ghost 6.63.0 → 6.64.0

package/core/server/services/members-metafields/access.js

@@ -1,28 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INTERNAL = exports.MEMBERS = exports.ADMIN = void 0;
-exports.readableFields = readableFields;
+exports.INTERNAL = exports.MEMBERS = exports.ADMIN = exports.MemberAccessSchema = exports.MEMBER_ACCESS = void 0;
+exports.readableLevels = readableLevels;
 exports.canWrite = canWrite;
+const metafield_types_1 = require("@tryghost/metafield-types");
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return metafield_types_1.MEMBER_ACCESS; } });
+Object.defineProperty(exports, "MemberAccessSchema", { enumerable: true, get: function () { return metafield_types_1.MemberAccessSchema; } });
+const EVERY_LEVEL = [...metafield_types_1.MEMBER_ACCESS_LEVELS];
 exports.ADMIN = { entry: 'admin' };
 exports.MEMBERS = { entry: 'members' };
 exports.INTERNAL = { entry: 'internal' };
-/**
- * Which of the site's fields this audience may see.
- *
- * Every field, whichever door they came through. Written as a function rather than
- * left unwritten so that when a publisher can mark a field as staff only, one
- * function changes and every caller is already asking.
- */
-function readableFields(_audience, fields) {
-    return fields;
+// Every audience is spelled out with the levels it may read, staff included, because
+// reads narrow on whatever this returns and an audience with no entry gets an empty
+// list, which matches no field. Giving staff a way to skip the check instead would
+// invert that: an unrecognised audience would then match everything.
+const READABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.read, metafield_types_1.MEMBER_ACCESS.write],
+};
+const WRITABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.write],
+};
+// `Object.hasOwn` rather than a plain lookup: an entry naming a property every object
+// inherits (`__proto__`, `constructor`, `toString`) would otherwise return that
+// inherited value instead of falling through to the empty list.
+function levelsFor(table, audience) {
+    const entry = audience?.entry;
+    return entry !== undefined && Object.hasOwn(table, entry) ? table[entry] : [];
 }
-/**
- * Whether this audience may write this field.
- *
- * Also total today. Kept separate from `readableFields` because the asymmetry to
- * expect is a field a member may read but not change, which one combined
- * permission could not express.
- */
-function canWrite(_audience, _field) {
-    return true;
+function readableLevels(audience) {
+    return levelsFor(READABLE, audience);
+}
+function canWrite(audience, field) {
+    return levelsFor(WRITABLE, audience).includes(field.memberAccess);
 }

package/core/server/services/members-metafields/actions.js

@@ -31,6 +31,7 @@ const COMMANDS = {
     create: 'added',
     rename: 'edited',
     reorder: 'edited',
+    changeAccess: 'edited',
     archive: 'archived',
     restore: 'restored',
     delete: 'deleted',

package/core/server/services/members-metafields/codec.js

@@ -9,6 +9,13 @@ const models_1 = require("./models");
 exports.metafieldCodec = zod_1.z.codec(schema_1.DbMetafield, models_1.Metafield, {
     // DbMetafield validates `type` as the field-type enum, so the decoded row
     // already carries a FieldType and camelKeys preserves it — no cast needed.
-    decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
-    encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),
+    decode: ({ member_access: memberAccess, ...row }) => ({
+        ...(0, case_keys_1.camelKeys)(row),
+        namespace: identity_1.CUSTOM_NAMESPACE,
+        access: { member: memberAccess },
+    }),
+    encode: ({ namespace: _namespace, access, ...field }) => ({
+        ...(0, case_keys_1.snakeKeys)(field),
+        member_access: access.member,
+    }),
 });

