ghost 6.63.0 → 6.65.0

package/core/server/services/members-metafields/values-service.js

@@ -11,11 +11,14 @@ const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
 const identity_1 = require("@tryghost/metafield-types/identity");
 const schema_1 = require("./schema");
+const date_1 = require("../../lib/db-types/date");
 const queries_1 = require("./queries");
 const access_1 = require("./access");
 const storage_1 = require("./storage");
 const FIELDS_TABLE = 'members_metafields';
 const VALUES_TABLE = 'members_metafield_values';
+const CHANGE_EVENTS_TABLE = 'members_metafield_change_events';
+const MEMBERS_TABLE = 'members';
 /**
  * From the canonical schema, the same source definitions-service reads, so no key a site
  * could hold is refused and this cannot drift from the `members_metafields.key` column.
@@ -34,6 +37,24 @@ const UPSERT_CHUNK = 400;
 const MAX_IDENTITY_LENGTH = MAX_KEY_LENGTH * 2 + 1;
 const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_IDENTITY_LENGTH), zod_1.z.unknown());
 const wireProperty = (identity) => [identity_1.QUALIFIER, identity].join('.');
+/**
+ * Every refusal in one error.
+ *
+ * The API renders a single error, so the first still fills `message` and `property` and
+ * a client that reads only those sees exactly what it saw before. The whole set rides in
+ * `errorDetails`, which the renderer already passes through as `details`, so a client
+ * that wants to mark every refused input can have them all from one attempt.
+ */
+function refusalError(refusals) {
+    const [first, ...rest] = refusals;
+    return new errors_1.default.ValidationError({
+        message: first.message,
+        property: first.property,
+        // Omitted when there is nothing more to say, so the common single refusal keeps the
+        // shape it has always had rather than growing a one-element list.
+        ...(rest.length > 0 ? { errorDetails: refusals } : {}),
+    });
+}
 /**
  * What a member holds for each defined field. Separate from the definitions service
  * because a value belongs to the member and a definition belongs to the site's settings,
@@ -47,7 +68,11 @@ class MetafieldValuesService {
         this.knex = knex;
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async activeFieldsByIdentity(identities) {
+    // The query is scoped to the audience, so a field they may not see is absent from
+    // the map and the caller reports it as unknown. Looking up unscoped and rejecting
+    // afterwards would let a member tell a hidden field from an undefined one by the
+    // reply they got.
+    async allowedFieldsByIdentity(identities, audience) {
         const keys = identities
             .map((identity) => (0, identity_1.parseIdentity)(identity))
             .filter((parsed) => parsed !== null && parsed.namespace === identity_1.CUSTOM_NAMESPACE)
@@ -55,12 +80,19 @@ class MetafieldValuesService {
         if (keys.length === 0) {
             return new Map();
         }
-        const fields = await (0, queries_1.activeFields)(this.knex)
+        const fields = await (0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY })
             .whereIn('key', keys)
-            .select('id', 'key', 'name', 'type');
+            .select('id', 'key', 'name', 'type', 'member_access');
         return new Map(fields.map((field) => [
             (0, identity_1.formatIdentity)({ namespace: identity_1.CUSTOM_NAMESPACE, key: field.key, partPath: null }),
-            { ...field, namespace: identity_1.CUSTOM_NAMESPACE },
+            {
+                id: field.id,
+                key: field.key,
+                name: field.name,
+                type: field.type,
+                namespace: identity_1.CUSTOM_NAMESPACE,
+                memberAccess: field.member_access,
+            },
         ]));
     }
     async getValuesForMembers(memberIds, audience) {
@@ -70,8 +102,7 @@ class MetafieldValuesService {
         // Not ordered by field: these rows become an object keyed by field, and an object
         // cannot carry an order. `path` is ordered so composite parts assemble the same
         // way every time.
-        const rows = await this.knex(VALUES_TABLE)
-            .join(FIELDS_TABLE, `${VALUES_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`)
+        const rows = await (0, queries_1.readableBy)(this.knex(VALUES_TABLE).join(FIELDS_TABLE, `${VALUES_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`), audience)
             .whereIn(`${VALUES_TABLE}.member_id`, memberIds)
             .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
             .orderBy(`${VALUES_TABLE}.path`, 'asc')
@@ -90,10 +121,7 @@ class MetafieldValuesService {
