0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Commit graph

164 commits

Author SHA1 Message Date
Simon Backx
87f714ef25 Added sentry dsn placeholder attribute to comments helper
refs https://github.com/TryGhost/Team/issues/1664
2022-07-12 10:24:02 +02:00
Rishabh
ecce576bc8 Updated sodo search script to include admin url
refs https://github.com/TryGhost/Team/issues/1665

- sodo search script only needs the admin url for fetching data from content api
- removes site url and updates the main url to use admin domain
2022-07-07 11:01:21 +02:00
Rishabh
67a60353c3 Added version information in sodo search config
refs https://github.com/TryGhost/Team/issues/1665

- version information allows creating the css bundle link for prod
- adds version information from the config
2022-07-06 10:11:15 +02:00
Naz
b996eadbd4 Renamed sodo search identification attribute
refs https://github.com/TryGhost/Team/issues/1665

- The search script should be uniquiely identifiable in DOM. Previously element for portal scipt element and search element both had `data-ghost` attributes` for identification. Having `data-sodo-search` makes naming unique
2022-07-04 16:44:01 +02:00
Naz
f6b2a83761 Added sodoSearch script output from ghost_head helper
no issue

- The sodoSearch needs to be injected into rendered HTML the same way portal scripts are.
- The feature is behind a `sodoSearch` alpha flag, so the scripts are injected conditionally
2022-07-04 16:44:01 +02:00
Simon Backx
3edbb364fe Renamed data-ghost attribute on comments script 2022-07-04 16:12:35 +02:00
Kevin Ansfield
dc49871837 Added {{comments}} helper
refs https://github.com/TryGhost/Team/issues/1664

- added `comments:url` config for a similar setup to Portal
- added `{{comments}}` helper that's behind the `comments` labs flag
  - currently outputs a `<script>` tag that points to the comments script with API location+key data attributes
2022-07-04 15:34:01 +02:00
Fabien "egg" O'Carroll
b82dc7ae7c 🔒 Fixed RCE exploit with date helper & locale setting
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-7v28-g2pq-ggg8

A vulnerability in an upstream library means an attacker can abuse locale input
to execute arbitrary commands from a file that has previously been uploaded
using the file upload functionality in the post editor.
2022-06-14 22:50:22 -04:00
Simon Backx
ad349bb3a5
Removed GA feature flags (#14915)
refs https://github.com/TryGhost/Team/issues/1616

- Removed all GA feature flags
- Removed `tweetGridCard` alpha flag
- Changes to `members-api` and `members-importer` packages: https://github.com/TryGhost/Members/compare/%40tryghost/members-api%408.1.1...%40tryghost/members-api%408.1.2
2022-05-26 09:54:30 +02:00
Simon Backx
c052652559
Updated settings API to return all settings in edit endpoint (#14889)
refs https://github.com/TryGhost/Team/issues/1650

Since we introduced calculated settings, we need to return all settings when editing a setting, because those calculated settings can change.

- When editing settings, return all the settings. Previously we didn't include the calculated settings (which caused issues with admin not having up to date values for those)
- Updated Stripe <head> script to be injected based on the calculated settings

Required for https://github.com/TryGhost/Admin/pull/2405
2022-05-24 16:42:15 +02:00
Hannah Wolfe
18cf73c3b3
Updated output logic to correctly use excerpt 2022-05-16 15:51:14 +01:00
Naz
0c097f6532 Fixed frontend rendering of page resource
refs https://github.com/TryGhost/Toolbox/issues/332

- After removing the concept of a boolean "page: true" from the page/post resources frontend resource rendering didn't have enough information to pick the correct template
- Resolved this issue through passing of additional "context" to the template picker. Something nicer should be worked on in the future, as context pattern feels dirty here.
2022-05-16 22:06:55 +08:00
Hannah Wolfe
b6d9389124
🔥 Removed legacy product + price helpers from themes
refs: https://github.com/TryGhost/Team/issues/1145
refs: https://github.com/TryGhost/Ghost/issues/14446

- remove legacy members theme helpers @products @product @price and @members.products
- all of these have been replaced with new concepts with the introduction of tiers
2022-05-12 18:58:01 +01:00
Hannah Wolfe
de118b0b04
Renamed lang and session_secret default settings (#14791)
refs: https://github.com/TryGhost/Toolbox/issues/327