package/core/server/services/members-metafields/definitions-service.js

@@ -47,10 +47,12 @@ const FieldName = zod_1.z
     .trim()
     .min(1, { message: 'Custom field name is required.' })
     .max(MAX_NAME_LENGTH, { message: 'Custom field name is too long.' });
-// The backend mints the key from the name, so create takes just a name and type.
+const FieldAccess = zod_1.z.object({ member: access_1.MemberAccessSchema });
+// No key: the backend mints it from the name.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
     type: metafield_types_1.FieldTypeSchema,
+    access: FieldAccess.optional(),
 });
 // A bound on the work one request can ask for, separate from how many definitions
 // a site may hold in total. Every definition in a batch costs several queries
@@ -73,11 +75,12 @@ const ReorderInput = zod_1.z
     key: zod_1.z.string().min(1, { message: 'Every custom field in the order needs a key.' }),
 }))
     .min(1, { message: 'The order must name every custom field.' });
-// Name and status are mutable. `key` and `type` are accepted so the immutability
-// rules can reject a change loudly; they are never persisted.
+// Name, status and access are mutable. `key` and `type` are accepted so the
+// immutability rules can reject a change loudly; they are never persisted.
 const EditFieldInput = zod_1.z.object({
     name: FieldName.optional(),
     status: schema_1.FieldStatusSchema.optional(),
+    access: FieldAccess.optional(),
     key: zod_1.z.string().optional(),
     type: metafield_types_1.FieldTypeSchema.optional(),
 });
@@ -95,8 +98,8 @@ class MetafieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async hasAnyActive() {
-        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+    async hasAnyReadable(audience) {
+        const [field] = await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY, limit: 1 }));
         return Boolean(field);
     }
     /**
@@ -106,34 +109,35 @@ class MetafieldDefinitionsService {
     isStored(namespace) {
         return namespace === identity_1.CUSTOM_NAMESPACE;
     }
-    async browse(options = {}, audience = access_1.ADMIN) {
+    async browse(options, audience) {
         if (options.namespace !== undefined && !this.isStored(options.namespace)) {
             return [];
         }
-        // Archived fields are hidden by default: most surfaces (member details, the
-        // filter picker, the importer) only ever want active fields. A caller-
-        // supplied `filter` can widen that — Settings pulls active and archived
-        // together in one request (`filter=status:[active,archived]`).
-        //
         // Whichever set comes back, it comes back in the publisher's order: filtering
         // narrows the list, it never reorders it.
-        const query = options.filter
-            ? applyFilter(this.knex(TABLE), options.filter)
-            : (0, queries_1.activeFields)(this.knex);
-        return (0, access_1.readableFields)(audience, await this.list(query));
+        const { filter } = options;
+        if (filter) {
+            // A filter naming `status` decides the statuses itself, which is how Settings
+            // pulls active and archived together in one request
+            // (`filter=status:[active,archived]`). One that does not gets the same active-only
+            // scope as an unfiltered read.
+            const parsed = parseFilter(filter);
+            return this.list((0, queries_1.definitions)(this.knex, {
+                audience,
+                status: filterReferencesStatus(parsed) ? queries_1.ANY_STATUS : queries_1.ACTIVE_ONLY,
+                filter: (query) => knexify(query, parsed, { tableName: TABLE }),
+            }));
+        }
+        return this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY }));
     }
-    /**
-     * Decode a definition query into the domain, in the publisher's order.
-     *
-     * Typed off `activeFields` so the builder keeps the table's row type: every caller
-     * hands over a query against the definitions table, whatever it has narrowed.
-     */
     async list(query) {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
         return rows.map((row) => zod_1.z.decode(codec_1.metafieldCodec, row));
     }
-    async read(namespace, key) {
-        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
+    async read(namespace, key, audience) {
+        const [field] = this.isStored(namespace)
+            ? await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ANY_STATUS, key }))
+            : [];
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