                 }, 'Skipping an unreadable metafield value');
             }
         }
-        // Narrowed before assembly, not after: a composite is one value spread across
-        // several rows, and dropping some of its parts later would hand back half an
-        // address rather than no address.
-        const flat = (0, storage_1.valuesFromLeaves)((0, access_1.readableFields)(audience, leaves));
+        const flat = (0, storage_1.valuesFromLeaves)(leaves);
         return new Map(memberIds.map((memberId) => [memberId, { [identity_1.CUSTOM_NAMESPACE]: flat.get(memberId) ?? {} }]));
     }
     parseValues(input) {
@@ -157,21 +185,29 @@ class MetafieldValuesService {
                 property: identity_1.QUALIFIER,
             });
         }
-        const byIdentity = await this.activeFieldsByIdentity(identities);
+        const byIdentity = await this.allowedFieldsByIdentity(identities, audience);
         const writes = [];
+        // Gathered rather than thrown as they are found. A write names several values, and
+        // a composite is several again, so refusing at the first leaves someone correcting
+        // one part per round trip to learn what was wrong with the rest.
+        const refusals = [];
         for (const [identity, raw] of Object.entries(values)) {
             const field = byIdentity.get(identity);
             if (!field) {
-                throw new errors_1.default.ValidationError({
+                refusals.push({
                     message: `Unknown custom field: ${identity}`,
                     property: wireProperty(identity),
                 });
+                continue;
             }
+            // A different refusal from the unknown-field one above: this audience can
+            // already see the field, so naming it discloses nothing.
             if (!(0, access_1.canWrite)(audience, field)) {
-                throw new errors_1.default.ValidationError({
+                refusals.push({
                     message: `Cannot set custom field: ${identity}`,
                     property: wireProperty(identity),
                 });
+                continue;
             }
             // `null` clears any field, and `''` clears one with no parts. For a value
             // with parts `''` names nothing, so it is left to fail validation rather than
@@ -186,14 +222,21 @@ class MetafieldValuesService {
             // Which field failed rides in `property`.
             const value = metafield_types_1.FIELD_TYPES[field.type].value.safeParse(raw);
             if (!value.success) {
-                const issue = value.error.issues[0];
-                throw new errors_1.default.ValidationError({
-                    message: issue.message,
-                    property: [wireProperty(identity), ...issue.path].join('.'),
-                });
+                // Every issue, not the first: a value with parts fails once per part, and each
+                // names the part it belongs to, which is what lets a client mark them all.
+                for (const issue of value.error.issues) {
+                    refusals.push({
+                        message: issue.message,
+                        property: [wireProperty(identity), ...issue.path].join('.'),
+                    });
+                }
+                continue;
             }
             writes.push({ field, value: value.data });
         }
+        if (refusals.length > 0) {
+            throw refusalError(refusals);
+        }
         return writes;
     }
     /**
@@ -204,13 +247,19 @@ class MetafieldValuesService {
      * them, and saying nothing about a path leaves it alone. There is no whole-value
      * replace, so a caller that does not know about a field cannot erase it.
      *
-     * `writtenBy` is required and has no default: every writer has to name itself, so a new
-     * one cannot quietly inherit the identity of whichever was written first.
+     * `writtenBy` and `source` are required and have no default: every writer has to name
+     * itself and where it wrote, so a new one cannot quietly inherit the identity of
+     * whichever was written first.
      *
      * Always transactional. Given an executor it joins that transaction, so the importer's
      * failed value write takes its member with it; given none it opens its own.
+     *
+     * Every write also puts an entry on the member's activity feed, naming the fields it
+     * touched and who wrote them where, in the same transaction, so the feed cannot name a
+     * change that was not stored or miss one that was. A value has more than one author,
