Commit Graph

16463 Commits

Author SHA1 Message Date
Daniel Lockyer
03c9fd47fa v5.2.4 2022-07-05 09:50:40 +01:00
Daniel Lockyer
a6150bc2df Updated Admin to v5.2.4 2022-07-05 09:50:40 +01:00
Daniel Lockyer
bf264c15e5 v5.2.3 2022-06-15 03:59:47 +01:00
Daniel Lockyer
506957be84 Updated Admin to v5.2.3 2022-06-15 03:59:46 +01:00
Fabien "egg" O'Carroll
b82dc7ae7c 🔒 Fixed RCE exploit with date helper & locale setting
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-7v28-g2pq-ggg8

A vulnerability in an upstream library means an attacker can abuse locale input
to execute arbitrary commands from a file that has previously been uploaded
using the file upload functionality in the post editor.
2022-06-14 22:50:22 -04:00
Renovate Bot
4c16cb9624
Update Test & linting packages 2022-06-06 03:00:14 +00:00
Daniel Lockyer
c6dabf13a3 v5.2.2 2022-06-03 17:50:37 +01:00
Daniel Lockyer
ea34d3600e Updated Admin to v5.2.2 2022-06-03 17:50:37 +01:00
Daniel Lockyer
fbda47062f 🎨 Updated Casper to v5.1.4 2022-06-03 17:50:36 +01:00
Matt Hanley
859d49626c
Updated mapping for stripe_products when product import is skipped (#14965)
refs d63e9256ea

- Following the ref'd commit, when migrating a site the default and free tiers would be skipped because they exist by default in the new site
- As the product is skipped, we don't have the ID available in the imported data to map the stripe_product to
- If the stripe_product isn't mapped, imported members won't be mapped to the correct tier
- This commit adds a lookup for the product by name and slug to restore the correct stripe_product mapping

Co-authored-by: Simon Backx <simon@ghost.org>
2022-06-03 17:31:53 +01:00
Matt Hanley
2ecb4acc85 Updated gscan 2022-06-03 16:09:34 +01:00
Matt Hanley
d63e9256ea
🐛 Fixed duplicate tiers being created on import (#14964)
- When importing tiers, duplicate tiers were being created with different slugs
2022-06-03 15:02:44 +01:00
Naz
b536cf5d9c Added e2e test coverage for post.added event
refs https://github.com/TryGhost/Toolbox/issues/320

- Wanted to verify if multiple webhook snapshot tests would play nicely together. They did!
- Also having few tests of the same type allows to detect patterns that could be extracted and reused later :)
2022-06-03 14:56:55 +08:00
Naz
9c3ed1a1f5 Added a hacky matcher to overcome 404 URL problem
refs https://github.com/TryGhost/Toolbox/issues/341
refs https://github.com/TryGhost/Toolbox/issues/320

- The snapshot for post's url property is causing test flakyness. The reason is due to the async nature of url processing in the URL Service (https://github.com/TryGhost/Ghost/issues/10360). Once the underlying issue is solved this hack could be removed.
- Having a snapshot tes even in this form is better than having none!
2022-06-03 11:57:39 +08:00
Naz
cb24a0d3f0 Fixed webhook snapshot test error output
refs https://github.com/TryGhost/Toolbox/issues/320

- When the snapshot test failed a misleading error was showing up. The bump fixed that bug.
2022-06-03 11:57:39 +08:00
Naz
3c7271ab76 Fixed post.published event test suite
refs https://github.com/TryGhost/Toolbox/issues/320

- Updated the test suite to use updated webhookMockReceiver.mock method and corrected previously incorrect snapshot
2022-06-03 11:57:39 +08:00
Naz
c30a8b82d1 Added webhooks tests to test:e2e command
refs https://github.com/TryGhost/Toolbox/issues/320

- Webhook tests are becoming a special type of tests and needed their own "home" to live in. Adding them to be a part of the e2e test command, so they are run the same way as the rest of e2e test suites
2022-06-03 11:57:39 +08:00
Naz
041a32934a Added webhook fixute utils
refs https://github.com/TryGhost/Toolbox/issues/320

- There will be more webhook e2e tests coming which require easy webhook fixture creation
2022-06-03 11:57:39 +08:00
Naz
c7e833545b Extracted webhook mock receiver into a package
refs https://github.com/TryGhost/Toolbox/issues/320