@@ -191,6 +195,7 @@ class MetafieldDefinitionsService {
                         key,
                         name: field.name,
                         type: field.type,
+                        memberAccess: field.access?.member ?? access_1.MEMBER_ACCESS.none,
                         sortOrder: firstSortOrder + index,
                     });
                     keys.push(key);
@@ -236,6 +241,7 @@ class MetafieldDefinitionsService {
                 key: wanted.key,
                 name: wanted.name,
                 type: wanted.type,
+                memberAccess: wanted.access.member,
                 sortOrder: await this.nextSortOrder(db),
             });
             const [created] = await this.readMany(db, [wanted.key]);
@@ -263,6 +269,7 @@ class MetafieldDefinitionsService {
             key: field.key,
             name: field.name,
             type: field.type,
+            member_access: field.memberAccess,
             sort_order: field.sortOrder,
             created_at: new Date(),
         });
@@ -351,7 +358,8 @@ class MetafieldDefinitionsService {
                     .where('key', key)
                     .update({ sort_order: ranks.get(key) });
             }
-            return this.list(trx(TABLE));
+            // An order covers the whole list, archived definitions included.
+            return this.list((0, queries_1.definitions)(trx, { audience: access_1.ADMIN, status: queries_1.ANY_STATUS }));
         });
         await this.recordAction({
             context,
@@ -460,7 +468,7 @@ class MetafieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -500,6 +508,22 @@ class MetafieldDefinitionsService {
                 details: { primary_name: patch.name, key, previous_name: existing.name },
             });
         }
+        if (patch.access !== undefined && patch.access.member !== existing.access.member) {
+            await this.knex(TABLE)
+                .where('key', key)
+                .update({ member_access: patch.access.member, updated_at: new Date() });
+            await this.recordAction({
+                context,
+                verb: 'changeAccess',
+                subject: existing.id,
+                details: {
+                    primary_name: patch.name ?? existing.name,
+                    key,
+                    member_access: patch.access.member,
+                    previous_member_access: existing.access.member,
+                },
+            });
+        }
         // A status change is the archive/restore transition. Only write (and log)
         // when it actually flips, so re-sending the current status is a no-op.
         if (patch.status !== undefined && patch.status !== existing.status) {
@@ -514,7 +538,7 @@ class MetafieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(identity_1.CUSTOM_NAMESPACE, key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -597,12 +621,11 @@ function isUniqueConstraintViolation(error) {
     const code = error?.code;
     return code === 'ER_DUP_ENTRY' || code === 'SQLITE_CONSTRAINT';
 }
-// Apply a caller-supplied NQL filter to the definition query. A malformed filter
-// is a client error (400), not a 500. The active-only default is preserved unless
-// the filter itself constrains status, so a filter on another field (e.g. type)
-// can never surface archived fields — this is the invariant queries.ts centralises,
-// held here as the per-field default override Bookshelf's filter plugin does.
-function applyFilter(query, filter) {
+// Parse a caller-supplied NQL filter, without applying it. A malformed filter is a
+// client error (400), not a 500. Whether the result widens the statuses is decided by
+// the caller, which reads it with `filterReferencesStatus` and says so when building
+// the query; nothing here narrows anything.
+function parseFilter(filter) {
     let mongoQuery;
     try {
         mongoQuery = nql(filter).toJSON();
@@ -623,20 +646,7 @@ function applyFilter(query, filter) {
             property: 'filter',
         });
     }
-    try {
-        knexify(query, mongoQuery, { tableName: TABLE });
-    }
-    catch (err) {
-        throw new errors_1.default.BadRequestError({
-            message: 'Could not parse the filter parameter.',
-            property: 'filter',
-            err: err,
-        });
-    }
-    if (!filterReferencesStatus(mongoQuery)) {
-        query.where('status', schema_1.FIELD_STATUS.active);
-    }
-    return query;
+    return mongoQuery;
 }
 // Whether an NQL-parsed filter constrains `status` anywhere, including inside the
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the