+     * and the feed is where a publisher finds out which of them changed it.
      */
-    async applyWrite(memberId, writes, { writtenBy, executor = this.knex }) {
+    async applyWrite(memberId, writes, { writtenBy, source, executor = this.knex }) {
         if (writes.length === 0) {
             return;
         }
@@ -273,6 +322,22 @@ class MetafieldValuesService {
                     // it currently holds rather than who wrote its first value.
                     .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
             }
+            const fields = writes.map(({ field }) => ({
+                namespace: field.namespace,
+                key: field.key,
+                name: field.name,
+            }));
+            await trx(CHANGE_EVENTS_TABLE).insert({
+                id: new bson_objectid_1.default().toHexString(),
+                member_id: memberId,
+                written_by_type: writtenBy.type,
+                written_by_id: writtenBy.id,
+                source,
+                metafields: schema_1.StoredFieldList.encode(fields),
+                // A string rather than the Date the value rows take: SQLite stores a bound Date
+                // as a number, which sorts before every string the feed pages through time with.
+                created_at: (0, date_1.toDatabaseDate)(now),
+            });
         };
         // knex's marker for a transactor: join it rather than nesting a savepoint under it.
         if (executor.isTransaction) {
@@ -282,5 +347,51 @@ class MetafieldValuesService {
             await executor.transaction(apply);
         }
     }
+    /**
+     * Entries from members' activity feeds, newest first, each with its member, as one page
+     * of the members events endpoint reads them.
+     *
+     * `filter` is a parsed NQL filter over this table's own columns: mapping the feed's
+     * names onto them is the feed's business, and applying them is this table's.
+     */
+    async browseChangeEvents({ limit, filter, }) {
+        const filtered = () => {
+            const query = this.knex(CHANGE_EVENTS_TABLE);
+            return filter ? (0, queries_1.knexify)(query, filter, { tableName: CHANGE_EVENTS_TABLE }) : query;
+        };
+        // Joined rather than looked up afterwards: an entry cannot outlive its member, whose
+        // delete cascades to it, so every entry has one to join.
+        const newestFirst = filtered()
+            .join(MEMBERS_TABLE, `${MEMBERS_TABLE}.id`, `${CHANGE_EVENTS_TABLE}.member_id`)
+            .orderBy([
+            { column: `${CHANGE_EVENTS_TABLE}.created_at`, order: 'desc' },
+            { column: `${CHANGE_EVENTS_TABLE}.id`, order: 'desc' },
+        ]);
+        const page = limit === undefined ? newestFirst : newestFirst.limit(limit);
+        const [rows, counted] = await Promise.all([
+            page.select(`${CHANGE_EVENTS_TABLE}.id`, `${CHANGE_EVENTS_TABLE}.member_id`, `${CHANGE_EVENTS_TABLE}.written_by_type`, `${CHANGE_EVENTS_TABLE}.written_by_id`, `${CHANGE_EVENTS_TABLE}.source`, `${CHANGE_EVENTS_TABLE}.metafields`, `${CHANGE_EVENTS_TABLE}.created_at`, { member_uuid: `${MEMBERS_TABLE}.uuid` }, { member_name: `${MEMBERS_TABLE}.name` }, { member_email: `${MEMBERS_TABLE}.email` }),
+            filtered().count({ total: '*' }).first(),
+        ]);
+        // What to do with an entry whose field list can't be read is decided here, not in the
+        // parser: it is still shown, naming no fields. The feed pages through time a page per
+        // event type, so dropping an entry would push a valid one off the end of its page for
+        // good. Anything else a row can't be read for, the table's constraints rule out, so it
+        // throws rather than being hidden.
+        const events = rows.map(({ member_uuid: uuid, member_name: name, member_email: email, ...event }) => {
+            const fields = schema_1.StoredFieldList.safeParse(event.metafields);
+            if (!fields.success) {
+                logging_1.default.warn({
+                    event: { name: 'members.metafields.change_event_unreadable' },
+                    err: fields.error,
+                    changeEventId: event.id,
+                }, 'Reading an unreadable metafield change entry as naming no fields');
+            }
+            return schema_1.DbMetafieldChangeEventWithMember.parse({
+                event: fields.success ? event : { ...event, metafields: schema_1.StoredFieldList.encode([]) },
+                member: { id: event.member_id, uuid, name, email },
+            });
+        });
+        return { events, total: Number(counted?.total ?? 0) };
+    }
 }
 exports.MetafieldValuesService = MetafieldValuesService;

