ghost 6.63.0 → 6.65.0

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectNewslettersContentApiRestrictedFieldsTransformer = exports.rejectPagesContentApiRestrictedFieldsTransformer = exports.rejectPostsContentApiRestrictedFieldsTransformer = exports.rejectTagsContentApiRestrictedFieldsTransformer = exports.rejectAuthorsContentApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiRestrictedOrderFields = validateAdminApiRestrictedOrderFields;
+exports.restrictAdminApiQueryOptions = restrictAdminApiQueryOptions;
 exports.rejectAuthorsRestrictedOrderFields = rejectAuthorsRestrictedOrderFields;
 exports.rejectTagsRestrictedOrderFields = rejectTagsRestrictedOrderFields;
 exports.rejectPostsContentApiRestrictedOrderFields = rejectPostsContentApiRestrictedOrderFields;
@@ -73,7 +75,10 @@ const CONTENT_API_TAG_RESTRICTED_FIELDS = new Set([
     'parent',
 ]);
 const CONTENT_API_TAG_RELATIONS = new Set(['tag', 'tags', 'primary_tag']);
-const ADMIN_API_RESTRICTED_FIELDS = new Set(['password']);
+// Columns Ghost deliberately withholds from every Admin API response. `filter` and
+// `order` are both compiled to SQL against the raw table, so a column hidden from
+// output is still usable as an oracle unless it is blocked on the way in.
+const ADMIN_API_RESTRICTED_FIELDS = new Set(['password', 'token', 'gift_link_token', 'secret']);
 function getOrderAttributes(tableName) {
     return Object.keys(schema[tableName])
         .map((field) => `${tableName}.${field}`)
@@ -104,6 +109,9 @@ function hasRestrictedTagSegment(key) {
         CONTENT_API_TAG_RELATIONS.has(segments[index - 1]) &&
         CONTENT_API_TAG_RESTRICTED_FIELDS.has(segment));
 }
+function isAdminApiRestrictedKey(key) {
+    return hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS);
+}
 function isContentApiRestrictedKey(key) {
     return (hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS) ||
         hasRestrictedSegment(key, CONTENT_API_RESTRICTED_RELATIONS) ||
@@ -171,11 +179,62 @@ const rejectNewslettersContentApiRestrictedFieldsTransformer = (input) => {
 };
 exports.rejectNewslettersContentApiRestrictedFieldsTransformer = rejectNewslettersContentApiRestrictedFieldsTransformer;
 const rejectAdminApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isAdminApiRestrictedKey);
 };
 exports.rejectAdminApiRestrictedFieldsTransformer = rejectAdminApiRestrictedFieldsTransformer;
+/**
+ * `@tryghost/bookshelf-order` resolves an order field to the first order
+ * attribute that ends with it, so `word` sorts by `users.password` and `oken`
+ * by `invites.token`. An unqualified field is therefore restricted when it is a
+ * suffix of any restricted column name. A qualified field can only match a
+ * whole column name after the dot, so its segments are checked exactly.
+ */
+function isAdminApiRestrictedOrderField(field) {
+    const normalizedField = field.toLowerCase();
+    if (normalizedField.includes('.')) {
+        return isAdminApiRestrictedKey(normalizedField);
+    }
+    return [...ADMIN_API_RESTRICTED_FIELDS].some((restrictedField) => restrictedField.endsWith(normalizedField));
+}
+/**
+ * Every schema column is orderable by default (see the base model's
+ * `orderAttributes`), so `order` reaches the SQL `ORDER BY` clause untouched.
+ * Sorting by a withheld column leaks its relative byte ordering, which the
+ * `filter` guard alone does not prevent.
+ */
+function validateAdminApiRestrictedOrderFields(order) {
+    if (!order) {
+        return order;
+    }
+    const restrictedField = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => String(value).split(','))
+        .map((clause) => clause.trim().split(/\s+/)[0])
+        .filter(Boolean)
+        .find(isAdminApiRestrictedOrderField);
+    if (restrictedField) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Restricted fields cannot be used in order.',
+        });
+    }
+    return order;
+}
+/**
+ * Applies the Admin API restricted-field guard to the query options of a single
+ * endpoint. Both client-supplied query surfaces have to be covered: `filter`
+ * compiles to `WHERE` and `order` to `ORDER BY`, and each is an independent
+ * oracle over columns the serializers strip from the response.
+ */
+function restrictAdminApiQueryOptions(options) {
+    validateAdminApiRestrictedOrderFields(options.order);
+    return {
+        ...options,
+        mongoTransformer: options.mongoTransformer
+            ? (0, mongo_utils_1.chainTransformers)(options.mongoTransformer, exports.rejectAdminApiRestrictedFieldsTransformer)
+            : exports.rejectAdminApiRestrictedFieldsTransformer,
+    };
+}
 const validateAdminApiBulkFilterTransformer = (input) => {
-    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find((key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find(isAdminApiRestrictedKey);
     if (restrictedField) {
         throw new errors_1.default.BadRequestError({
             message: 'Restricted fields cannot be used in bulk operation filters.',

