0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Commit graph

80 commits

Author SHA1 Message Date
Fabien "egg" O'Carroll
b82dc7ae7c 🔒 Fixed RCE exploit with date helper & locale setting
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-7v28-g2pq-ggg8

A vulnerability in an upstream library means an attacker can abuse locale input
to execute arbitrary commands from a file that has previously been uploaded
using the file upload functionality in the post editor.
2022-06-14 22:50:22 -04:00
Simon Backx
a051ab3b69
🎨 Reduced favicon requirements and added image formatting (#14918)
fixes https://github.com/TryGhost/Team/issues/1652
fixes https://github.com/TryGhost/Ghost/issues/13319

**Image formatting**
Added support for changing the format of images via the `handle-image-sizes` middleware (e.g. format SVG to png, jpeg, webp)

This change was required:
- Not all browsers support SVG favicons, so we need to convert them to PNGs
- We can't fit image resizing and formatting in the `serve-favicon` middleware: we need to store the resized image to avoid resizing on every request. This system was already present in the `handle-image-sizes` middleware.

To format an uploaded image:
- Original URL: https://localhost/blog/content/images/2022/05/giphy.gif
- To resize: https://localhost/blog/content/images/size/w256h256/2022/05/giphy.gif (already supported)
- To resize and format to webp: https://localhost/blog/content/images/size/w256h256/format/webp/2022/05/giphy.gif
- Animations are preserved when converting Gifs to Webp and in reverse, and also when only resizing (https://github.com/TryGhost/Ghost/issues/13319)

**Favicons**
- Custom favicons are no longer served via `/favicon.png` or `/favicon.ico` (only for default favicon), but use their full path
- Added support for uploading more image extensions in Ghost as a favicon: .jpg, .jpeg, .gif, .webp and .svg are now supported (already supported .png and .ico).
- File extensions other than jpg/jpeg, png, or ico will always get transformed to the image/png format to guarantee browser support (webp and svg images are not yet supported as favicons by all browsers).

For all image formats, other than .ico files:
- Allowed to upload images larger than 1000px in width and height, they will get cropped to 256x256px.
- Allowed uploading favicons that are not square. They will get cropped automatically.
- Allowed to upload larger files, up to 20MB (will get served at a lower file size after being resized)

For .svg files:
- The minimum size of 60x60px is no longer required.

For .ico files:
- The file size limit is increased to 200kb (coming from 100kb)
2022-05-27 16:36:53 +02:00
Simon Backx
c052652559
Updated settings API to return all settings in edit endpoint (#14889)
refs https://github.com/TryGhost/Team/issues/1650

Since we introduced calculated settings, we need to return all settings when editing a setting, because those calculated settings can change.

- When editing settings, return all the settings. Previously we didn't include the calculated settings (which caused issues with admin not having up to date values for those)
- Updated Stripe <head> script to be injected based on the calculated settings

Required for https://github.com/TryGhost/Admin/pull/2405
2022-05-24 16:42:15 +02:00
Naz
5abd67809d Cleaned up AMP rendering of "page" resources
refs https://github.com/TryGhost/Toolbox/issues/332

- After dropping support for `page: (true|false)` for post resources in Content API there is no need to check for `body.post.page` in the AMP renderer. Furthermore, the AMP router uses `public-post` controller that **only** returns "post" resources. This check was a redundant, unnecessary piece of logic
2022-05-17 11:39:52 +08:00
Hannah Wolfe
5090d75d96
Improved theme asset handling - permissible assets
refs: https://github.com/TryGhost/Team/issues/1633

- this makes /assets/ a more permissible folder - it can serve anything _except_ hbs files
- meanwhile the root folder becomes less permissible, and won't serve theme dev files commonly found in the root
2022-05-16 19:54:33 +01:00
Hannah Wolfe
18cf73c3b3
Updated output logic to correctly use excerpt 2022-05-16 15:51:14 +01:00
Naz
0c097f6532 Fixed frontend rendering of page resource
refs https://github.com/TryGhost/Toolbox/issues/332

- After removing the concept of a boolean "page: true" from the page/post resources frontend resource rendering didn't have enough information to pick the correct template
- Resolved this issue through passing of additional "context" to the template picker. Something nicer should be worked on in the future, as context pattern feels dirty here.
2022-05-16 22:06:55 +08:00
Hannah Wolfe
b6d9389124
🔥 Removed legacy product + price helpers from themes
refs: https://github.com/TryGhost/Team/issues/1145
refs: https://github.com/TryGhost/Ghost/issues/14446