package/core/server/services/mentions/mention-discovery-service.js

@@ -63,7 +63,7 @@ module.exports = class MentionDiscoveryService {
       return null;
     }
 
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(response.body);
 
     // must be first <link> OR <a> element with rel=webmention

package/core/server/services/mentions/mention-sending-service.js

@@ -81,8 +81,8 @@ module.exports = class MentionSendingService {
         return;
       }
       // make sure we have something to parse before we create a job
-      let html = post.get('status') === 'published' ? post.get('html') : null;
-      let previousHtml = post.previous('status') === 'published' ? post.previous('html') : null;
+      const html = post.get('status') === 'published' ? post.get('html') : null;
+      const previousHtml = post.previous('status') === 'published' ? post.previous('html') : null;
       if (html || previousHtml) {
         // Capture the source URL now, from the event's data, rather than
         // deferring the model into the job.
@@ -242,7 +242,7 @@ module.exports = class MentionSendingService {
    * @returns {URL[]}
    */
   getLinks(html) {
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
     const $ = cheerio.load(html);
     const urls = [];
     const siteUrl = this.siteUrl;

package/core/server/services/mentions/mention.js

@@ -61,7 +61,7 @@ module.exports = class Mention {
 
     if (contentType.includes('text/html')) {
       try {
-        const cheerio = require('cheerio');
+        const cheerio = require('cheerio/slim');
         const $ = cheerio.load(html);
         const hasTargetUrl =
           $(
@@ -309,12 +309,11 @@ module.exports = class Mention {
       timestamp = new Date();
     }
 
-    let payload;
-    payload = data.payload ? JSON.parse(JSON.stringify(data.payload)) : null;
+    const payload = data.payload ? JSON.parse(JSON.stringify(data.payload)) : null;
 
     /** @type boolean */
-    let verified;
-    verified = isNew ? false : !!data.verified;
+
+    const verified = isNew ? false : !!data.verified;
 
     /** @type {ObjectID | null} */
     let resourceId = null;

package/core/server/services/mentions/mentions-api.js

@@ -321,7 +321,10 @@ module.exports = class MentionsAPI {
    * @returns {Promise<Mention>}
    */
   async processWebmention(webmention) {
-    let mention = await this.#repository.getBySourceAndTarget(webmention.source, webmention.target);
+    const mention = await this.#repository.getBySourceAndTarget(
+      webmention.source,
+      webmention.target,
+    );
 
     return await this.#updateWebmention(mention, webmention);
   }

package/core/server/services/mentions-jobs/job-service.js

@@ -20,33 +20,6 @@ const workerMessageHandler = ({ name, message }) => {
   }
 };
 
-const initTestMode = () => {
-  // Output job queue length every 5 seconds
-  setInterval(() => {
-    logging.warn(
-      `${jobManager.inlineQueue.length()} jobs in the queue. Idle: ${jobManager.inlineQueue.idle()}`,
-    );
-
-    const runningScheduledjobs = Object.keys(jobManager.bree.workers);
-    if (Object.keys(jobManager.bree.workers).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.workers).length} jobs running: ${runningScheduledjobs}`,
-      );
-    }
-
-    const scheduledJobs = Object.keys(jobManager.bree.intervals);
-    if (Object.keys(jobManager.bree.intervals).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.intervals).length} scheduled jobs: ${scheduledJobs}`,
-      );
-    }
-
-    if (runningScheduledjobs.length === 0 && scheduledJobs.length === 0) {
-      logging.warn('No scheduled or running jobs');
-    }
-  }, 5000);
-};
-
 const jobManager = new JobManager({
   errorHandler,
   workerMessageHandler,
@@ -56,4 +29,3 @@ const jobManager = new JobManager({
 });
 
 module.exports = jobManager;
-module.exports.initTestMode = initTestMode;

package/core/server/services/milestones/milestones-service.js

@@ -300,7 +300,7 @@ module.exports = class MilestonesService {
     const membersMilestones = this.#milestonesConfig.members;
 
