ghost 6.64.0 → 6.65.0

package/core/server/lib/request-external.js

@@ -12,6 +12,7 @@ const dnsPromises = require('dns').promises;
 const errors = require('@tryghost/errors');
 const config = require('../../shared/config');
 const validator = require('@tryghost/validator');
+const ipaddr = require('ipaddr.js');
 
 // Shared keep-alive agents so outbound HTTPS connections are pooled and reused
 // across page renders / oEmbed / webmention / recommendations / image probes.
@@ -44,70 +45,58 @@ function normalizeIPv4(addr) {
   return null;
 }
 
+const IPV4_COMPATIBLE = ipaddr.IPv6.parseCIDR('::/96');
+const NAT64_WELL_KNOWN = ipaddr.IPv6.parseCIDR('64:ff9b::/96');
+
 /**
- * Normalize an IPv6 address from any expanded form (e.g. 0:0:0:0:0:0:0:1)
- * to compressed notation (e.g. ::1) using the WHATWG URL parser.
- * Returns null if the address is not a valid IPv6 address.
+ * Build an IPv4 address from two 16-bit IPv6 groups.
+ *
+ * @param {number} hi
+ * @param {number} lo
+ * @returns {ipaddr.IPv4}
  */
-function normalizeIPv6(addr) {
-  try {
-    const hostname = new URL('http://[' + addr + ']/').hostname;
-    // hostname includes brackets, strip them
-    const normalized = hostname.slice(1, -1);
-    if (net.isIPv6(normalized)) {
-      return normalized;
-    }
-  } catch {
-    // URL parsing failed
-  }
-  return null;
+function ipv4FromGroups(hi, lo) {
+  return new ipaddr.IPv4([(hi >> 8) & 0xff, hi & 0xff, (lo >> 8) & 0xff, lo & 0xff]);
 }
 
 /**
- * Check if a normalized (dotted-decimal) IPv4 address falls in a private/reserved range.
+ * Default-deny: anything outside ipaddr.js's plain "unicast" range is private.
+ * IPv6 transition prefixes that route to an embedded IPv4 address are classified
+ * by that IPv4 address instead, so e.g. DNS64-synthesized addresses for public
+ * hosts are still allowed on NAT64 networks.
+ *
+ * @param {ipaddr.IPv4 | ipaddr.IPv6} address
+ * @returns {boolean}
  */
-function isPrivateIPv4(addr) {
-  const parts = addr.split('.');
-  const a = parseInt(parts[0], 10);
-  const b = parseInt(parts[1], 10);
+function isPrivateAddress(address) {
+  if (address instanceof ipaddr.IPv6) {
+    const parts = address.parts;
 
-  // 10.0.0.0/8
-  if (a === 10) {
-    return true;
-  }
-  // 172.16.0.0/12
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  // 192.168.0.0/16
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  // 127.0.0.0/8
-  if (a === 127) {
-    return true;
-  }
-  // 169.254.0.0/16
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  // 100.64.0.0/10 (carrier-grade NAT, RFC 6598)
-  if (a === 100 && b >= 64 && b <= 127) {
-    return true;
-  }
-  // 198.18.0.0/15 (benchmarking, RFC 2544)
-  if (a === 198 && (b === 18 || b === 19)) {
-    return true;
-  }
-  // 0.0.0.0/8
-  if (a === 0) {
-    return true;
-  }
-  // 240.0.0.0/4 (reserved) and 255.255.255.255 (broadcast)
-  if (a >= 240) {
-    return true;
+    // ::/96 - unspecified, loopback and deprecated IPv4-compatible addresses (RFC 4291).
+    // ipaddr.js classifies IPv4-compatible addresses such as ::7f00:1 as unicast.
+    if (address.match(IPV4_COMPATIBLE)) {
+      return true;
+    }
+
+    switch (address.range()) {
+      // ::ffff:0:0/96 IPv4-mapped (RFC 4291) and ::ffff:0:0:0/96 IPv4-translated (RFC 6145)
+      case 'ipv4Mapped':
+      case 'rfc6145':
+        return isPrivateAddress(ipv4FromGroups(parts[6], parts[7]));
+      // 64:ff9b::/96 NAT64 well-known prefix (RFC 6052). The 64:ff9b:1::/48 local-use
+      // prefix (RFC 8215) has a network-specific IPv4 position, so it stays blocked.
+      case 'rfc6052':
+        if (address.match(NAT64_WELL_KNOWN)) {
+          return isPrivateAddress(ipv4FromGroups(parts[6], parts[7]));
+        }
+        return true;
+      // 2002::/16 6to4 (RFC 3056)
+      case '6to4':
+        return isPrivateAddress(ipv4FromGroups(parts[1], parts[2]));
+    }
   }
-  return false;
+
+  return address.range() !== 'unicast';
 }
 