- lang / locale has had a lot of churn, but we decided this setting should always be locale
- session_secret is too generic as we have multiples of these
2022-05-12 15:07:05 +01:00
Hannah Wolfe
409dc3b534
Added frontend key to ghost_head for portal (#14782)
refs: https://github.com/TryGhost/Team/issues/1599
refs: f3d5d9cf6b

- this commit adds the concept of a frontend data service, intended for passing data to the frontend from the server in a clean way. This is the start of a new & improved pattern, to hopefully reduce coupling
- the newly added internal frontend key is then exposed through this pattern so that the frontend can make use of it
- the first use case is so that portal can use it to talk to the content API instead of having weird endpoints for portal
- this key will also be used by other internal scripts in future, it's public and therefore safe to expose, but it's meant for internal use only and therefore is not exposed in a generic way e.g. as a helper
2022-05-11 17:34:31 +01:00
Hannah Wolfe
b29852b012
🔥 Removed support for http/https mixed mode (#14783)
closes: https://github.com/TryGhost/Toolbox/issues/324
refs: https://github.com/TryGhost/Ghost/issues/14446

- Currently, if url is configured to http but a request is marked secure, Ghost will handle upgrading all internal URLs to https so that there are no mixed content warnings
- From 5.0 that feature is going away, in favour of strictly honouring the configured URL
- Ghost will serve URLs exactly as configured and won't upgrade http to https anymore
- This use case was common when Ghost was first built, but in 2022 the web is mostly https.
- The code needed to support the feature creates a lot of additional complexity & maintenance overhead, so removing this gives us space to do more cool and useful stuff in 2022
2022-05-11 14:53:23 +01:00
Hannah Wolfe
412d290a30
Refactored async helpers to use async/await (#14781)
- async/await makes the code easier to read
- also means we can get rid of usages of Promise, and some unnecessary usages of Bluebird
- this refactor is done for the 4 async helpers and the code that wraps async helpers so the whole pipeline is async/await and more understandable
2022-05-11 09:51:38 +01:00
Naz
5e441d0942 🔥 Removed {{author}} helper support
refs https://github.com/TryGhost/Toolbox/issues/230

 - Single {{author}} helper has been deprecated since multiple major releases. It has also been throwing fatal errors in gscan v5 since some time. It will finally be gone!
 - The plural {{authors}} helper should be used instead, read here for more information: https://ghost.org/docs/themes/helpers/authors/
2022-05-02 17:59:48 +08:00
Hannah Wolfe
8bd9169298
Removed res.locals.apiVersion
- we are getting rid of the concept of having multiple api versions in a single ghost install
- we no longer need to pass the apiVersion around using res.locals
- To simplify code that uses our frontend proxy the proxy now _only_ exposes canary
2022-04-28 15:35:28 +01:00
CommanderRoot
adc0805dce
replaced deprecated String.prototype.substr() (#14367)
- `.substr()` is deprecated so we replace it with .slice() which works similarly but isn't deprecated

Signed-off-by: Tobias Speicher <rootcommander@gmail.com>
2022-04-28 11:49:12 +01:00
Hannah Wolfe
c902d91c81
Renamed rendering service to handlebars
- This fits more closely, as this service is to so with rendering helpers and small parts
- Whereas we want to use "rendering" for things concerned with rendering pages
2022-04-05 20:10:33 +01:00
Hannah Wolfe
e9d6f61029
Moved checks into frontend data service
refs: https://github.com/TryGhost/Ghost/commit/11867ab43

- These checks live in the wrong place. They are mostly a frontend thing
- The only server place they were used was slack and that was fixed in 11867ab43
- Moving these to the frontend they fit neatly into the frontend data service
2022-04-05 15:23:00 +01:00
Naz
4f7324f1c0 Added a note to potentially breaking price helper
refs https://github.com/TryGhost/Team/issues/449

- Once we deprecate site.lang use in favor of site.locale this helper will need inspection for potentially breaking change. Left a note to come back to it once it's time
2022-04-01 11:33:02 +08:00
Rishabh
b03862d08a Updated content cta helper to use new tiers helper
refs https://github.com/TryGhost/Team/issues/1004