- remove legacy members theme helpers @products @product @price and @members.products
- all of these have been replaced with new concepts with the introduction of tiers
2022-05-12 18:58:01 +01:00
Matt Hanley
78d1132b13
Updated theme card asset default setting (#14789)
refs https://github.com/TryGhost/Team/issues/1611

- For Ghost 5.0 card assets will be included by default, including bookmark and gallery cards
2022-05-12 14:44:31 +01:00
Hannah Wolfe
409dc3b534
Added frontend key to ghost_head for portal (#14782)
refs: https://github.com/TryGhost/Team/issues/1599
refs: f3d5d9cf6b

- this commit adds the concept of a frontend data service, intended for passing data to the frontend from the server in a clean way. This is the start of a new & improved pattern, to hopefully reduce coupling
- the newly added internal frontend key is then exposed through this pattern so that the frontend can make use of it
- the first use case is so that portal can use it to talk to the content API instead of having weird endpoints for portal
- this key will also be used by other internal scripts in future, it's public and therefore safe to expose, but it's meant for internal use only and therefore is not exposed in a generic way e.g. as a helper
2022-05-11 17:34:31 +01:00
Hannah Wolfe
b29852b012
🔥 Removed support for http/https mixed mode (#14783)
closes: https://github.com/TryGhost/Toolbox/issues/324
refs: https://github.com/TryGhost/Ghost/issues/14446

- Currently, if url is configured to http but a request is marked secure, Ghost will handle upgrading all internal URLs to https so that there are no mixed content warnings
- From 5.0 that feature is going away, in favour of strictly honouring the configured URL
- Ghost will serve URLs exactly as configured and won't upgrade http to https anymore
- This use case was common when Ghost was first built, but in 2022 the web is mostly https.
- The code needed to support the feature creates a lot of additional complexity & maintenance overhead, so removing this gives us space to do more cool and useful stuff in 2022
2022-05-11 14:53:23 +01:00
Naz
5e441d0942 🔥 Removed {{author}} helper support
refs https://github.com/TryGhost/Toolbox/issues/230

 - Single {{author}} helper has been deprecated since multiple major releases. It has also been throwing fatal errors in gscan v5 since some time. It will finally be gone!
 - The plural {{authors}} helper should be used instead, read here for more information: https://ghost.org/docs/themes/helpers/authors/
2022-05-02 17:59:48 +08:00
Daniel Lockyer
3b6cdc2bc5
Renamed preview files to previews
refs https://github.com/TryGhost/Toolbox/issues/308

- we have a pattern of using plurals around Ghost but this was singular
- this shouldn't change any API functionality, it's just code
  refactoring
2022-04-28 15:37:14 +01:00
Hannah Wolfe
a4a9ba7940
🔥 Removed versioned APIs
refs: https://github.com/TryGhost/Toolbox/issues/229

- we are getting rid of the concept of having multiple api versions in a single ghost install
- removed all the code for multiple api versions & left canary wired up, but without the version in the URL
- TODO: reorganise the folders so there's no canary folder when we're closer to shipping
        we need to minimise the pain of merging changes across from main for now
2022-04-28 15:37:09 +01:00
Hannah Wolfe
608258747a
Removed versioned routing configs
refs: https://github.com/TryGhost/Toolbox/issues/228

- we are getting rid of the concept of having multiple api versions in a single ghost install
- we no longer need versioned routing configs
2022-04-28 15:35:28 +01:00
Hannah Wolfe
8bd9169298
Removed res.locals.apiVersion
- we are getting rid of the concept of having multiple api versions in a single ghost install
- we no longer need to pass the apiVersion around using res.locals
- To simplify code that uses our frontend proxy the proxy now _only_ exposes canary
2022-04-28 15:35:28 +01:00
Hannah Wolfe
4332546a56
Removed theme engines API versioning concept
refs: https://github.com/TryGhost/Toolbox/issues/228

- we are getting rid of the concept of api versions from Ghost
- this means getting rid of them from the frontend as well, and from themes
2022-04-28 15:35:27 +01:00
Hannah Wolfe
a703185497
Fixed mockLabs disabling all other flags (#14621)
refs TryGhost/Team#1566

- Mocking a labs flag (regardless of enabled/disabled) currently has a side effect of setting any other flag to undefined.
- This meant in a test where we set a flag e.g. members-importer where we set multipleProducts, multipleNewsletters is always disabled
- This fix preserves the default state of all labs flags that are not mocked so that labs behaves how we expect
- Removed usage of GA flags in tests
- Removed tests that had GA flags disabled