     // get the closest milestone we're over now
-    let achievedMilestones = this.#getMatchedMilestones(membersMilestones, membersCount);
+    const achievedMilestones = this.#getMatchedMilestones(membersMilestones, membersCount);
 
     // check for previously achieved milestones. We do not send an email when no
     // previous milestones exist

package/core/server/services/newsletters/newsletters-service.js

@@ -391,7 +391,7 @@ class NewslettersService {
         if (process.env.NODE_ENV !== 'production') {
           logging.warn(message.text);
         }
-        let msg = Object.assign(
+        const msg = Object.assign(
           {
             from: fromEmail,
             subject: 'Verify email address',

package/core/server/services/notifications/notifications.js

@@ -37,7 +37,7 @@ class Notifications {
    * @returns {Object[]} - all notifications
    */
   fetchAllNotifications() {
-    let allNotifications = this.settingsCache.get('notifications');
+    const allNotifications = this.settingsCache.get('notifications');
 
     // @TODO: this check can be removed to improve read operation perf. It's here only because
     //        reads are done often and this gives a possibility to self-heal any broken records.
@@ -67,7 +67,7 @@ class Notifications {
    * @returns {boolean}
    */
   areNotificationsValid(notifications) {
-    if (!_.isArray(notifications)) {
+    if (!Array.isArray(notifications)) {
       return false;
     }
 
@@ -151,7 +151,7 @@ class Notifications {
       addedAt: moment().toDate(),
     };
 
-    let notificationsToCheck = notifications;
+    const notificationsToCheck = notifications;
     let notificationsToAdd = [];
 
     const allNotifications = this.fetchAllNotifications();

package/core/server/services/oembed/oembed-service.js

@@ -42,6 +42,7 @@ const messages = {
   unableToFetchOembed: 'Unable to fetch requested embed.',
   unauthorized: 'URL contains a private resource.',
   unconvertibleSvg: 'SVG image is too large or compressed to convert.',
+  unsupportedImage: 'Image is not a supported file type.',
 };
 
 const SVG_RASTER_SIZE = 256;
@@ -68,6 +69,16 @@ const shouldRasterize = (buffer, ext) => {
   return head.startsWith('<') && /<svg[\s:>]/i.test(head);
 };
 
+let fileTypeFromBuffer;
+
+const detectFileType = async (buffer) => {
+  if (!fileTypeFromBuffer) {
+    ({ fileTypeFromBuffer } = await import('file-type'));
+  }
+
+  return fileTypeFromBuffer(buffer);
+};
+
 /**
  * @param {string} url
  * @returns {{url: string, provider: boolean}}
@@ -79,15 +90,15 @@ const findUrlWithProvider = (url) => {
 
   // build up a list of URL variations to test against because the oembed
   // providers list is not always up to date with scheme or www vs non-www
-  let baseUrl = url.replace(/^\/\/|^https?:\/\/(?:www\.)?/, '');
-  let testUrls = [
+  const baseUrl = url.replace(/^\/\/|^https?:\/\/(?:www\.)?/, '');
+  const testUrls = [
     `https://${baseUrl}`,
     `https://www.${baseUrl}`,
     `http://${baseUrl}`,
     `http://www.${baseUrl}`,
   ];
 