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -98,8 +98,8 @@ function defaultFormat(frame) {
 }
 
 function handlePostsMeta(frame) {
-  let metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
-  let meta = _.pick(frame.data.pages[0], metaAttrs);
+  const metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
+  const meta = _.pick(frame.data.pages[0], metaAttrs);
   frame.data.pages[0].posts_meta = meta;
 }
 

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -127,8 +127,8 @@ function defaultFormat(frame) {
 }
 
 function handlePostsMeta(frame) {
-  let metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
-  let meta = _.pick(frame.data.posts[0], metaAttrs);
+  const metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
+  const meta = _.pick(frame.data.posts[0], metaAttrs);
   frame.data.posts[0].posts_meta = meta;
 }
 

package/core/server/api/endpoints/utils/serializers/input/tags.js

@@ -5,7 +5,7 @@ const utils = require('../../index');
 const { rejectTagsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
-  let defaultOrder = 'name asc';
+  const defaultOrder = 'name asc';
 
   if (!frame.options.order && frame.options.filter) {
     frame.options.autoOrder = slugFilterOrder('tags', frame.options.filter);

package/core/server/api/endpoints/utils/serializers/input/utils/slug-filter-order.js

@@ -1,10 +1,10 @@
 const slugFilterOrder = (table, filter) => {
-  let orderMatch = filter.match(/slug:\s?\[(.*)\]/);
+  const orderMatch = filter.match(/slug:\s?\[(.*)\]/);
 
   if (orderMatch) {
-    let orderSlugs = orderMatch[1].split(',');
-    let caseParts = [];
-    let bindings = [];
+    const orderSlugs = orderMatch[1].split(',');
+    const caseParts = [];
+    const bindings = [];
 
     orderSlugs.forEach((slug, index) => {
       caseParts.push(`WHEN \`${table}\`.\`slug\` = ? THEN ?`);

package/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -118,11 +118,14 @@ const commentMapper = (model, frame) => {
     url.forPost(jsonModel.post.id, jsonModel.post, frame, routerType);
     response.post = _.pick(jsonModel.post, postFields);
 
-    // Compute excerpt from custom_excerpt or plaintext (same logic as post serializer)
-    if (jsonModel.post.custom_excerpt) {
-      response.post.excerpt = jsonModel.post.custom_excerpt;
-    } else if (jsonModel.post.plaintext) {
-      response.post.excerpt = jsonModel.post.plaintext.substring(0, 500);
+    // Excerpts can contain gated post content, so only Admin gets them
+    if (!isPublicRequest) {
+      // Compute excerpt from custom_excerpt or plaintext (same logic as post serializer)
+      if (jsonModel.post.custom_excerpt) {
+        response.post.excerpt = jsonModel.post.custom_excerpt;
+      } else if (jsonModel.post.plaintext) {
+        response.post.excerpt = jsonModel.post.plaintext.substring(0, 500);
+      }
     }
   }
 

package/core/server/api/endpoints/utils/serializers/output/mappers/posts.js

@@ -121,7 +121,7 @@ module.exports = async (model, frame, options = {}) => {
   }
 
