Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-06 22:40:14 -05:00
Code Issues Activity

Merged v5.22.1 into main

Browse source 
v5.22.1
This commit is contained in:
Daniel Lockyer 2022-11-01 06:11:24 +07:00
commit 68689917e6
No known key found for this signature in database
8 changed files with 137 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
ghost/admin/app/services/members-utils.js
View file

@ -4,6 +4,7 @@ export default class MembersUtilsService extends Service {
@service config;
@service settings;
@service feature;
@service session;
@service store;
paidTiers = null;
@ -29,15 +30,21 @@ export default class MembersUtilsService extends Service {
return;
}
return this.store.query('tier', {filter: 'type:paid+active:true', limit: 'all'}).then((tiers) => {
this.paidTiers = tiers;
});
// contributors don't have permissions to fetch tiers
if (this.session.user && !this.session.user.isContributor) {
return this.store.query('tier', {filter: 'type:paid+active:true', limit: 'all'}).then((tiers) => {
this.paidTiers = tiers;
});
}
}
async reload() {
return this.store.query('tier', {filter: 'type:paid+active:true', limit: 'all'}).then((tiers) => {
this.paidTiers = tiers;
});
// contributors don't have permissions to fetch tiers
if (this.session.user && !this.session.user.isContributor) {
return this.store.query('tier', {filter: 'type:paid+active:true', limit: 'all'}).then((tiers) => {
this.paidTiers = tiers;
});
}
}
/**

32
ghost/admin/app/templates/posts.hbs
View file

@ -35,22 +35,22 @@
data-test-post-id={{post.id}}
/>
{{else}}
<li class="no-posts-box">
<div class="no-posts">
{{#if this.showingAll}}
{{svg-jar "posts-placeholder" class="gh-posts-placeholder"}}
<h4>Start creating content.</h4>
<LinkTo @route="editor.new" @model="post" class="gh-btn gh-btn-green">
<span>Write a new post</span>
</LinkTo>
{{else}}
<h4>No posts match the current filter</h4>
<LinkTo @route="posts" @query={{hash type=null author=null tag=null}} class="gh-btn">
<span>Show all posts</span>
</LinkTo>
{{/if}}
</div>
</li>
<li class="no-posts-box" data-test-no-posts-box>
<div class="no-posts">
{{#if this.showingAll}}
{{svg-jar "posts-placeholder" class="gh-posts-placeholder"}}
<h4>Start creating content.</h4>
<LinkTo @route="editor.new" @model="post" class="gh-btn gh-btn-green" data-test-link="write-a-new-post">
<span>Write a new post</span>
</LinkTo>
{{else}}
<h4>No posts match the current filter</h4>
<LinkTo @route="posts" @query={{hash type=null author=null tag=null}} class="gh-btn" data-test-link="show-all">
<span>Show all posts</span>
</LinkTo>
{{/if}}
</div>
</li>
{{/each}}
</ol>