Replaces {{products}} helper usage with updated {{tiers}} helper. Default output for {{tiers}} helper is the same as {{products}} helper.
2022-03-04 18:22:59 +05:30
Rishabh
665c30f255 Added new {{tiers}} theme helper
refs https://github.com/TryGhost/Team/issues/1004

- adds new `{{tiers}}` helper behind `multipleProducts` flag
- `{{tiers}}` outputs a string with list of tiers that have access to specific post when used in a post context in theme
- outputs empty string when used out of a post context and without access to `visibility` property
- uses tiers attached to post column for data
2022-03-04 18:22:59 +05:30
Simon Backx
f389bab6ab
🐛 {{access}} property incorrect when using get/next-post/prev-post helpers (#14256)
refs https://github.com/TryGhost/Team/issues/1367

- The {{access}} property of a post always returned false for non-public content
- Added the member context to the get, next-post and prev-post helpers
- The get, next-post and prev-post helpers didn't add the member context to the internal API calls
- Added the members context to these calls
- Added tests that check if the member context is passed to the API calls
- Transformed next_post helper tests to async await syntax
- Transformed prev_post helper tests to async await syntax
2022-03-03 16:18:05 +01:00
Simon Backx
e97abeceb5
Added >, <, >=, and <= operators to match helper (#14215)
refs https://github.com/TryGhost/Team/issues/1386

- The current match handler supports normal (in)equality operators, but no numeric comparisons (<, >, <=, >=)
- A use case for these new operators is to show the latest post in a separate way from other posts

Includes unit tests to check the new behaviour.
Run via `yarn test test/unit/frontend/helpers/match.test.js`
2022-03-03 15:43:47 +01:00
Fabien "egg" O'Carroll
df3f7a2c1b Added support for Tiers API to the get helper
https://github.com/TryGhost/Team/issues/1405

This will allow themes to fetch the list of tiers for creating custom
signup pages.
2022-03-03 15:15:43 +02:00
Hannah Wolfe
5bf12939e4
Updated eslint-plugin-ghost & fixed resulting failures
- I recently added a bunch of strict rules to our eslint plugin around returns: ca9af37866
- These mostly are issues that occur whilst writing code, that you spot and fix as you're developing, but they're annoying to notice/find and eslint can be used to flag them quickly
- There are of course, edge cases where you don't need to return from array fns, but this rule also suggests better patterns might be available
- For our excert helper and new assertEvent helper, I've updated the code to use simpler patterns that are easier to read, so as to avoid the warnings
- For our old API I've simply disabled the rule as we're about to delete this code
2022-02-21 12:30:12 +00:00
Daniel Lockyer
af240816d8 Added eslint exemption for camelcase line
no issue

- the new eslint bump seems to flag this line up for using camelcase
- i'm not sure why this hasn't flagged before but it seems we want to
  keep the naming because the function name has the same linting exemption
2022-02-07 13:16:05 +01:00
Rishabh
15d692dc01 Updated frontend helpers to handle tiers visibility
refs https://github.com/TryGhost/Team/issues/1071

- visibility handling for posts/pages with restricted tiers access has changed, this change updates frontend helpers
2022-02-01 11:13:51 +05:30
Marat Vyshegorodtsev
74b97e99cd
Added timezone and locale to the options of the date helper (#13892)
fixes https://github.com/TryGhost/Ghost/issues/13832

The `date` handlebars helper has only one option currently — `format`. It assumes the locale and timezone from the `options.data.site` object which is not always desired behavior.

The helper sometimes is used, for example, in custom RSS template where we always need the `en-US` locale, not the one that we have configured for the website globally. This change makes the two options configurable, and defaults to the `options.data.site` object values, if not specified in the helper (keeps the backwards compatibility with the current behavior).
2022-01-19 14:43:53 +00:00
Fabien 'egg' O'Carroll
0c853a372b
Supported restricting limit="all" in get helper (#13903)
refs https://github.com/TryGhost/Team/issues/1251

With sites that have a huge number of resources, using limit="all" can
cause OOM errors at the Node level. Administrators now have the ability
to cap limit="all" requests via config. This only affects the get helper
used in themes, not the API, this is by design as themes have less
visibility of issues.
2021-12-16 13:59:39 +02:00
Fabien egg O'Carroll
55d7176e51 🐛 Fixed card scripts executing before DOM is parsed
no-issue

Using the async attribute means that the script is downloaded in
parallel with the parsing of the html into DOM, and then executed upon
completion. This means that the script cannot be sure that particular
parts of the DOM exist as it may not have finished parsing. This has
resulted in bugs with the new toggle card not working.