 function isPrivateIp(addr) {
@@ -116,70 +105,17 @@ function isPrivateIp(addr) {
     return true;
   }
 
-  // Check for IPv4-mapped IPv6 in dotted notation (e.g. ::ffff:192.168.0.1)
-  const v4DottedMatch = addr.match(/^::ffff:(\d[\d.]+)$/i);
-  if (v4DottedMatch) {
-    const normalized = normalizeIPv4(v4DottedMatch[1]);
-    if (normalized) {
-      return isPrivateIPv4(normalized);
-    }
+  let address;
+  try {
+    // WHATWG normalization first so every IPv4 form Node will connect to
+    // (decimal, octal, hex, integer, shortened) is parsed the same way
+    address = ipaddr.parse(normalizeIPv4(addr) ?? addr);
+  } catch {
+    // Unrecognized format - fail closed
     return true;
   }
 
-  // Check for IPv4-mapped IPv6 in hex notation (e.g. ::ffff:7f00:1)
-  const v4HexMatch = addr.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-  if (v4HexMatch) {
-    const hi = parseInt(v4HexMatch[1], 16);
-    const lo = parseInt(v4HexMatch[2], 16);
-    const mapped =
-      ((hi >> 8) & 0xff) + '.' + (hi & 0xff) + '.' + ((lo >> 8) & 0xff) + '.' + (lo & 0xff);
-    return isPrivateIPv4(mapped);
-  }
-
-  // Try normalizing as IPv4 (handles decimal, octal, hex, and integer notation)
-  const normalized = normalizeIPv4(addr);
-  if (normalized) {
-    return isPrivateIPv4(normalized);
-  }
-
-  // IPv6 checks
-  const normalized6 = normalizeIPv6(addr);
-  if (normalized6) {
-    // ::1 loopback, :: unspecified
-    if (normalized6 === '::1' || normalized6 === '::' || normalized6 === '::0') {
-      return true;
-    }
-    // fc00::/7 unique local
-    if (/^f[cd][0-9a-f]{2}:/i.test(normalized6)) {
-      return true;
-    }
-    // fe80::/10 link-local
-    if (/^fe[89ab][0-9a-f]:/i.test(normalized6)) {
-      return true;
-    }
-    // Re-check for IPv4-mapped IPv6 after normalization
-    // Handles expanded forms like 0:0:0:0:0:ffff:127.0.0.1 which normalize to ::ffff:...
-    const v4DottedNorm = normalized6.match(/^::ffff:(\d[\d.]+)$/i);
-    if (v4DottedNorm) {
-      const normV4 = normalizeIPv4(v4DottedNorm[1]);
-      if (normV4) {
-        return isPrivateIPv4(normV4);
-      }
-      return true;
-    }
-    const v4HexNorm = normalized6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-    if (v4HexNorm) {
-      const hi = parseInt(v4HexNorm[1], 16);
-      const lo = parseInt(v4HexNorm[2], 16);
-      const mapped =
-        ((hi >> 8) & 0xff) + '.' + (hi & 0xff) + '.' + ((lo >> 8) & 0xff) + '.' + (lo & 0xff);
-      return isPrivateIPv4(mapped);
-    }
-    return false;
-  }
-
-  // Unrecognized format - fail closed
-  return true;
+  return isPrivateAddress(address);
 }
 
 async function errorIfHostnameResolvesToPrivateIp(options) {

package/core/server/models/base/plugins/actions.js

@@ -1,4 +1,3 @@
-const _ = require('lodash');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 
@@ -27,7 +26,7 @@ module.exports = function (Bookshelf) {
       return Bookshelf.model('Action')
         .add(action, { autoRefresh: false })
         .catch((err) => {
-          if (_.isArray(err)) {
+          if (Array.isArray(err)) {
             err = err[0];
           }
 