   // Transforms post/page metadata to flat structure
-  let metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
+  const metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
   _(metaAttrs)
     .filter((k) => {
       return !frame.options.columns || (frame.options.columns && frame.options.columns.includes(k));

package/core/server/api/endpoints/utils/serializers/output/pages.js

@@ -17,7 +17,7 @@ module.exports = {
     if (!models) {
       return;
     }
-    let pages = [];
+    const pages = [];
 
     const tiersPage = await tiersService.api.browse({});
     const tiers =
@@ -44,8 +44,8 @@ module.exports = {
       }) || [];
 
     if (models.meta) {
-      for (let model of models.data) {
-        let page = await mappers.pages(model, frame, { tiers });
+      for (const model of models.data) {
+        const page = await mappers.pages(model, frame, { tiers });
         pages.push(page);
       }
       frame.response = {
@@ -55,7 +55,7 @@ module.exports = {
 
       return;
     }
-    let page = await mappers.pages(models, frame, { tiers });
+    const page = await mappers.pages(models, frame, { tiers });
     frame.response = {
       pages: [page],
     };

package/core/server/api/endpoints/utils/serializers/output/posts.js

@@ -21,7 +21,7 @@ module.exports = {
     if (!models) {
       return;
     }
-    let posts = [];
+    const posts = [];
 
     const tiersPage = await tiersService.api.browse({});
     const tiers =
@@ -47,8 +47,8 @@ module.exports = {
         };
       }) || [];
     if (models.meta) {
-      for (let model of models.data) {
-        let post = await mappers.posts(model, frame, { tiers });
+      for (const model of models.data) {
+        const post = await mappers.posts(model, frame, { tiers });
         posts.push(post);
       }
       frame.response = {
@@ -58,7 +58,7 @@ module.exports = {
 
       return;
     }
-    let post = await mappers.posts(models, frame, { tiers });
+    const post = await mappers.posts(models, frame, { tiers });
     frame.response = {
       posts: [post],
     };

package/core/server/api/endpoints/utils/serializers/output/search-index.js

@@ -8,8 +8,8 @@ module.exports = {
   async fetchPosts(models, apiConfig, frame) {
     debug('fetchPosts');
 
-    let posts = [];
-    let keys = [];
+    const posts = [];
+    const keys = [];
 
     if (utils.isContentAPI(frame)) {
       keys.push('id', 'slug', 'title', 'excerpt', 'url', 'updated_at', 'visibility');
@@ -17,7 +17,7 @@ module.exports = {
       keys.push('id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility');
     }
 
-    for (let model of models.data) {
+    for (const model of models.data) {
       let post = await mappers.posts(model, frame, {});
       post = _.pick(post, keys);
       posts.push(post);
@@ -31,11 +31,11 @@ module.exports = {
   async fetchPages(models, apiConfig, frame) {
     debug('fetchPages');
 
-    let pages = [];
+    const pages = [];
 
     const keys = ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility'];
 
-    for (let model of models.data) {
+    for (const model of models.data) {
       let page = await mappers.pages(model, frame, {});
       page = _.pick(page, keys);
       pages.push(page);
@@ -49,11 +49,11 @@ module.exports = {
   async fetchTags(models, apiConfig, frame) {
     debug('fetchTags');
 
-    let tags = [];
+    const tags = [];
 
     const keys = ['id', 'slug', 'name', 'url'];
 
-    for (let model of models.data) {
+    for (const model of models.data) {
       let tag = await mappers.tags(model, frame);
       tag = _.pick(tag, keys);
       tags.push(tag);
@@ -67,11 +67,11 @@ module.exports = {
   async fetchAuthors(models, apiConfig, frame) {
     debug('fetchAuthors');
 
-    let authors = [];
+    const authors = [];
 
     const keys = ['id', 'slug', 'name', 'url', 'profile_image'];
 
-    for (let model of models.data) {
+    for (const model of models.data) {
       let author = await mappers.authors(model, frame);
       author = _.pick(author, keys);
       authors.push(author);
@@ -85,11 +85,11 @@ module.exports = {
   async fetchUsers(models, apiConfig, frame) {
     debug('fetchUsers');
 
-    let users = [];
+    const users = [];
 
     const keys = ['id', 'slug', 'name', 'url', 'profile_image'];
 