Switching our script to use the defer attribute means that the script is
still downloaded in parallel with parsing, but it is not executed until
parsing is complete. This means that the script can safely access the
DOM.
2021-12-08 17:54:37 +02:00
Thibaut Patel
77c0364efd 🐛 Fixed malformed URLs crashing the url helper
refs https://github.com/TryGhost/Team/issues/960

- Character like "%%" or "%80" would crash our current url escaping behavior. We consider they aren't valid URLs as the percentages haven't been properly escaped.
2021-12-02 10:34:24 +01:00
Hannah Wolfe
e4c1e0d938
Added middleware for serving minified card assets
- Wired up the forntend to include and serve the minified css and js card assets if they exist
- This is a very naive implementation - ideally we wouldn't have to inject this in multiple places
- This allows us to add files to src/cards and have them included in themes
- The system is currently disabled due to an override in the theme config setting assets to false
2021-11-05 11:41:03 +00:00
Thibaut Patel
c32cc3e48b 🐛 Fixed broken assets for theme/design preview
refs https://github.com/TryGhost/Team/issues/1190

- The assets were broken in Admin when the frontend and admin urls were different
- Fixed the issue by changing the `asset` helper to output absolute URLs when the frontend/admin urls are differents
2021-11-03 11:20:04 +01:00
Hannah Wolfe
981f11da95
Added basic {{match}} helper
refs: https://github.com/TryGhost/Team/issues/759

- The match helper allows for basic equals and not equals comparisons,
Example:
  {{match title "=" "Getting Started"}}
  {{match slug "!=" "welcome"}}
- There's a lot more functionality we want to add here, so that it ends up being a replacement for {{#has}}
- However, this first iteration is already useful, especially in the context of custom theme settings
- Therefore we are adding it early, and will document it along with custom theme settings when that goes GA very soon
2021-10-14 19:36:56 +01:00
Hannah Wolfe
cd765e2393
Added implicit equals support to match helper
refs: https://github.com/TryGhost/Team/issues/759

- This allows for {{match x y}} to work without having to supply an "=" sign explicitly
2021-10-14 16:29:42 +01:00
Hannah Wolfe
fbc23459fc
Added full SafeString handling to match helper
refs: https://github.com/TryGhost/Team/issues/759

- No matter what, a handlebars helper outputs a string. So if you return true, you'll always get 'true'.
- SafeStrings are handlebars's way of passing around a string whilst also maintaining a record of the original value e.g. new SafeString(true) results in {string: true}
- We need this for the match helper, so that we know when doing a comparison that we're meant to be comparing against a boolean true, not a string true
- Therefore, we need to putput SafeStrings, but also process them when passed in

The logic
- Figuring out the correct logic here has been a little tricky but essentially:
  - {{match safestring}} with a single arg, will return true for any truthy value
  - {{match safestring "=" true}} does a direct comparison with the original value of the safe string, so if it was a boolean true, the match will be true else false
  - {{match (match something) "=" true}} will therefore work for any level of nesting
  - this can result in slightly inconsistent results, but feels correct and documentable

