Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-03-11 02:12:21 -05:00
Code Issues Activity

Added query string trimming from the original URL

Browse source 
refs https://github.com/TryGhost/Toolbox/issues/292

- There are couple of reasons why we don't want to include the query string information in the outgoing notification emails:
- 1. Security - we can expose the Content API key to an unauthorized person. The emails go out to administrators, so they have access to this data anyway. But for example they might forward full email content to someone from “tech team” or whoever is not really authorized to see it.
2. It looks a bit ugly and could be waaay to long breaking the email layou
This commit is contained in:
Naz 2022-05-11 10:40:09 +08:00
parent 32d888d3cc
commit 3010d498ca
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ghost/mw-api-version-mismatch/lib/mw-api-version-mismatch.js
View file

@ -11,11 +11,12 @@ const versionMismatchHandler = (APIVersionCompatibilityService) => {
if (err && err.errorType === 'RequestNotAcceptableError') {
if (err.code === 'UPDATE_CLIENT') {
const {key, type} = extractApiKey(req);
const requestURL = req.originalUrl.split('?').shift();
await APIVersionCompatibilityService.handleMismatch({
acceptVersion: req.headers['accept-version'],
contentVersion: `v${res.locals.safeVersion}`,
requestURL: req.originalUrl,
requestURL,
userAgent: req.headers['user-agent'],
apiKeyValue: key,
apiKeyType: type

4
ghost/mw-api-version-mismatch/test/mw-api-version-mismatch.test.js
View file

@ -51,7 +51,7 @@ describe('mw-api-version-mismatch', function () {
handleMismatch: sinon.stub().resolves()
};
const req = {
originalUrl: '/api/admin/posts/1',
originalUrl: '/api/admin/posts/1?tim_me=please',
query: {
key: 'content_api_key_secret'
},
@ -81,7 +81,7 @@ describe('mw-api-version-mismatch', function () {
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].acceptVersion, 'v3.28');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].contentVersion, 'v4.46');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].requestURL, '/api/admin/posts/1');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].requestURL, '/api/admin/posts/1', 'trims query string');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].userAgent, 'Zapier/2.1 GhostAdminSDK/3.28');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].apiKeyValue, 'content_api_key_secret');
assert.equal(APIVersionCompatibilityService.handleMismatch.args[0][0].apiKeyType, 'content');