61
ghost/admin/mirage/config/members.js
View file

@ -2,43 +2,20 @@ import faker from 'faker';
import moment from 'moment-timezone';
import nql from '@tryghost/nql';
import {Response} from 'miragejs';
import {extractFilterParam, paginateModelCollection} from '../utils';
import {
extractFilterParam,
paginateModelCollection,
withPermissionsCheck
} from '../utils';
import {underscore} from '@ember/string';
function hasInvalidPermissions() {
const {schema, request} = this;
// always allow dev requests through - the logged in user will be real so
// we can't check against it in the mocked db
if (!request.requestHeaders['X-Test-User']) {
return false;
}
const invalidPermsResponse = new Response(403, {}, {
errors: [{
type: 'NoPermissionError',
message: 'You do not have permission to perform this action'
}]
});
const user = schema.users.find(request.requestHeaders['X-Test-User']);
const adminRoles = user.roles.filter(role => ['Owner', 'Administrator'].includes(role.name));
if (adminRoles.length === 0) {
return invalidPermsResponse;
}
}
function withPermissionsCheck(fn) {
return function () {
const boundPermsCheck = hasInvalidPermissions.bind(this);
const boundFn = fn.bind(this);
return boundPermsCheck() || boundFn(...arguments);
};
}
const ALLOWED_ROLES = [
'Owner',
'Administrator'
];
export function mockMembersStats(server) {
server.get('/members/stats/count', withPermissionsCheck(function (db, {queryParams}) {
server.get('/members/stats/count', withPermissionsCheck(ALLOWED_ROLES, function (db, {queryParams}) {
let {days} = queryParams;
let firstSubscriberDays = faker.datatype.number({min: 30, max: 600});
@ -94,12 +71,12 @@ export function mockMembersStats(server) {
}
export default function mockMembers(server) {
server.post('/members/', withPermissionsCheck(function ({members}) {
server.post('/members/', withPermissionsCheck(ALLOWED_ROLES, function ({members}) {
const attrs = this.normalizedRequestAttrs();
return members.create(attrs);
}));
server.get('/members/', withPermissionsCheck(function ({members}, {queryParams}) {
server.get('/members/', withPermissionsCheck(ALLOWED_ROLES, function ({members}, {queryParams}) {
let {filter, search, page, limit} = queryParams;
page = +page || 1;
@ -164,7 +141,7 @@ export default function mockMembers(server) {
return paginateModelCollection('members', collection, page, limit);
}));
server.del('/members/', withPermissionsCheck(function ({members}, {queryParams}) {
server.del('/members/', withPermissionsCheck(ALLOWED_ROLES, function ({members}, {queryParams}) {
if (!queryParams.filter && !queryParams.search && queryParams.all !== 'true') {
return new Response(422, {}, {errors: [{
type: 'IncorrectUsageError',
@ -200,7 +177,7 @@ export default function mockMembers(server) {
};
}));
server.get('/members/:id/', withPermissionsCheck(function ({members}, {params}) {
server.get('/members/:id/', withPermissionsCheck(ALLOWED_ROLES, function ({members}, {params}) {
let {id} = params;
let member = members.find(id);
@ -212,7 +189,7 @@ export default function mockMembers(server) {
});
}));
server.put('/members/:id/', withPermissionsCheck(function ({members, tiers, subscriptions}, {params}) {
server.put('/members/:id/', withPermissionsCheck(ALLOWED_ROLES, function ({members, tiers, subscriptions}, {params}) {
const attrs = this.normalizedRequestAttrs();
const member = members.find(params.id);
@ -282,12 +259,12 @@ export default function mockMembers(server) {
return member.update(attrs);
}));
server.del('/members/:id/', withPermissionsCheck(function ({members}, request) {
server.del('/members/:id/', withPermissionsCheck(ALLOWED_ROLES, function ({members}, request) {
const id = request.params.id;
members.find(id).destroy();
}));
server.get('/members/upload/', withPermissionsCheck(function () {
server.get('/members/upload/', withPermissionsCheck(ALLOWED_ROLES, function () {
return new Response(200, {
'Content-Disposition': 'attachment',
filename: `members.${moment().format('YYYY-MM-DD')}.csv`,
@ -295,7 +272,7 @@ export default function mockMembers(server) {
}, '');
}));
server.post('/members/upload/', withPermissionsCheck(function ({labels}, request) {
server.post('/members/upload/', withPermissionsCheck(ALLOWED_ROLES, function ({labels}, request) {
const label = labels.create();
// TODO: parse CSV and create member records
@ -312,7 +289,7 @@ export default function mockMembers(server) {
});
}));
server.get('/members/events/', withPermissionsCheck(function ({memberActivityEvents}, {queryParams}) {
server.get('/members/events/', withPermissionsCheck(ALLOWED_ROLES, function ({memberActivityEvents}, {queryParams}) {
let {limit} = queryParams;
limit = +limit || 15;

37
ghost/admin/mirage/config/tiers.js
View file

@ -1,11 +1,27 @@
import {paginatedResponse} from '../utils';
import {paginatedResponse, withPermissionsCheck} from '../utils';
const ALLOWED_WRITE_ROLES = [
'Owner',
'Administrator'
];
const ALLOWED_READ_ROLES = [
'Owner',
'Administrator',
'Editor',
'Author'
];
export default function mockTiers(server) {
server.post('/tiers/');
// CREATE
server.post('/tiers/', withPermissionsCheck(ALLOWED_WRITE_ROLES, function ({tiers}) {
const attrs = this.normalizedRequestAttrs();
return tiers.create(attrs);
}));
server.get('/tiers/', paginatedResponse('tiers'));
// READ
server.get('/tiers/', withPermissionsCheck(ALLOWED_READ_ROLES, paginatedResponse('tiers')));
server.get('/tiers/:id/', function ({tiers}, {params}) {
server.get('/tiers/:id/', withPermissionsCheck(ALLOWED_READ_ROLES, function ({tiers}, {params}) {
let {id} = params;
let tier = tiers.find(id);
@ -15,16 +31,21 @@ export default function mockTiers(server) {
message: 'Tier not found.'
}]
});
});
}));
server.put('/tiers/:id/', function ({tiers}, {params}) {
// UPDATE
server.put('/tiers/:id/', withPermissionsCheck(ALLOWED_WRITE_ROLES, function ({tiers}, {params}) {
const attrs = this.normalizedRequestAttrs();
const tier = tiers.find(params.id);
tier.update(attrs);
return tier.save();
});
}));
server.del('/tiers/:id/');
// DELETE
server.del('/tiers/:id/', withPermissionsCheck(ALLOWED_WRITE_ROLES, function (schema, request) {
const id = request.params.id;
schema.tiers.find(id).destroy();
}));
}