@@ -99,7 +98,7 @@ module.exports = function (Bookshelf) {
           return;
         }
 
-        let context = {
+        const context = {
           action_name: options.actionName,
         };
 

package/core/server/models/base/plugins/crud.js

@@ -302,10 +302,9 @@ module.exports = function (Bookshelf) {
        */
       add: function add(data, unfilteredOptions) {
         const options = this.filterOptions(unfilteredOptions, 'add');
-        let model;
 
         data = this.filterData(data);
-        model = this.forge(data);
+        const model = this.forge(data);
 
         // We allow you to disable timestamps when importing posts so that the new posts `updated_at` value is the same
         // as the import json blob. More details refer to https://github.com/TryGhost/Ghost/issues/1696

package/core/server/models/base/plugins/events.js

@@ -8,7 +8,7 @@ const schema = require('../../../data/schema');
 const events = require('../../../lib/common/events');
 
 // Run tests or development with NUMERIC_IDS=1 to enable numeric object IDs
-let forceNumericObjectIds = process.env.NODE_ENV !== 'production' && !!process.env.NUMERIC_IDS;
+const forceNumericObjectIds = process.env.NODE_ENV !== 'production' && !!process.env.NUMERIC_IDS;
 let numberGenerator = 0;
 
 module.exports = function (Bookshelf) {
@@ -103,11 +103,11 @@ module.exports = function (Bookshelf) {
 
       /**
        * Do not call `toJSON`. This can remove properties e.g. password.
-       * @returns {*}
+       * @returns {Promise<void>}
        */
-      onValidate: function onValidate(model, columns, options) {
+      onValidate: async function onValidate(model, columns, options) {
         this.setEmptyValuesToNull();
-        return schema.validate(this.tableName, this, options);
+        schema.validate(this.tableName, this, options);
       },
 
       onFetched() {},

package/core/server/models/base/plugins/raw-knex.js

@@ -66,7 +66,7 @@ module.exports = function (Bookshelf) {
             },
           };
 
-          let query = Bookshelf.knex(tableNames[modelName]);
+          const query = Bookshelf.knex(tableNames[modelName]);
 
           if (orderBy) {
             query.orderBy(orderBy);
@@ -111,7 +111,7 @@ module.exports = function (Bookshelf) {
             return [];
           }
 
-          let props = {};
+          const props = {};
 
           if (!withRelated) {
             return _.map(objects, (object) => {
@@ -136,7 +136,7 @@ module.exports = function (Bookshelf) {
             props[relation.name] = (async () => {
               debug('fetch withRelated', relation.name);
 
-              let relationQuery = Bookshelf.knex(relation.targetTable);
+              const relationQuery = Bookshelf.knex(relation.targetTable);
 
               // default fields to select
               _.each(relation.select, (fieldToSelect) => {

package/core/server/models/base/plugins/sanitize.js

@@ -134,7 +134,7 @@ module.exports = function (Bookshelf) {
             let relations = data[property];
 
             // CASE: 1:1 relation will have single data point
-            if (!_.isArray(data[property])) {
+            if (!Array.isArray(data[property])) {
               relations = [data[property]];
             }
             _.each(relations, (relation, indexInArr) => {

package/core/server/models/benefit.js

@@ -7,7 +7,7 @@ const Benefit = ghostBookshelf.Model.extend(
     async onSaving(model, attr, options) {
       ghostBookshelf.Model.prototype.onSaving.call(this, model, attr, options);
       // Make sure name is trimmed of extra spaces
-      let name = this.get('name') && this.get('name').trim();
+      const name = this.get('name') && this.get('name').trim();
       this.set('name', name);
       if (this.hasChanged('slug') || (!this.get('slug') && this.get('name'))) {
         // Pass the new slug through the generator to strip illegal characters, detect duplicates

package/core/server/models/collection.js

@@ -92,7 +92,7 @@ const Collection = ghostBookshelf.Model.extend({
   },
 
   permittedAttributes() {
-    let filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
+    const filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
 