Co-authored-by: Simon Backx <simon@ghost.org>
2022-04-28 10:55:20 +02:00
Hannah Wolfe
1d121c52f4
Replaced white/black list terminology
refs 92986b77e3

- I thought we did this a while ago, but uses in comments and elsewhere in the codebase were missed
2022-04-19 11:19:59 +01:00
Hannah Wolfe
0581314796
Fixed location of url service unit tests
- The url service was moved from frontend to server some time ago but the tests were forgotten
- This is only being done now because in 5.0 major changes are happening and it'll be annoying if the
  files move on that branch
2022-04-06 13:05:41 +01:00
Hannah Wolfe
08479f3816
Moved routing helpers to rendering service
- The helpers folder was full of things used for rendering pages
- It belongs as its own service so that we can see what it really does
2022-04-05 20:12:20 +01:00
Hannah Wolfe
c902d91c81
Renamed rendering service to handlebars
- This fits more closely, as this service is to so with rendering helpers and small parts
- Whereas we want to use "rendering" for things concerned with rendering pages
2022-04-05 20:10:33 +01:00
Hannah Wolfe
e9d6f61029
Moved checks into frontend data service
refs: https://github.com/TryGhost/Ghost/commit/11867ab43

- These checks live in the wrong place. They are mostly a frontend thing
- The only server place they were used was slack and that was fixed in 11867ab43
- Moving these to the frontend they fit neatly into the frontend data service
2022-04-05 15:23:00 +01:00
Hannah Wolfe
4ee2fcd869
Moved frontend data helpers into their own service
- Some of the helpers inside the routing service would be better suited to their own service
- These two helpers fetchData and entryLookup talk to the API to get data & so make a decent start for a data service
- The data service would be the single point of contact with the API for the frontend
- Doing this now cos I'm moving some files around ahead of deleting things for 5.0
2022-04-05 13:38:42 +01:00
Hannah Wolfe
a31069d49d
Removed unnecessary use of rewire
refs: https://github.com/TryGhost/Ghost/commit/e68cb8b31

- I found that some of the places we use rewire are totally unnecessary
- Rewire seems to mess with coverage sometimes
- It's also a code smell in general so I've ripped it out where possible
2022-03-24 19:32:06 +00:00
Naz
7becf0a2b2 Aliased canary endpoints to point to non-versioned URLs
refs https://github.com/TryGhost/Toolbox/issues/169

- Before releasing Ghost v5 we would like to move all canary-related URLs to a non-versioned format, which will become a default in v5.
- 'canary' is by definition unstable, so breaking any unprepared client explicitly using the canary is expected
- Removed the aliased /content/ and /admin/ apps from app.js because with updated configuration they become duplicates of 'canary' endpoints
2022-03-14 21:22:54 +13:00
Rishabh
b03862d08a Updated content cta helper to use new tiers helper
refs https://github.com/TryGhost/Team/issues/1004

Replaces {{products}} helper usage with updated {{tiers}} helper. Default output for {{tiers}} helper is the same as {{products}} helper.
2022-03-04 18:22:59 +05:30
Rishabh
665c30f255 Added new {{tiers}} theme helper
refs https://github.com/TryGhost/Team/issues/1004

- adds new `{{tiers}}` helper behind `multipleProducts` flag
- `{{tiers}}` outputs a string with list of tiers that have access to specific post when used in a post context in theme
- outputs empty string when used out of a post context and without access to `visibility` property
- uses tiers attached to post column for data
2022-03-04 18:22:59 +05:30
Simon Backx
f389bab6ab
🐛 {{access}} property incorrect when using get/next-post/prev-post helpers (#14256)
refs https://github.com/TryGhost/Team/issues/1367

- The {{access}} property of a post always returned false for non-public content
- Added the member context to the get, next-post and prev-post helpers
- The get, next-post and prev-post helpers didn't add the member context to the internal API calls
- Added the members context to these calls
- Added tests that check if the member context is passed to the API calls
- Transformed next_post helper tests to async await syntax
- Transformed prev_post helper tests to async await syntax
2022-03-03 16:18:05 +01:00
Simon Backx
e97abeceb5
Added >, <, >=, and <= operators to match helper (#14215)
refs https://github.com/TryGhost/Team/issues/1386

- The current match handler supports normal (in)equality operators, but no numeric comparisons (<, >, <=, >=)
- A use case for these new operators is to show the latest post in a separate way from other posts