This is documented extensively through the test cases
2021-10-14 16:29:41 +01:00
Hannah Wolfe
9d7049cd3f
Refactored helper registration code into a service
- The helper registration code is "framework" code and very specific
- At the moment the "theme engine" is full of lots of disparate theme related stuff
- I'm trying to make the frontend framework code clearer and also expand it to  make it more useful
- The helper system now also exposes 3 methods allowing you to register a directory, a helper or an alias
- I've updated the codebase to use these both for our core helpers and for "apps"
2021-10-05 10:04:02 +01:00
Hannah Wolfe
1bbaf65a22
Removed need for index.js in frontend/helpers
- The index.js file was actually loader code
- It was mainly used by the unit tests, which needed to be rewritten to get each helper individually
2021-10-04 16:46:01 +01:00
Hannah Wolfe
fd20f90cca
Divided f/e proxy into true proxy + rendering service
- The original intention of the proxy was to collect up all the requires in our helpers into one place
- This has since been expanded and used in more places, in more ways
- In hindsight there are now multiple different types of requires in the proxy:
   - One: true frontend rendering framework requires (stuff from deep inside theme-engine)
   - Two: data manipulation/sdk stuff, belongs to the frontend, ways to process API data
   - Three: actual core stuff from Ghost, that we wish wasn't here / needs to be passed in a controlled way
- This commit pulls out One into a new rendering service, so at least that stuff is managed independently
- This draws the lines clearly between what's internal to the frontend and what isn't
- It also highlights that the theme-engine needs to be divided up / refactored so that we don't have these deep requires
2021-09-29 13:10:14 +01:00
Hannah Wolfe
52b924638d
Removed core @tryghost pkg usage from f/e proxy
- The frontend proxy is meant to be a way to pass critical internal pieces of Ghost core into the frontend
- These fundamental @tryghost packages are shared and can be required directly, hence there's no need to pass them via the proxy
- Reducing the surface area of the proxy reduces the proxies API
- This makes it easier to see what's left in terms of decoupling the frontend, and what will always need to be passed (e.g. api)

Note on @tryghost/social-urls:
- this is a small utility that helps create URLs for social profiles, it's a util for working with data on the frontend aka part of the sdk
- I think there should be many of these small helpers and we'll probably want to bundle them for the frontend at some point
- for now, I'm leaving these as part of the proxy, as need to figure out where they belong
2021-09-28 12:19:02 +01:00
Hannah Wolfe
870bf27394
Removed use of i18n from helpers in favour of tpl
- i18n is an old pattern that failed
- we are slowly replacing i18n with the tpl helper
2021-09-28 11:42:59 +01:00
Rishabh
58bdf1e6e5 Added new ghost analytics meta tag behind activity alpha flag
refs https://github.com/TryGhost/Team/issues/1063

Member activity is a labs alpha feature which aims at capturing member events for site owner if switched on. The event metadata captures the site page/post where the event originates from, and the post/page id is included as content of new ghost analytics meta tag. The meta tag is only aded on the site if member activity is switched on from labs.
2021-09-20 13:55:37 +05:30
Hannah Wolfe
ba587ba882
Fixed logic bugs in match helper (#13315)
closes: CORE-33

Two bugs:
- lodash isEmpty and handlebars util isEmpty are not the same
- I literally had the truthy and falsy cases the wrong way around 🙈

Notes:
- I have, for now, copied the isEmpty util from handlebars. It's so small it doesn't seem worth trying to require the util right now, although in future it'd be nice if that was easier to do
- Adding the management for the conditional being a SafeString allows the match helper to be a subexpression of itself, I can see this pattern being useful later in combo with the any and all helpers
2021-09-17 09:47:10 +01:00
Rishabh Garg
2272f84cc9
Added beta {{products}} helper for tiers list on post (#13267)
refs https://github.com/TryGhost/Team/issues/1004

- adds new `{{products}}` helper behind `multipleProducts` flag
- `{{products}}` outputs a string with list of products that have access to specific post when used in a post context in theme
- outputs empty string when used out of a post context and without access to `visibility` property
- uses all available posts for a site via the global products data
- updates {{content}} helper cta to use this new helper to show list of tiers with access to post
2021-09-10 09:30:41 +05:30
Peter Zimon
94234e1505 Updated copy for tiers CTA
- Updated "product" copy to "tier" in the default content CTA  when members need to be on a different plan to have access to a post.
2021-07-19 13:14:37 +02:00
Rishabh
50eddaa208 Updated default content cta for restricted post/page access to custom filters
refs https://github.com/TryGhost/Team/issues/849

With multiple products, we have re-enabled segmentation by product for posts behind alpha feature flag. This change handles the default content cta to show custom message if the post's access is restricted to specific products when behind the flag.
2021-07-05 17:10:45 +05:30