     this.relationships.forEach((key) => {
       filteredKeys.push(key);

package/core/server/models/comment.js

@@ -180,7 +180,7 @@ const Comment = ghostBookshelf.Model.extend(
     },
 
     orderAttributes: function orderAttributes() {
-      let keys = ghostBookshelf.Model.prototype.orderAttributes.call(this, arguments);
+      const keys = ghostBookshelf.Model.prototype.orderAttributes.call(this, arguments);
       keys.push('count__likes');
       keys.push('count__net_score');
       keys.push('count__reports');
@@ -209,7 +209,7 @@ const Comment = ghostBookshelf.Model.extend(
   },
   {
     destroy: function destroy(unfilteredOptions) {
-      let options = this.filterOptions(unfilteredOptions, 'destroy', {
+      const options = this.filterOptions(unfilteredOptions, 'destroy', {
         extraAllowedProperties: ['id'],
       });
 
@@ -492,7 +492,7 @@ const Comment = ghostBookshelf.Model.extend(
      * @return {Array} Keys allowed in the `options` hash of the model's method.
      */
     permittedOptions: function permittedOptions(methodName) {
-      let options = ghostBookshelf.Model.permittedOptions.call(this, methodName);
+      const options = ghostBookshelf.Model.permittedOptions.call(this, methodName);
       options.push('parentId');
       options.push('isAdmin');
       options.push('browseAll');

package/core/server/models/invite.js

@@ -15,10 +15,7 @@ const messages = {
   notAllowedToInvite: 'Not allowed to invite this role.',
 };
 
-let Invite;
-let Invites;
-
-Invite = ghostBookshelf.Model.extend(
+const Invite = ghostBookshelf.Model.extend(
   {
     tableName: 'invites',
 
@@ -142,7 +139,7 @@ Invite = ghostBookshelf.Model.extend(
   },
 );
 
-Invites = ghostBookshelf.Collection.extend({
+const Invites = ghostBookshelf.Collection.extend({
   model: Invite,
 });
 

package/core/server/models/label.js

@@ -6,10 +6,7 @@ const messages = {
   labelNotFound: 'Label not found.',
 };
 
-let Label;
-let Labels;
-
-Label = ghostBookshelf.Model.extend(
+const Label = ghostBookshelf.Model.extend(
   {
     tableName: 'labels',
 
@@ -50,7 +47,7 @@ Label = ghostBookshelf.Model.extend(
 
       ghostBookshelf.Model.prototype.onSaving.apply(this, arguments);
       // Make sure name is trimmed of extra spaces
-      let name = this.get('name') && this.get('name').trim();
+      const name = this.get('name') && this.get('name').trim();
       this.set('name', name);
       if (this.hasChanged('slug') || (!this.get('slug') && this.get('name'))) {
         // Pass the new slug through the generator to strip illegal characters, detect duplicates
@@ -139,7 +136,7 @@ Label = ghostBookshelf.Model.extend(
   },
 );
 
-Labels = ghostBookshelf.Collection.extend({
+const Labels = ghostBookshelf.Collection.extend({
   model: Label,
 });
 

package/core/server/models/member.js

@@ -2,7 +2,7 @@ const ghostBookshelf = require('./base');
 const crypto = require('crypto');
 const _ = require('lodash');
 const { chainTransformers } = require('@tryghost/mongo-utils');
-const config = require('../../shared/config');
+const { memberAvatarImage } = require('../services/members/member-avatar');
 const { MemberCommentingCodec } = require('../services/members/commenting');
 const {
   METAFIELDS_RELATION,
@@ -588,7 +588,10 @@ const Member = ghostBookshelf.Model.extend(
      * has no access to the nested relations, which should be updated.
      */
     permittedAttributes: function permittedAttributes() {
-      let filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
+      const filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(
+        this,
+        arguments,
+      );
 
       this.relationships.forEach((key) => {
         filteredKeys.push(key);
@@ -632,14 +635,8 @@ const Member = ghostBookshelf.Model.extend(
     toJSON(unfilteredOptions) {
       const attrs = ghostBookshelf.Model.prototype.toJSON.call(this, unfilteredOptions);
 
