mirror of
https://github.com/TryGhost/Ghost.git
synced 2025-01-06 22:40:14 -05:00
ed7ce2c00f
refs https://github.com/TryGhost/Team/issues/1664 This has no security features, we need to replace usage of "*" with the origin of the frontend site.
67 lines
2.4 KiB
JavaScript
67 lines
2.4 KiB
JavaScript
const debug = require('@tryghost/debug')('web:admin:app');
|
|
const express = require('../../../shared/express');
|
|
const serveStatic = express.static;
|
|
const config = require('../../../shared/config');
|
|
const constants = require('@tryghost/constants');
|
|
const urlUtils = require('../../../shared/url-utils');
|
|
const shared = require('../shared');
|
|
const errorHandler = require('@tryghost/mw-error-handler');
|
|
const sentry = require('../../../shared/sentry');
|
|
const redirectAdminUrls = require('./middleware/redirect-admin-urls');
|
|
|
|
module.exports = function setupAdminApp() {
|
|
debug('Admin setup start');
|
|
const adminApp = express('admin');
|
|
|
|
// Admin assets
|
|
// @TODO ensure this gets a local 404 error handler
|
|
const configMaxAge = config.get('caching:admin:maxAge');
|
|
adminApp.use('/assets', serveStatic(
|
|
config.get('paths').adminAssets,
|
|
{maxAge: (configMaxAge || configMaxAge === 0) ? configMaxAge : constants.ONE_YEAR_MS, fallthrough: false}
|
|
));
|
|
|
|
adminApp.use('/auth-frame', serveStatic(
|
|
config.get('paths').adminAuthAssets
|
|
));
|
|
|
|
// Ember CLI's live-reload script
|
|
if (config.get('env') === 'development') {
|
|
adminApp.get('/ember-cli-live-reload.js', function emberLiveReload(req, res) {
|
|
res.redirect(`http://localhost:4200${urlUtils.getSubdir()}/ghost/ember-cli-live-reload.js`);
|
|
});
|
|
}
|
|
|
|
// Force SSL if required
|
|
// must happen AFTER asset loading and BEFORE routing
|
|
adminApp.use(shared.middleware.urlRedirects.adminSSLAndHostRedirect);
|
|
|
|
// Add in all trailing slashes & remove uppercase
|
|
// must happen AFTER asset loading and BEFORE routing
|
|
adminApp.use(shared.middleware.prettyUrls);
|
|
|
|
// Cache headers go last before serving the request
|
|
// Admin is currently set to not be cached at all
|
|
adminApp.use(shared.middleware.cacheControl('private'));
|
|
|
|
// Special redirects for the admin (these should have their own cache-control headers)
|
|
adminApp.use(redirectAdminUrls);
|
|
|
|
// Finally, routing
|
|
adminApp.get('*', require('./controller'));
|
|
|
|
adminApp.use((err, req, res, next) => {
|
|
if (err.statusCode && err.statusCode === 404) {
|
|
// Remove 404 errors for next middleware to inject
|
|
next();
|
|
} else {
|
|
next(err);
|
|
}
|
|
});
|
|
adminApp.use(errorHandler.pageNotFound);
|
|
adminApp.use(errorHandler.handleHTMLResponse(sentry));
|
|
|
|
debug('Admin setup end');
|
|
|
|
return adminApp;
|
|
};
|