-    for (let model of models.data) {
+    for (const model of models.data) {
       let user = await mappers.users(model, frame);
       user = _.pick(user, keys);
       users.push(user);

package/core/server/api/endpoints/utils/serializers/output/settings.js

@@ -12,7 +12,7 @@ const mappers = require('./mappers');
  * @returns {*}
  */
 function settingsFilter(settings, filter) {
-  let filteredGroups = filter ? filter.split(',') : [];
+  const filteredGroups = filter ? filter.split(',') : [];
   return _.filter(settings, (setting) => {
     if (filteredGroups.length > 0) {
       return _.includes(filteredGroups, setting.group);

package/core/server/api/endpoints/utils/serializers/output/utils/clean.js

@@ -140,6 +140,8 @@ const post = (attrs, frame) => {
   delete attrs.author;
   delete attrs.type;
   delete attrs.newsletter_id;
+  // Internal stored metadata — not part of the public Posts/Pages API yet
+  delete attrs.auto_excerpt;
 
   return attrs;
 };

package/core/server/api/endpoints/utils/serializers/output/utils/extra-attrs.js

@@ -23,7 +23,7 @@ module.exports.forPost = (options, model, attrs) => {
   // 1. Gets excerpt from post's plaintext. If custom_excerpt exists, it overrides the excerpt but the key remains excerpt.
   if (columnsIncludesExcerpt) {
     if (!attrs.custom_excerpt) {
-      let plaintext = model.get('plaintext');
+      const plaintext = model.get('plaintext');
       if (plaintext) {
         attrs.excerpt = plaintext.substring(0, 500);
       } else {
@@ -39,7 +39,7 @@ module.exports.forPost = (options, model, attrs) => {
   }
 
   if (columnsIncludesPlaintext || formatsIncludesPlaintext) {
-    let plaintext = model.get('plaintext');
+    const plaintext = model.get('plaintext');
     if (plaintext) {
       attrs.plaintext = plaintext;
     } else {
@@ -49,7 +49,7 @@ module.exports.forPost = (options, model, attrs) => {
 
   // 3. Displays excerpt if no columns was requested - specifically needed for the Admin Posts API
   if (noColumnsRequested) {
-    let customExcerpt = model.get('custom_excerpt');
+    const customExcerpt = model.get('custom_excerpt');
 
     if (customExcerpt !== null) {
       attrs.excerpt = customExcerpt;
@@ -64,6 +64,9 @@ module.exports.forPost = (options, model, attrs) => {
   }
 
   // 4. Add `reading_time` if no columns were requested, or if `reading_time` was requested via `columns`
+  // reading_time is also a DB column now; drop the raw value so we only expose it when
+  // computed below (avoids leaking `reading_time: null` into APIs/webhooks).
+  delete attrs.reading_time;
   if (noColumnsRequested || columnsIncludesReadingTime) {
     if (attrs.html) {
       let additionalImages = 0;

package/core/server/api/endpoints/utils/validators/input/automated_emails.js

@@ -20,54 +20,44 @@ const messages = {
   tokenRequired: 'Token is required',
 };
 
-const validateAutomatedEmail = async function (frame) {
+const validateAutomatedEmail = function (frame, isSlugRequired) {
   if (!frame.data.automated_emails || !frame.data.automated_emails[0]) {
-    return Promise.resolve();
+    return;
   }
 
   const data = frame.data.automated_emails[0];
 
   if (!data.name || !ALLOWED_NAMES.includes(data.name)) {
-    return Promise.reject(
-      new ValidationError({
-        message: tpl(messages.invalidName),
-        property: 'name',
-      }),
-    );
+    throw new ValidationError({
+      message: tpl(messages.invalidName),
+      property: 'name',
+    });
   }
 
   if (data.status && !ALLOWED_STATUSES.includes(data.status)) {
-    return Promise.reject(
-      new ValidationError({
-        message: tpl(messages.invalidStatus),
-        property: 'status',
-      }),
-    );
+    throw new ValidationError({
+      message: tpl(messages.invalidStatus),
+      property: 'status',
+    });
   }
 