-      // Inject a computed avatar url. Uses gravatar's default ?d= query param
-      // to serve a blank image if there is no gravatar for the member's email.
-      // Will not use gravatar if privacy.useGravatar is false in config
-      attrs.avatar_image = null;
-      if (attrs.email && !config.isPrivacyDisabled('useGravatar')) {
-        const { gravatar } = require('../lib/image');
-        attrs.avatar_image = gravatar.url(attrs.email, { size: 250, default: 'blank' });
-      }
+      // Inject a computed avatar url, by the rule every place that shows a member shares.
+      attrs.avatar_image = memberAvatarImage(attrs.email);
 
       // Serialize commenting domain object to API format
       if (attrs.commenting) {

package/core/server/models/newsletter.js

@@ -85,7 +85,7 @@ const Newsletter = ghostBookshelf.Model.extend(
     },
 
     subscribeMembersById(memberIds, unfilteredOptions = {}) {
-      let pivotRows = [];
+      const pivotRows = [];
       for (const memberId of memberIds) {
         pivotRows.push({
           id: ObjectID().toHexString(),

package/core/server/models/permission.js

@@ -1,9 +1,6 @@
 const ghostBookshelf = require('./base');
 
-let Permission;
-let Permissions;
-
-Permission = ghostBookshelf.Model.extend({
+const Permission = ghostBookshelf.Model.extend({
   tableName: 'permissions',
 
   relationships: ['roles'],
@@ -17,7 +14,7 @@ Permission = ghostBookshelf.Model.extend({
    * has no access to the nested relations, which should be updated.
    */
   permittedAttributes: function permittedAttributes() {
-    let filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
+    const filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
 
     this.relationships.forEach((key) => {
       filteredKeys.push(key);
@@ -35,7 +32,7 @@ Permission = ghostBookshelf.Model.extend({
   },
 });
 
-Permissions = ghostBookshelf.Collection.extend({
+const Permissions = ghostBookshelf.Collection.extend({
   model: Permission,
 });
 

package/core/server/models/post.js

@@ -40,7 +40,6 @@ const POST_REVISIONS_INTERVAL_MS = 10 * 60 * 1000; // 10 minutes
 const ALL_STATUSES = ['published', 'draft', 'scheduled', 'sent'];
 
 let Post;
-let Posts;
 
 Post = ghostBookshelf.Model.extend(
   {
@@ -253,7 +252,10 @@ Post = ghostBookshelf.Model.extend(
      * has no access to the nested relations, which should be updated.
      */
     permittedAttributes: function permittedAttributes() {
-      let filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
+      const filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(
+        this,
+        arguments,
+      );
 
       this.relationships.forEach((key) => {
         filteredKeys.push(key);
@@ -263,10 +265,10 @@ Post = ghostBookshelf.Model.extend(
     },
 
     orderAttributes: function orderAttributes() {
-      let keys = ghostBookshelf.Model.prototype.orderAttributes.apply(this, arguments);
+      const keys = ghostBookshelf.Model.prototype.orderAttributes.apply(this, arguments);
 
       // extend ordered keys with post_meta keys
-      let postsMetaKeys = _.without(
+      const postsMetaKeys = _.without(
         ghostBookshelf.model('PostsMeta').prototype.orderAttributes(),
         'posts_meta.id',
         'posts_meta.post_id',
@@ -379,14 +381,13 @@ Post = ghostBookshelf.Model.extend(
     },
 
     emitChange: function emitChange(event, options = {}) {
-      let eventToTrigger;
       let resourceType = this.get('type');
 
       if (options.usePreviousAttribute) {
         resourceType = this.previous('type');
       }
 