Includes unit tests to check the new behaviour.
Run via `yarn test test/unit/frontend/helpers/match.test.js`
2022-03-03 15:43:47 +01:00
Torsten Zander
f1b71f7fd7
🐛 Fixed AssetHelper not working with svg (#13978)
loses TryGhost#13971

This fixes an issue with links containing # anchor. It makes sure the # part is at the end of the url like url?v=hash#anhor

Co-authored-by: Hannah Wolfe <github.erisds@gmail.com>
2022-02-07 15:07:18 +00:00
Rishabh
64721150a9 Updated tests to handle visibility tier
refs https://github.com/TryGhost/Team/issues/1071

- updates tests to handle new visibility of `tiers` which uses tiers pivot table
2022-02-01 11:13:51 +05:30
Hannah Wolfe
9d8089a748
Removed deprecated routes.yaml data format
refs: https://github.com/TryGhost/Ghost/issues/10434
refs: https://github.com/TryGhost/Ghost/pull/10449
refs: https://github.com/TryGhost/Ghost/pull/10559

- We originally had a weird structure returned for data keys in routes.yaml.
- To the best of my knowledge this was never desired or really used
- I'm removing it now simply because I'm trying to remove all references to v2/v3 in tests, and this had a comment saying it was deprecated in v3
- I could have changed the comment to be a proper @deprecated comment and leave this til we rewrite dynamic routing
- However it's weird and confusing and I believe entirely unused - so getting rid is way way better
2022-01-21 20:16:43 +00:00
Hannah Wolfe
4c8ff38a44
Updated misc unversioned tests to run on canary
refs: https://github.com/TryGhost/Toolbox/issues/168

- All of our unversioned tests should be running against canary already
- These tests are erroneously running on the wrong version

We're going to be dropping the idea of having multiple versions of the API in each Ghost version.
Because this has not achieved the goal of making it easier to make breaking changes, but it has
created an ordinate amount of technical debt and maintenance overhead.

As we know this is going away in the next major, there is no benefit to us constantly running tests
that check if those versions still work, especially given how long they take.

Instead we're starting work to ensure that all of our test work on canary, and that canary has
excellent test coverage so that we can be sure that our one API version works really well and that
any changes, no matter how subtle are deliberate, tracked and understood.
2022-01-21 15:11:48 +00:00
Hannah Wolfe
12e8c974a1
Cleaned up weird refs to versions in tests
refs: https://github.com/TryGhost/Toolbox/issues/168

- These are all places where we reference an API version like v2 or v3 but it's not actually
used or relevant.
- The aim is to get rid of all mentions of these old versions to make it clearer that we're only running tests on canary
2022-01-21 15:10:03 +00:00
Hannah Wolfe
e47b55b466
Removed some hidden v2 and v3 tests
refs: https://github.com/TryGhost/Toolbox/issues/168

- These are all test files I missed in ffcd3fbe313b4a413833da9a7473376cb21246fd

We're going to be dropping the idea of having multiple versions of the API in each Ghost version.
Because this has not achieved the goal of making it easier to make breaking changes, but it has
created an ordinate amount of technical debt and maintenance overhead.

As we know this is going away in the next major, there is no benefit to us constantly running tests
that check if those versions still work, especially given how long they take.

Instead we're starting work to ensure that all of our test work on canary, and that canary has
excellent test coverage so that we can be sure that our one API version works really well and that
any changes, no matter how subtle are deliberate, tracked and understood.
2022-01-21 15:07:17 +00:00
Marat Vyshegorodtsev
74b97e99cd
Added timezone and locale to the options of the date helper (#13892)
fixes https://github.com/TryGhost/Ghost/issues/13832

The `date` handlebars helper has only one option currently — `format`. It assumes the locale and timezone from the `options.data.site` object which is not always desired behavior.

The helper sometimes is used, for example, in custom RSS template where we always need the `en-US` locale, not the one that we have configured for the website globally. This change makes the two options configurable, and defaults to the `options.data.site` object values, if not specified in the helper (keeps the backwards compatibility with the current behavior).
2022-01-19 14:43:53 +00:00
Thibaut Patel
01e833376b
🐛 Added pagination to sitemap.xml to avoid max 50,000 entries limit
refs https://github.com/TryGhost/Team/issues/1044
refs https://github.com/TryGhost/Ghost/pull/13298

- This splits the sitemaps according to the limit set by Google https://developers.google.com/search/docs/advanced/sitemaps/large-sitemaps