-  if (data.slug && !ALLOWED_SLUGS.includes(data.slug)) {
-    return Promise.reject(
-      new ValidationError({
-        message: tpl(messages.invalidSlug),
-        property: 'slug',
-      }),
-    );
+  if ((isSlugRequired && !data.slug) || (data.slug && !ALLOWED_SLUGS.includes(data.slug))) {
+    throw new ValidationError({
+      message: tpl(messages.invalidSlug),
+      property: 'slug',
+    });
   }
 
   if (data.lexical) {
     try {
       JSON.parse(data.lexical);
     } catch (e) {
-      return Promise.reject(
-        new ValidationError({
-          message: tpl(messages.invalidLexical),
-          property: 'lexical',
-        }),
-      );
+      throw new ValidationError({
+        message: tpl(messages.invalidLexical),
+        property: 'lexical',
+      });
     }
   }
-
-  return Promise.resolve();
 };
 
 const validateOptionalStringField = (value, errorMessage) => {
@@ -107,11 +97,11 @@ const validatePreviewData = (frame) => {
 };
 
 module.exports = {
-  async add(apiConfig, frame) {
-    await validateAutomatedEmail(frame);
+  add(apiConfig, frame) {
+    validateAutomatedEmail(frame, true);
   },
-  async edit(apiConfig, frame) {
-    await validateAutomatedEmail(frame);
+  edit(apiConfig, frame) {
+    validateAutomatedEmail(frame, false);
   },
   editSenders(apiConfig, frame) {
     const senderName = frame.data.sender_name;

package/core/server/api/endpoints/utils/validators/input/settings.js

@@ -28,7 +28,7 @@ const iconUrlRegex = new RegExp(/^(\/|__GHOST_URL__\/)/);
 const iconUrlOptions = { require_protocol: true, protocols: ['http', 'https'] };
 
 function parseArraySettingValue(value) {
-  if (_.isArray(value)) {
+  if (Array.isArray(value)) {
     return value;
   }
 
@@ -43,11 +43,25 @@ function isValidNavigationUrl(value) {
   );
 }
 
+// Local installs serve uploaded icons from http://localhost:2368, which has no TLD
+function isLocalhostIconUrl(value) {
+  try {
+    return (
+      new URL(value).hostname === 'localhost' &&
+      validator.isURL(value, { ...iconUrlOptions, require_tld: false })
+    );
+  } catch {
+    return false;
+  }
+}
+
 function isValidNavigationIcon(value) {
   return (
     _.isString(value) &&
     !value.match(/\s/) &&
-    (validator.isURL(value, iconUrlOptions) || value.match(iconUrlRegex))
+    (validator.isURL(value, iconUrlOptions) ||
+      value.match(iconUrlRegex) ||
+      isLocalhostIconUrl(value))
   );
 }
 
@@ -149,10 +163,10 @@ module.exports = {
         //       settings API use raw unstringified objects (e.g. when adding notifications)
         //       The conditional can be removed once internals are changed to do the calls properly
         //       and the JSON.parse should be left as the only valid way to check the value.
-        if (!_.isArray(setting.value)) {
+        if (!Array.isArray(setting.value)) {
           try {
             const value = JSON.parse(setting.value);
-            if (!_.isArray(value)) {
+            if (!Array.isArray(value)) {
               errors.push(typeError);
             }
           } catch (err) {

package/core/server/data/exporter/exporter.js

@@ -1,4 +1,3 @@
-const _ = require('lodash');
 const db = require('../../data/db');
 const commands = require('../schema').commands;
 const ghostVersion = require('@tryghost/version');
@@ -14,7 +13,7 @@ const { TABLES_ALLOWLIST, SETTING_KEYS_BLOCKLIST } = require('./table-lists');
 const exportTable = function exportTable(tableName, options) {
   if (
     TABLES_ALLOWLIST.includes(tableName) ||
-    (options.include && _.isArray(options.include) && options.include.indexOf(tableName) !== -1)
+    (options.include && Array.isArray(options.include) && options.include.indexOf(tableName) !== -1)
   ) {
     const query = (options.transacting || db.knex)(tableName);
 
@@ -26,7 +25,8 @@ const getSettingsTableData = function getSettingsTableData(settingsData) {
   return (
     settingsData &&
     settingsData.filter((setting) => {
-      return !SETTING_KEYS_BLOCKLIST.includes(setting.key);
+      // core settings hold instance secrets and are never imported, so never export them
+      return setting.group !== 'core' && !SETTING_KEYS_BLOCKLIST.includes(setting.key);
     })
   );
 };

package/core/server/data/exporter/table-lists.js

@@ -34,6 +34,7 @@ const BACKUP_TABLES = [
   'members_payment_events',
   'members_login_events',
   'members_email_change_events',
+  'members_metafield_change_events',
   'members_status_events',
   'members_paid_subscription_events',
   'members_subscribe_events',
@@ -76,6 +77,7 @@ const BACKUP_TABLES = [
   'automation_runs',
   'welcome_email_automation_runs',
   'welcome_email_automated_emails',
+  'tinybird_syncs',
 ];
 