-      eventToTrigger = resourceType + '.' + event;
+      const eventToTrigger = resourceType + '.' + event;
 
       ghostBookshelf.Model.prototype.emitChange.bind(this)(this, eventToTrigger, options);
     },
@@ -694,9 +695,9 @@ Post = ghostBookshelf.Model.extend(
        * CASE: Don't create new posts_meta entry if post meta is empty
        */
       if (!_.isUndefined(this.get('posts_meta')) && !_.isNull(this.get('posts_meta'))) {
-        let postsMetaData = this.get('posts_meta');
-        let relatedModelId = model.related('posts_meta').get('id');
-        let hasNoData = !_.values(postsMetaData).some((x) => !!x);
+        const postsMetaData = this.get('posts_meta');
+        const relatedModelId = model.related('posts_meta').get('id');
+        const hasNoData = !_.values(postsMetaData).some((x) => !!x);
         if (relatedModelId && !_.isEmpty(postsMetaData)) {
           postsMetaData.id = relatedModelId;
           this.set('posts_meta', postsMetaData);
@@ -1163,7 +1164,7 @@ Post = ghostBookshelf.Model.extend(
 
     toJSON: function toJSON(unfilteredOptions) {
       const options = Post.filterOptions(unfilteredOptions, 'toJSON');
-      let attrs = ghostBookshelf.Model.prototype.toJSON.call(this, options);
+      const attrs = ghostBookshelf.Model.prototype.toJSON.call(this, options);
 
       // CASE: never expose the mobiledoc revisions
       delete attrs.mobiledoc_revisions;
@@ -1402,7 +1403,7 @@ Post = ghostBookshelf.Model.extend(
      * **See:** [ghostBookshelf.Model.edit](base.js.html#edit)
      */
     edit: function edit(data, unfilteredOptions) {
-      let options = this.filterOptions(unfilteredOptions, 'edit', {
+      const options = this.filterOptions(unfilteredOptions, 'edit', {
         extraAllowedProperties: ['id'],
       });
 
@@ -1458,7 +1459,7 @@ Post = ghostBookshelf.Model.extend(
      * **See:** [ghostBookshelf.Model.add](base.js.html#add)
      */
     add: function add(data, unfilteredOptions) {
-      let options = this.filterOptions(unfilteredOptions, 'add', {
+      const options = this.filterOptions(unfilteredOptions, 'add', {
         extraAllowedProperties: ['id'],
       });
 
@@ -1486,7 +1487,7 @@ Post = ghostBookshelf.Model.extend(
     },
 
     destroy: function destroy(unfilteredOptions) {
-      let options = this.filterOptions(unfilteredOptions, 'destroy', {
+      const options = this.filterOptions(unfilteredOptions, 'destroy', {
         extraAllowedProperties: ['id'],
       });
 
@@ -1528,11 +1529,7 @@ Post = ghostBookshelf.Model.extend(
       hasUserPermission,
       hasApiKeyPermission,
     ) {
-      let { isContributor, isOwner, isAdmin, isEitherEditor } = setIsRoles(loadedPermissions);
-      let isIntegration;
-      let isEdit;
-      let isAdd;
-      let isDestroy;
+      const { isContributor, isOwner, isAdmin, isEitherEditor } = setIsRoles(loadedPermissions);
 
       function isChanging(attr) {
         return unsafeAttrs[attr] && unsafeAttrs[attr] !== postModel.get(attr);
@@ -1546,13 +1543,13 @@ Post = ghostBookshelf.Model.extend(
         return postModel.get('status') === 'draft';
       }
 
-      isIntegration =
+      const isIntegration =
         loadedPermissions.apiKey &&
         _.some(loadedPermissions.apiKey.roles, { name: 'Admin Integration' });
 
-      isEdit = action === 'edit';
-      isAdd = action === 'add';
-      isDestroy = action === 'destroy';
+      const isEdit = action === 'edit';
+      const isAdd = action === 'add';
+      const isDestroy = action === 'destroy';
 
       if (limitService.isLimited('members')) {
         // You can't publish a post if you're over your member limit
@@ -1671,7 +1668,7 @@ Post = ghostBookshelf.Model.extend(
   },
 );
 
-Posts = ghostBookshelf.Collection.extend({
+const Posts = ghostBookshelf.Collection.extend({
   model: Post,
 });
 

package/core/server/models/product.js

@@ -105,7 +105,10 @@ const Product = ghostBookshelf.Model.extend(
      * has no access to the nested relations, which should be updated.
      */
     permittedAttributes: function permittedAttributes() {
-      let filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(this, arguments);
+      const filteredKeys = ghostBookshelf.Model.prototype.permittedAttributes.apply(
+        this,
+        arguments,
+      );
 
       this.relationships.forEach((key) => {
         filteredKeys.push(key);