Co-authored-by:
- Kevin Ansfield (@kevinansfield)
2022-01-05 11:54:35 +01:00
Matt Hanley
cc7f527a6a
🐛 Added fallback for meta_description to custom_excerpt (#13927)
closes https://github.com/TryGhost/Ghost/issues/13920

- Custom excerpt should be used as a fallback for meta_description in line with the behaviour of OG and Twitter metadata
- We specifically don't want to use the full fallback to the auto-generated preview text when a custom excerpt isn't defined, because we trust search engines to be able to summarise content better than we can
2022-01-03 19:09:03 +00:00
Kevin Ansfield
cabf78e938 Cleaned up customThemeSettings labs flag
closes https://github.com/TryGhost/Team/issues/1164

- `customThemeSettings` feature is GA so any conditionals can be cleaned up
- removed conditional loading of custom theme settings and associated API routes
- removed event trigger for reloading custom theme settings when the feature flag is toggled
- removed flag from labs GA list
2022-01-03 17:45:25 +00:00
Fabien 'egg' O'Carroll
0c853a372b
Supported restricting limit="all" in get helper (#13903)
refs https://github.com/TryGhost/Team/issues/1251

With sites that have a huge number of resources, using limit="all" can
cause OOM errors at the Node level. Administrators now have the ability
to cap limit="all" requests via config. This only affects the get helper
used in themes, not the API, this is by design as themes have less
visibility of issues.
2021-12-16 13:59:39 +02:00
Hannah Wolfe
40fee069c9
Moved locale testing out of casper fixture (#13850)
refs: https://github.com/TryGhost/Toolbox/issues/137#issuecomment-986829141

- Moving the weird customisation of Casper out of the test fixture
- Created a standalone theme for testing locales instead
- This should make it easier for us to update our Casper fixture
2021-12-06 15:11:54 +00:00
Thibaut Patel
faff6ad669 Fixed the tests from the previous commit
refs 77c0364efd
2021-12-02 10:48:46 +01:00
Thibaut Patel
77c0364efd 🐛 Fixed malformed URLs crashing the url helper
refs https://github.com/TryGhost/Team/issues/960

- Character like "%%" or "%80" would crash our current url escaping behavior. We consider they aren't valid URLs as the percentages haven't been properly escaped.
2021-12-02 10:34:24 +01:00
Fabien egg O'Carroll
3407df7c1c Fixed stubbing of labs data
no-issue

Labs data is read from the labs service not the settings cache, so we
should be stubbing this to ensure that the tests run correctly.
2021-12-01 16:11:27 +02:00
Sam Lord
2887e416da
Switch to @tryghost/errors from ignition errors package (#13807)
refs: TryGhost/Toolbox#147

* Replaces all references to isIgnitionError with isGhostError
* Switches use of GhostError to InternalServerError - as GhostError is no longer public
There are places where InternalServerError is not the valid error, and new errors should be added to the @tryghost/errors package to ensure that we can use semantically correct errors in those cases.
2021-12-01 10:22:01 +00:00
Hannah Wolfe
0ede559d5b
🐛 Fixed card asset init/reload behaviour
- Card asset reloading was incorrectly only happening if the API version changed 🙈
- In addition, having an init function was redundant, as theme activation happens on boot
- This meant that the card assets were being generated twice on boot
- Instead, we now only generate them on theme activation, which covers the boot case and simplifies all the logic
2021-11-23 12:53:58 +00:00
Hannah Wolfe
6e6a4822f2
Updated servePublicFile to honor v= cache keys
- Currently it's assumed that public files are 100% static
- With card assets, we're using it for files that are partially static, but can change between reboots and theme changes
- We already have a system for managing cache busting across theme changes and restarts - the ?v= key that is added via the asset helper
- This was already in place and used, but servePublicFile's internal cache didn't honor this key, and cached for the lifetime of boot
- This small change means that if a ?v= query param is present on a request for a public file, that we pay attention to it. Else we cache as before
2021-11-23 12:49:53 +00:00
Naz
34b0196c0f Added writeDisabled flag to URL file cache
refs https://github.com/TryGhost/Toolbox/issues/135

- Allows to turn off overwriting urls/resources JSON file caches on testing environment. This is needed to have predictable state when running multiple test suites that stop the Ghost process and try to persiste URL cache.
2021-11-22 21:56:32 +13:00
Naz
ee4d2dd1a8 Extracted a local file cache class for URLs
refs https://github.com/TryGhost/Toolbox/issues/135

- This extracts the file storage knowledge out of the URL Service an allows to have optional features based on the environment - for example turning off writing cache for when running tests
2021-11-22 21:56:32 +13:00