package/core/server/services/members-metafields/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.readableFields = exports.canWrite = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.canWrite = exports.MEMBER_ACCESS = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -16,8 +16,8 @@ var access_1 = require("./access");
 Object.defineProperty(exports, "ADMIN", { enumerable: true, get: function () { return access_1.ADMIN; } });
 Object.defineProperty(exports, "INTERNAL", { enumerable: true, get: function () { return access_1.INTERNAL; } });
 Object.defineProperty(exports, "MEMBERS", { enumerable: true, get: function () { return access_1.MEMBERS; } });
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return access_1.MEMBER_ACCESS; } });
 Object.defineProperty(exports, "canWrite", { enumerable: true, get: function () { return access_1.canWrite; } });
-Object.defineProperty(exports, "readableFields", { enumerable: true, get: function () { return access_1.readableFields; } });
 function init() {
     // The three are constructed together below, so checking all of them keeps the "all or
     // none" invariant explicit rather than trusting one to stand in for the rest.

package/core/server/services/members-metafields/models.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Metafield = void 0;
 const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
+const access_1 = require("./access");
 const schema_1 = require("./schema");
 exports.Metafield = zod_1.z.object({
     id: zod_1.z.string(),
@@ -11,6 +12,7 @@ exports.Metafield = zod_1.z.object({
     name: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
     status: schema_1.FieldStatusSchema,
+    access: zod_1.z.object({ member: access_1.MemberAccessSchema }),
     createdAt: zod_1.z.date(),
     updatedAt: zod_1.z.date().nullable(),
 });

package/core/server/services/members-metafields/queries.js

@@ -1,20 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.activeFields = activeFields;
-exports.fieldByKey = fieldByKey;
+exports.ANY_STATUS = exports.ACTIVE_ONLY = void 0;
+exports.readableBy = readableBy;
+exports.definitions = definitions;
 exports.inFieldOrder = inFieldOrder;
+const access_1 = require("./access");
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_metafields';
-// Archived fields must stay out of every read and write, and nothing in the database
-// enforces that — no constraint stops a value row referencing an archived field. A query
-// that forgets the filter is a silent bug, so the filter lives in one place.
-/** Takes the executor so the same query runs standalone or inside a write's transaction. */
-function activeFields(db) {
-    return db(FIELDS_TABLE).where('status', schema_1.FIELD_STATUS.active);
+// Nothing in the database keeps an archived or hidden field out of a read: no
+// constraint stops a value row referencing one. Both filters are therefore applied in
+// code, and a query that forgets either is a silent bug.
+function readableBy(query, audience) {
+    query.whereIn(`${FIELDS_TABLE}.member_access`, (0, access_1.readableLevels)(audience));
+    return query;
+}
+/**
+ * Whether a read includes definitions the publisher has archived.
+ *
+ * A member is never offered an archived field. Staff managing the list are always
+ * shown one, since an archived field is still theirs to rename, restore or delete.
+ */
+exports.ACTIVE_ONLY = 'active-only';
+exports.ANY_STATUS = 'any-status';
+// Unannotated so the builder keeps the row type knex derives from the table
+// registration; naming a type here would both lose that and make the alias below
+// refer to itself.
+function metafieldsTable(db) {
+    return db(FIELDS_TABLE);
 }
-/** One field by key, as the same kind of query the rest of this reads through. */
-function fieldByKey(db, key) {
-    return db(FIELDS_TABLE).where(`${FIELDS_TABLE}.key`, key);
+function definitions(db, scope) {
+    let query = metafieldsTable(db);
+    if (scope.filter) {
+        query = scope.filter(query);
+    }
+    if (scope.key !== undefined) {
+        query = query.where(`${FIELDS_TABLE}.key`, scope.key);
+    }
+    if (scope.status === exports.ACTIVE_ONLY) {
+        query = query.where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active);
+    }
+    if (scope.limit !== undefined) {
+        query = query.limit(scope.limit);
+    }
+    return readableBy(query, scope.audience);
 }
 /**
  * The publisher's order, applied to every read of the list. Here for the same reason the

package/core/server/services/members-metafields/schema.js

@@ -4,6 +4,7 @@ exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = ex
 const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
+const access_1 = require("./access");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
 // column, which is static config and cannot import this.
@@ -17,6 +18,7 @@ exports.DbMetafield = zod_1.z.object({
     name: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
+    member_access: access_1.MemberAccessSchema,
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });

package/core/server/services/members-metafields/serializers.js

@@ -10,6 +10,7 @@ const MetafieldResource = zod_1.z.object({
     name: zod_1.z.string(),
     type: zod_1.z.string(),
     status: zod_1.z.string(),
+    access: zod_1.z.object({ member: zod_1.z.string() }),
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });

package/core/server/services/members-metafields/values-service.js

@@ -47,7 +47,11 @@ class MetafieldValuesService {
         this.knex = knex;
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async activeFieldsByIdentity(identities) {
+    // The query is scoped to the audience, so a field they may not see is absent from
+    // the map and the caller reports it as unknown. Looking up unscoped and rejecting
+    // afterwards would let a member tell a hidden field from an undefined one by the
+    // reply they got.
+    async allowedFieldsByIdentity(identities, audience) {
         const keys = identities
             .map((identity) => (0, identity_1.parseIdentity)(identity))
             .filter((parsed) => parsed !== null && parsed.namespace === identity_1.CUSTOM_NAMESPACE)
@@ -55,12 +59,19 @@ class MetafieldValuesService {
         if (keys.length === 0) {
             return new Map();
         }
-        const fields = await (0, queries_1.activeFields)(this.knex)
+        const fields = await (0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY })
             .whereIn('key', keys)
-            .select('id', 'key', 'name', 'type');
+            .select('id', 'key', 'name', 'type', 'member_access');
         return new Map(fields.map((field) => [
             (0, identity_1.formatIdentity)({ namespace: identity_1.CUSTOM_NAMESPACE, key: field.key, partPath: null }),
-            { ...field, namespace: identity_1.CUSTOM_NAMESPACE },
+            {
+                id: field.id,
+                key: field.key,
+                name: field.name,
+                type: field.type,
+                namespace: identity_1.CUSTOM_NAMESPACE,
+                memberAccess: field.member_access,
+            },
         ]));
     }
     async getValuesForMembers(memberIds, audience) {
@@ -70,8 +81,7 @@ class MetafieldValuesService {
         // Not ordered by field: these rows become an object keyed by field, and an object
         // cannot carry an order. `path` is ordered so composite parts assemble the same
         // way every time.
-        const rows = await this.knex(VALUES_TABLE)
-            .join(FIELDS_TABLE, `${VALUES_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`)
+        const rows = await (0, queries_1.readableBy)(this.knex(VALUES_TABLE).join(FIELDS_TABLE, `${VALUES_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`), audience)
             .whereIn(`${VALUES_TABLE}.member_id`, memberIds)
             .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
             .orderBy(`${VALUES_TABLE}.path`, 'asc')
@@ -90,10 +100,7 @@ class MetafieldValuesService {
                 }, 'Skipping an unreadable metafield value');
             }
         }
-        // Narrowed before assembly, not after: a composite is one value spread across
-        // several rows, and dropping some of its parts later would hand back half an
-        // address rather than no address.
-        const flat = (0, storage_1.valuesFromLeaves)((0, access_1.readableFields)(audience, leaves));
+        const flat = (0, storage_1.valuesFromLeaves)(leaves);
         return new Map(memberIds.map((memberId) => [memberId, { [identity_1.CUSTOM_NAMESPACE]: flat.get(memberId) ?? {} }]));
     }
     parseValues(input) {
@@ -157,7 +164,7 @@ class MetafieldValuesService {
                 property: identity_1.QUALIFIER,
             });
         }
-        const byIdentity = await this.activeFieldsByIdentity(identities);
+        const byIdentity = await this.allowedFieldsByIdentity(identities, audience);
         const writes = [];
         for (const [identity, raw] of Object.entries(values)) {
             const field = byIdentity.get(identity);
@@ -167,6 +174,8 @@ class MetafieldValuesService {
                     property: wireProperty(identity),
                 });
             }
+            // A different refusal from the unknown-field one above: this audience can
+            // already see the field, so naming it discloses nothing.
             if (!(0, access_1.canWrite)(audience, field)) {
                 throw new errors_1.default.ValidationError({
                     message: `Cannot set custom field: ${identity}`,

package/core/server/services/mentions/mention-discovery-service.js

@@ -63,7 +63,7 @@ module.exports = class MentionDiscoveryService {
       return null;
     }
 
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(response.body);
 
     // must be first <link> OR <a> element with rel=webmention

package/core/server/services/mentions/mention-sending-service.js

@@ -242,7 +242,7 @@ module.exports = class MentionSendingService {
    * @returns {URL[]}
    */
   getLinks(html) {
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(html);
     const urls = [];
     const siteUrl = this.siteUrl;

package/core/server/services/mentions/mention.js

@@ -61,7 +61,7 @@ module.exports = class Mention {
 
     if (contentType.includes('text/html')) {
       try {
-        const cheerio = require('cheerio');
+        const cheerio = require('cheerio/slim');
         const $ = cheerio.load(html);
         const hasTargetUrl =
           $(

package/core/server/services/oembed/oembed-service.js

@@ -42,6 +42,7 @@ const messages = {
   unableToFetchOembed: 'Unable to fetch requested embed.',
   unauthorized: 'URL contains a private resource.',
   unconvertibleSvg: 'SVG image is too large or compressed to convert.',
+  unsupportedImage: 'Image is not a supported file type.',
 };
 
 const SVG_RASTER_SIZE = 256;
@@ -68,6 +69,16 @@ const shouldRasterize = (buffer, ext) => {
   return head.startsWith('<') && /<svg[\s:>]/i.test(head);
 };
 