32
ghost/admin/mirage/utils.js
View file

@ -122,3 +122,35 @@ export function extractFilterParam(param, filter = '') {
return normalizeBooleanParams(normalizeStringParams(match));
}
export function hasInvalidPermissions(allowedRoles) {
const {schema, request} = this;
// always allow dev requests through - the logged in user will be real so
// we can't check against it in the mocked db
if (!request.requestHeaders['X-Test-User']) {
return false;
}
const invalidPermsResponse = new Response(403, {}, {
errors: [{
type: 'NoPermissionError',
message: 'You do not have permission to perform this action'
}]
});
const user = schema.users.find(request.requestHeaders['X-Test-User']);
const adminRoles = user.roles.filter(role => allowedRoles.includes(role.name));
if (adminRoles.length === 0) {
return invalidPermsResponse;
}
}
export function withPermissionsCheck(allowedRoles, fn) {
return function () {
const boundPermsCheck = hasInvalidPermissions.bind(this);
const boundFn = fn.bind(this);
return boundPermsCheck(allowedRoles) || boundFn(...arguments);
};
}

2
ghost/admin/package.json
View file

@ -1,6 +1,6 @@
{
"name": "ghost-admin",
"version": "5.22.0",
"version": "5.22.1",
"description": "Ember.js admin client for Ghost",
"author": "Ghost Foundation",
"homepage": "http://ghost.org",

32
ghost/admin/tests/acceptance/content-test.js
View file

@ -1,6 +1,6 @@
import {authenticateSession, invalidateSession} from 'ember-simple-auth/test-support';
import {beforeEach, describe, it} from 'mocha';
import {click, currentURL, fillIn, find, findAll, settled, visit} from '@ember/test-helpers';
import {blur, click, currentURL, fillIn, find, findAll, settled, visit} from '@ember/test-helpers';
import {clickTrigger, selectChoose} from 'ember-power-select/test-support/helpers';
import {expect} from 'chai';
import {setupApplicationTest} from 'ember-mocha';
@ -247,13 +247,33 @@ describe('Acceptance: Content', function () {
describe('as contributor', function () {
beforeEach(async function () {
let adminRole = this.server.create('role', {name: 'Administrator'});
let admin = this.server.create('user', {roles: [adminRole]});
// Create posts
this.server.create('post', {authors: [admin], status: 'scheduled', title: 'Admin Post'});
let contributorRole = this.server.create('role', {name: 'Contributor'});
this.server.create('user', {roles: [contributorRole]});
return await authenticateSession();
});
it('shows posts list and allows post creation', async function () {
await visit('/posts');
// has an empty state
expect(findAll('[data-test-post-id]')).to.have.length(0);
expect(find('[data-test-no-posts-box]')).to.exist;
expect(find('[data-test-link="write-a-new-post"]')).to.exist;
await click('[data-test-link="write-a-new-post"]');
expect(currentURL()).to.equal('/editor/post');
await fillIn('[data-test-editor-title-input]', 'First contributor post');
await blur('[data-test-editor-title-input]');
expect(currentURL()).to.equal('/editor/post/1');
await click('[data-test-link="posts"]');
expect(findAll('[data-test-post-id]')).to.have.length(1);
expect(find('[data-test-no-posts-box]')).to.not.exist;
});
});
});

2
ghost/core/package.json
View file

@ -1,6 +1,6 @@
{
"name": "ghost",
"version": "5.22.0",
"version": "5.22.1",
"description": "The professional publishing platform",
"author": "Ghost Foundation",
"homepage": "https://ghost.org",