-  for (let testUrl of testUrls) {
+  for (const testUrl of testUrls) {
     provider = hasProvider(testUrl);
     if (provider) {
       url = testUrl;
@@ -234,6 +245,20 @@ class OEmbedService {
       });
 
       ext = '.png';
+    } else {
+      // The URL's extension is attacker-controlled and decides the
+      // Content-Type the stored file is later served with, so name the
+      // file after its contents and hold it to the same allowlist as image
+      // uploads. `file-type` never reports SVG, which is handled above.
+      const fileType = await detectFileType(imageBuffer);
+      ext = fileType ? `.${fileType.ext}` : '';
+
+      if (!this.config.get('uploads').images.extensions.includes(ext)) {
+        throw new errors.ValidationError({
+          message: tpl(messages.unsupportedImage),
+          context: imageUrl,
+        });
+      }
     }
 
     const uniqueFileName = `${name}-${crypto.randomUUID()}${ext}`;
@@ -369,6 +394,80 @@ class OEmbedService {
     };
   }
 
+  /**
+   * Requests a URL through this.externalRequest and resolves with the response
+   * and at most the first chunk of its body, aborting the rest of the download.
+   *
+   * @param {string} url
+   * @returns {Promise<{response: import('got').Response, chunk?: Buffer}>}
+   */
+  fetchFirstChunk(url) {
+    return new Promise((resolve, reject) => {
+      const stream = this.externalRequest.stream(url, {
+        headers: {
+          'user-agent': USER_AGENT,
+          range: 'bytes=0-0',
+        },
+        timeout: {
+          request: DEFAULT_REQUEST_TIMEOUT,
+        },
+        decompress: false,
+        throwHttpErrors: false,
+      });
+      let response;
+
+      stream.on('response', (res) => {
+        response = res;
+      });
+      stream.once('data', (chunk) => {
+        stream.destroy();
+        resolve({ response, chunk });
+      });
+      stream.once('end', () => resolve({ response }));
+      stream.on('error', reject);
+    });
+  }
+
+  /**
+   * Checks that a favicon candidate is reachable and looks like an image.
+   *
+   * Replaces metascraper-logo-favicon's default resolver, which probes via
+   * reachable-url. reachable-url bundles got 11, which ignores the `dnsLookup`
+   * externalRequest installs to validate the resolved IP at connection time,
+   * leaving those probes open to DNS rebinding. Mirrors the default resolver's
+   * checks otherwise.
+   *
+   * @param {string} faviconUrl
+   * @param {Array<string|string[]>} [contentTypes] - allowed content types for the icon's extension
+   * @returns {Promise<{url: string} | undefined>}
+   */
+  async resolveFaviconUrl(faviconUrl, contentTypes) {
+    let result;
+    try {
+      result = await this.fetchFirstChunk(faviconUrl);
+    } catch {
+      return undefined;
+    }
+
+    const { response, chunk } = result;
+    if (!response || response.statusCode < 200 || response.statusCode >= 300) {
+      return undefined;
+    }
+
+    if (contentTypes) {
+      const contentType = response.headers['content-type']?.split(';')[0].toLowerCase();
+      if (!contentType || !contentTypes.some((ct) => contentType.includes(ct))) {
+        return undefined;
+      }
+      // An empty body or one starting with '<' (60) is markup, not an image
+      if (!chunk?.length || chunk[0] === 60) {
+        return undefined;
+      }
+    }
+
+    return { url: response.url };
+  }
+
   /**
    * @param {string} url
    * @param {string} html
@@ -452,6 +551,8 @@ class OEmbedService {
       require('metascraper-logo-favicon')({
         gotOpts,
         pickFn,
+        resolveFaviconUrl: (faviconUrl, contentTypes) =>
+          this.resolveFaviconUrl(faviconUrl, contentTypes),
       }),
       require('metascraper-logo')(),
     ];
@@ -561,12 +662,12 @@ class OEmbedService {
    */
   async fetchOembedData(url, html, cardType) {
     // Lazy require the library to keep boot quick
-    const cheerio = require('cheerio');
+    const cheerio = require('cheerio/slim');
 