 // NOTE: exposing only tables which are going to be included in a "default" export file
@@ -104,7 +106,8 @@ const TABLES_ALLOWLIST = [
   'snippets',
 ];
 
-// NOTE: these are settings keys which should never end up in the export file
+// NOTE: these are non-core settings keys which should never end up in the export file
+//       (the whole core group is always excluded)
 const SETTING_KEYS_BLOCKLIST = [
   'stripe_connect_publishable_key',
   'stripe_connect_secret_key',
@@ -112,12 +115,8 @@ const SETTING_KEYS_BLOCKLIST = [
   'stripe_secret_key',
   'stripe_publishable_key',
   'stripe_billing_portal_configuration_id',
-  'members_stripe_webhook_id',
-  'members_stripe_webhook_secret',
   'email_verification_required',
   'indexnow_api_key',
-  'machine_payments_secret',
-  'machine_payments_deposit_address',
 ];
 
 module.exports = {

package/core/server/data/importer/handlers/image.js

@@ -3,9 +3,8 @@ const path = require('path');
 const config = require('../../../../shared/config');
 const urlUtils = require('../../../../shared/url-utils').default;
 const adapterManager = require('../../../services/adapter-manager').default;
-let ImageHandler;
 
-ImageHandler = {
+const ImageHandler = {
   type: 'images',
   extensions: config.get('uploads').images.extensions,
   contentTypes: config.get('uploads').images.contentTypes,

package/core/server/data/importer/handlers/json.js

@@ -9,9 +9,7 @@ const messages = {
   checkImportJsonIsValid: 'check that the import file is valid JSON.',
 };
 
-let JSONHandler;
-
-JSONHandler = {
+const JSONHandler = {
   type: 'data',
   extensions: ['.json'],
   contentTypes: ['application/octet-stream', 'application/json'],

package/core/server/data/importer/handlers/markdown.js

@@ -5,13 +5,9 @@ const featuredImageRegex = /^(!\[]\(([^)]*?)\)\s+)(?=#)/;
 const titleRegex = /^#\s?([\w\W]*?)(?=\n)/;
 const statusRegex = /(published||draft)-/;
 const dateRegex = /(\d{4}-\d{2}-\d{2})-/;
-let processDateTime;
-let processFileName;
-let processMarkdownFile;
-let MarkdownHandler;
 
 // Takes a date from the filename in y-m-d-h-m form, and converts it into a Date ready to import
-processDateTime = function (post, datetime) {
+const processDateTime = function (post, datetime) {
   const format = 'YYYY-MM-DD-HH-mm';
   datetime = moment.utc(datetime, format).valueOf();
 
@@ -24,7 +20,7 @@ processDateTime = function (post, datetime) {
   return post;
 };
 
-processFileName = function (filename) {
+const processFileName = function (filename) {
   let post = {};
   let name = filename.split('.')[0];
   let match;
@@ -50,7 +46,7 @@ processFileName = function (filename) {
   return post;
 };
 
-processMarkdownFile = function (filename, content) {
+const processMarkdownFile = function (filename, content) {
   const post = processFileName(filename);
   let match;
 
@@ -77,7 +73,7 @@ processMarkdownFile = function (filename, content) {
   return post;
 };
 
-MarkdownHandler = {
+const MarkdownHandler = {
   type: 'data',
   extensions: ['.md', '.markdown'],
   contentTypes: ['application/octet-stream', 'text/plain'],

package/core/server/data/importer/import-manager.js

@@ -29,7 +29,7 @@ const messages = {
   zipContainsMultipleDataFormats:
     'Zip file contains multiple data formats. Please split up and import separately.',
 };
-let defaults = {
+const defaults = {
   extensions: ['.zip'],
   contentTypes: ['application/zip', 'application/x-zip-compressed'],
   directories: [],