isLocalhostIconUrl(value) {
+  try {
+    return (
+      new URL(value).hostname === 'localhost' &&
+      validator.isURL(value, { ...iconUrlOptions, require_tld: false })
+    );
+  } catch {
+    return false;
+  }
+}
+
 function isValidNavigationIcon(value) {
   return (
     _.isString(value) &&
     !value.match(/\s/) &&
-    (validator.isURL(value, iconUrlOptions) || value.match(iconUrlRegex))
+    (validator.isURL(value, iconUrlOptions) ||
+      value.match(iconUrlRegex) ||
+      isLocalhostIconUrl(value))
   );
 }
 

package/core/server/data/exporter/exporter.js

@@ -26,7 +26,8 @@ const getSettingsTableData = function getSettingsTableData(settingsData) {
   return (
     settingsData &&
     settingsData.filter((setting) => {
-      return !SETTING_KEYS_BLOCKLIST.includes(setting.key);
+      // core settings hold instance secrets and are never imported, so never export them
+      return setting.group !== 'core' && !SETTING_KEYS_BLOCKLIST.includes(setting.key);
     })
   );
 };

package/core/server/data/exporter/table-lists.js

@@ -76,6 +76,7 @@ const BACKUP_TABLES = [
   'automation_runs',
   'welcome_email_automation_runs',
   'welcome_email_automated_emails',
+  'tinybird_syncs',
 ];
 
 // NOTE: exposing only tables which are going to be included in a "default" export file
@@ -104,7 +105,8 @@ const TABLES_ALLOWLIST = [
   'snippets',
 ];
 
-// NOTE: these are settings keys which should never end up in the export file
+// NOTE: these are non-core settings keys which should never end up in the export file
+//       (the whole core group is always excluded)
 const SETTING_KEYS_BLOCKLIST = [
   'stripe_connect_publishable_key',
   'stripe_connect_secret_key',
@@ -112,12 +114,8 @@ const SETTING_KEYS_BLOCKLIST = [
   'stripe_secret_key',
   'stripe_publishable_key',
   'stripe_billing_portal_configuration_id',
-  'members_stripe_webhook_id',
-  'members_stripe_webhook_secret',
   'email_verification_required',
   'indexnow_api_key',
-  'machine_payments_secret',
-  'machine_payments_deposit_address',
 ];
 
 module.exports = {

package/core/server/data/importer/importers/data/settings-importer.js

@@ -9,6 +9,11 @@ const keyTypeMapper = require('../../../../api/endpoints/utils/serializers/input
 const { WRITABLE_KEYS_ALLOWLIST } = require('../../../../../shared/labs');
 
 const labsDefaults = JSON.parse(defaultSettings.labs.labs.defaultValue);
+const defaultSettingsGroups = Object.fromEntries(
+  Object.entries(defaultSettings).flatMap(([group, settings]) =>
+    Object.keys(settings).map((key) => [key, group]),
+  ),
+);
 const ignoredSettings = [
   'slack_url',
   'members_from_address',
@@ -183,9 +188,10 @@ class SettingsImporter extends BaseImporter {
       return data;
     });
 
-    // Remove core and theme data types
+    // Remove core and theme data types, using the schema's group rather than the file's
     this.dataToImport = _.filter(this.dataToImport, (data) => {
-      return ['core', 'theme'].indexOf(data.group) === -1;
+      const group = defaultSettingsGroups[data.key] ?? data.group;
+      return ['core', 'theme'].indexOf(group) === -1;
     });
 
     const newIsPrivate = _.find(this.dataToImport, { key: 'is_private' });