- Following the rule of having minimum code changes in the Ghost core codebase. This module belongs to "framework" along with other testing tools anyway.
- The bump includes a noteworthy changes - the "snapshotManager" was extracted into a separate exposed property of express-test API (maybe should be even it's own separate concept eventually, for now exposing it was enough). "snapshotManager" had to be exposed to be able to pass it to the webhook mock receiver - to use same instance configured with mocha hooks. snapshotManager has to be a singleton in the system to configure snapshots correctly through mochaHooks.
2022-06-03 11:57:39 +08:00
Naz
0f4aeaaa80 Added basic framework for webhook e2e tests
refs https://github.com/TryGhost/Toolbox/issues/320

- This is an **MVP** to be able to intercept and match webhook request
snapshots. The concept is similar to the one used in API E2E tests using
same "matchBodySnapshot" and other "match*" methods to test the webhook
**request** data
- Next up here would be:
1. Header matcher
2. Mocking more than one webhook (and doing something nicer with the way
the fixture data is inserted, does this logic belong to the mock-receiver?
2022-06-03 11:57:39 +08:00
Daniel Lockyer
6a3f61f62a Fixed database environment variables leaking across matrix runs
refs https://github.com/TryGhost/Toolbox/issues/244

- due to the way we currently set the env vars, they get applied across
  all matrix variations
- this means we're leaking the variables for SQLite to the MySQL test
  runs and this shows a warning because of how strict `mysql2` is
- this commit switches to optionally setting the env variables
- this is a partial workaround for fbcdacbd83/core/shared/config/utils.js (L55-L76) not seeming to work
2022-06-02 09:49:22 -04:00
Daniel Lockyer
fbcdacbd83 v5.2.1 2022-06-02 12:34:53 +01:00
Daniel Lockyer
e3223cd9a7 Updated Admin to v5.2.1 2022-06-02 12:34:53 +01:00
Naz
c9758112b3 🐛 Fixed an error when updating a user
closes https://github.com/TryGhost/Team/issues/1655
refs https://github.com/TryGhost/Ghost/commit/4bc14d2c4

- The API should always accept the input it returns. In this case it did not accept the input when it contained an unchanged roles property
- The problem here came from the referenced commit where we can now end up in the situation when the `roleToAssign` is just empty. It was an optimization to prevent a need to do ANY DB operation when none was needed.
2022-06-02 12:13:27 +01:00
Daniel Lockyer
264678e9be
Prevented certain GitHub Actions workflows from running on forks
fixes https://github.com/TryGhost/Toolbox/issues/285

- without this, some of the workflows that are only useful for the core
  team will run on forks
- this commit adds checks to ensure we're running on a repo maintained
  by the TryGhost organization for a handful of workflows
2022-06-01 17:54:26 -04:00
Daniel Lockyer
a6efdbf1db v5.2.0 2022-06-01 16:28:51 +01:00
Daniel Lockyer
06868f81c6 Updated Admin to v5.2.0 2022-06-01 16:28:51 +01:00
Daniel Lockyer
47cca9b773 🎨 Updated Casper to v5.1.3 2022-06-01 16:28:50 +01:00
Matt Hanley
54d88cf689 Updated packages 2022-06-01 16:07:14 +01:00
Fabien 'egg' O'Carroll
6c455dc1f2
🐛 Fixed Stripe Checkout for Members w/ existing subscriptions (#14953)
refs https://github.com/TryGhost/Team/issues/1526

This adds a check for existing subscriptions for a member associated with the
email addressed used for Stripe Checkout, if any are found the Checkout Session
creation fails and responds with a 403.

We've also updated the error handling for the create-stripe-checkout-session
endpoint so that it follows the existing Ghost API patterns.
2022-06-01 15:53:05 +01:00
Simon Backx
c32b1baa9b
Added support for publishing email only posts by setting status to sent (#14950)
no issue

If you try to publish a draft email only post by setting the status to sent, you won't receive an error but the email won't get sent. This is because we don't support this behaviour. This is very counter-intuitive when writing the documentation, so I've patched this behaviour and added some more tests.
- When setting the status to `sent` for not email only posts, the post status will be set to `published` without warning
- Also published_by was not set correctly in the past. This is also fixed and has new tests.
2022-06-01 14:53:55 +02:00
Naz
4bc14d2c4b 🐛 Fixed invalid user role assignment
closes https://github.com/TryGhost/Toolbox/issues/351

- When an invalid value was passed in `roles` parameter when editing a user it resulted in incorrect database state (all roles appeared to be unassigned from the user).
- The fix includes ability to set user role by an allowed name, one of:  'Administrator', 'Editor', 'Author', 'Contributor'.
- Also added a validation in case a non-ObjectID value is passed in roles to the users edit method.
2022-06-01 17:48:08 +08:00
Naz
29e5d08210 Refactored Admin API test agent to use async/await
no issue