     // check for <link rel="alternate" type="application/json+oembed"> element
     let oembedUrl;
     try {
-      oembedUrl = cheerio('link[type="application/json+oembed"]', html).attr('href');
+      oembedUrl = cheerio.load(html)('link[type="application/json+oembed"]').attr('href');
     } catch (e) {
       return this.unknownProvider(url);
     }
@@ -622,15 +723,15 @@ class OEmbedService {
           return;
         }
 
-        // `rich` and `video` responses ship provider-supplied HTML that gets
-        // stored in the post's Lexical payload and rendered into the admin
-        // editor preview (via srcdoc) and into public themes (via innerHTML).
-        // Known providers (YouTube, Twitter, etc.) go through `knownProvider`
-        // with @extractus/oembed-extractor's allowlist — anything reaching
-        // here is an arbitrary site's self-declared oEmbed endpoint, which we
-        // must not trust. Drop the response and let the caller fall back to
-        // a bookmark card.
-        if (oembed.type === 'video' || oembed.type === 'rich') {
+        // `rich`, `video` and `photo` responses can all ship provider-supplied
+        // HTML that gets stored in the post's Lexical payload and rendered
+        // into the admin editor preview (via srcdoc) and into public themes
+        // and emails (via innerHTML). Known providers (YouTube, Twitter, etc.)
+        // go through `knownProvider` with @extractus/oembed-extractor's
+        // allowlist — anything reaching here is an arbitrary site's
+        // self-declared oEmbed endpoint, which we must not trust. Drop the
+        // response and let the caller fall back to a bookmark card.
+        if (oembed.type === 'video' || oembed.type === 'rich' || oembed.type === 'photo') {
           return;
         }
 

package/core/server/services/permissions/can-this.js

@@ -132,7 +132,6 @@ class CanThisResult {
     const self = this;
     let userPermissionLoad;
     let apiKeyPermissionLoad;
-    let permissionsLoad;
 
     // Get context.user, context.api_key and context.app
     context = parseContext(context);
@@ -158,7 +157,7 @@ class CanThisResult {
     }
 
     // Wait for both user and api key permissions to load
-    permissionsLoad = Promise.all([userPermissionLoad, apiKeyPermissionLoad]).then(
+    const permissionsLoad = Promise.all([userPermissionLoad, apiKeyPermissionLoad]).then(
       function (result) {
         return {
           user: result[0],

package/core/server/services/post-scheduling/post-scheduling.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const moment_1 = __importDefault(require("moment"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const build_signed_job_1 = require("../../adapters/scheduling/build-signed-job");
+const get_scheduler_idempotency_key_1 = require("../../adapters/scheduling/get-scheduler-idempotency-key");
 // CJS-only modules — typed loosely below. models is the Bookshelf registry
 // without TS declarations; the rest are JS modules without types.
 const models = require('../../models');
@@ -111,14 +112,20 @@ class PostScheduling {
         const resource = `${resourceType}s`;
         const publishedAt = event === 'unscheduled' ? model.previous('published_at') : model.get('published_at');
         const previousPublishedAt = model.previous('published_at');
+        const time = (0, moment_1.default)(publishedAt).valueOf();
         return (0, build_signed_job_1.buildSignedJob)({
             apiUrl: this.#apiUrl,
             path: ['schedules', resource, `${model.get('id')}/`],
-            time: (0, moment_1.default)(publishedAt).valueOf(),
+            time,
             key,
             extra: {
                 oldTime: previousPublishedAt ? (0, moment_1.default)(previousPublishedAt).valueOf() : null,
             },
+            // The key identifies one job: the URL already carries the resource
+            // and a token signed for this fire time under the current signing key,
+            // so re-registering the same job (e.g. a boot rebuild) yields the same
+            // key, while a reschedule or key rotation yields a new one.
+            getIdempotencyKey: (url) => (0, get_scheduler_idempotency_key_1.getSchedulerIdempotencyKey)({ namespace: 'post-scheduling', date: new Date(time), url }),
         });
     }
 }