+let fileTypeFromBuffer;
+
+const detectFileType = async (buffer) => {
+  if (!fileTypeFromBuffer) {
+    ({ fileTypeFromBuffer } = await import('file-type'));
+  }
+
+  return fileTypeFromBuffer(buffer);
+};
+
 /**
  * @param {string} url
  * @returns {{url: string, provider: boolean}}
@@ -234,6 +245,20 @@ class OEmbedService {
       });
 
       ext = '.png';
+    } else {
+      // The URL's extension is attacker-controlled and decides the
+      // Content-Type the stored file is later served with, so name the
+      // file after its contents and hold it to the same allowlist as image
+      // uploads. `file-type` never reports SVG, which is handled above.
+      const fileType = await detectFileType(imageBuffer);
+      ext = fileType ? `.${fileType.ext}` : '';
+
+      if (!this.config.get('uploads').images.extensions.includes(ext)) {
+        throw new errors.ValidationError({
+          message: tpl(messages.unsupportedImage),
+          context: imageUrl,
+        });
+      }
     }
 
     const uniqueFileName = `${name}-${crypto.randomUUID()}${ext}`;
@@ -561,12 +586,12 @@ class OEmbedService {
    */
   async fetchOembedData(url, html, cardType) {
     // Lazy require the library to keep boot quick
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
 
     // check for <link rel="alternate" type="application/json+oembed"> element
     let oembedUrl;
     try {
-      oembedUrl = cheerio('link[type="application/json+oembed"]', html).attr('href');
+      oembedUrl = cheerio.load(html)('link[type="application/json+oembed"]').attr('href');
     } catch (e) {
       return this.unknownProvider(url);
     }
@@ -622,15 +647,15 @@ class OEmbedService {
           return;
         }
 
-        // `rich` and `video` responses ship provider-supplied HTML that gets
-        // stored in the post's Lexical payload and rendered into the admin
-        // editor preview (via srcdoc) and into public themes (via innerHTML).
-        // Known providers (YouTube, Twitter, etc.) go through `knownProvider`
-        // with @extractus/oembed-extractor's allowlist — anything reaching
-        // here is an arbitrary site's self-declared oEmbed endpoint, which we
-        // must not trust. Drop the response and let the caller fall back to
-        // a bookmark card.
-        if (oembed.type === 'video' || oembed.type === 'rich') {
+        // `rich`, `video` and `photo` responses can all ship provider-supplied
+        // HTML that gets stored in the post's Lexical payload and rendered
+        // into the admin editor preview (via srcdoc) and into public themes
+        // and emails (via innerHTML). Known providers (YouTube, Twitter, etc.)
+        // go through `knownProvider` with @extractus/oembed-extractor's
+        // allowlist — anything reaching here is an arbitrary site's
+        // self-declared oEmbed endpoint, which we must not trust. Drop the
+        // response and let the caller fall back to a bookmark card.
+        if (oembed.type === 'video' || oembed.type === 'rich' || oembed.type === 'photo') {
           return;
         }
 

package/core/server/services/posts/post-scheduling.js

@@ -16,6 +16,10 @@ const messages = {
 // retrying a publish that will never happen.
 const NO_OP = { scheduledResource: null, preScheduledResource: null };
 
+// Ignore overlapping deliveries for the same resource. The scheduler owns
+// retries if the active publish fails; always release the guard when it settles.
+const inFlight = new Set();
+
 /**
  * Publishes scheduled resource (a post or a page at the moment of writing)
  *
@@ -27,6 +31,22 @@ const NO_OP = { scheduledResource: null, preScheduledResource: null };
  *   `scheduledResource: null` when there was nothing to publish yet
  */
 exports.publish = async (resourceType, id, force, options) => {
+  const key = `${resourceType}:${id}`;
+
+  if (inFlight.has(key)) {
+    return NO_OP;
+  }
+
+  inFlight.add(key);
+
+  try {
+    return await publishNow(resourceType, id, force, options);
+  } finally {
+    inFlight.delete(key);
+  }
+};
+
+const publishNow = async (resourceType, id, force, options) => {
   const publishAPostBySchedulerToleranceInMinutes =
     config.get('times').publishAPostBySchedulerToleranceInMinutes;