- Improves readability of what's going on in the code.
2022-06-01 17:48:08 +08:00
Hannah Wolfe
6271e2f5f3 Increased body parser limit to 50mb
refs: https://github.com/TryGhost/Ghost/issues/5998#issuecomment-928981043

- Starting to see more people using long form content and otherwise exceeding the 1mb internal limit
- Setting it to 50mb matches Ghost-CLI's max body for nginx
- It might be ideal at some point to make this configurable, but I think increasing the limit solves the problem very simply for the foreseeable future
2022-06-01 10:12:23 +01:00
Rishabh
c6c64c3aeb Updated single tier labels and subscription error messages
- bumps portal to refine single tier labels
- portal handles/shows custom error messages for failed checkout session creation
2022-06-01 13:44:08 +05:30
Renovate Bot
4feb5873b6
Update dependency express-jwt to v7.7.5 2022-05-31 21:02:21 +00:00
Simon Backx
a30e42404b
Added getLazyRelation model helper method (#14943)
closes https://github.com/TryGhost/Team/issues/1626

- getLazyRelation is a safer shorthand for `model.related('relationName').fetch()`
- prevents doing a `fetch` operation on a relation that is already loaded, which can cause issues when `formatOnWrite` has a custom implementation
- uses the already loaded relation if it exists, or loads the relation
- doesn't reload if already loaded
- reload is forceable using the forceRefresh option
2022-05-31 13:21:53 +02:00
Daniel Lockyer
82a60ae155 Fixed detection of Windows environment when connecting to SQLite temp DB
fixes https://github.com/TryGhost/Toolbox/issues/284

- this section of code rewrites `/tmp` in the SQlite filename to the
  temp dir
- the fix was only intended for Windows environments, because they
  typically don't have a `/tmp` dir
- this commit adds a `process.platform` check for Windows
- it also moves the code into the DB connection file instead of the
  config lib
2022-05-30 17:42:34 -04:00
Renovate Bot
4ddba47b00
Update dependency express-jwt to v7.7.3 2022-05-30 18:31:17 +00:00
Renovate Bot
367ad86e24
Update dependency knex-migrator to v4.2.11 2022-05-30 15:39:08 +00:00
Simon Backx
9d21a14b4b
Added integration test for MEGA.sendEmailJob (#14944)
closes https://github.com/TryGhost/Team/issues/1632
2022-05-30 15:41:02 +02:00
Simon Backx
da8cb5c078
Added possible fix for random test timeouts
no issue

Some tests timeout for an unknown reason. This commit adds some missing awaits for async test methods (that don't perform any async operation, but are marked as async).
2022-05-30 15:00:55 +02:00
Daniel Lockyer
438526641b v5.1.1 2022-05-30 13:54:29 +01:00
Daniel Lockyer
d9e5092ec5 Updated Admin to v5.1.1 2022-05-30 13:54:28 +01:00
Renovate Bot
8c601a411f
Update metascraper 2022-05-30 01:34:06 +00:00
Daniel Lockyer
302c257560 v5.1.0 2022-05-27 16:10:20 +01:00
Daniel Lockyer
b86756c36b Updated Admin to v5.1.0 2022-05-27 16:10:19 +01:00
Daniel Lockyer
f2c4675d5f 🎨 Updated Casper to v5.1.1 2022-05-27 16:10:18 +01:00
Simon Backx
a051ab3b69
🎨 Reduced favicon requirements and added image formatting (#14918)
fixes https://github.com/TryGhost/Team/issues/1652
fixes https://github.com/TryGhost/Ghost/issues/13319

**Image formatting**
Added support for changing the format of images via the `handle-image-sizes` middleware (e.g. format SVG to png, jpeg, webp)

This change was required:
- Not all browsers support SVG favicons, so we need to convert them to PNGs
- We can't fit image resizing and formatting in the `serve-favicon` middleware: we need to store the resized image to avoid resizing on every request. This system was already present in the `handle-image-sizes` middleware.

To format an uploaded image:
- Original URL: https://localhost/blog/content/images/2022/05/giphy.gif
- To resize: https://localhost/blog/content/images/size/w256h256/2022/05/giphy.gif (already supported)
- To resize and format to webp: https://localhost/blog/content/images/size/w256h256/format/webp/2022/05/giphy.gif
- Animations are preserved when converting Gifs to Webp and in reverse, and also when only resizing (https://github.com/TryGhost/Ghost/issues/13319)

**Favicons**
- Custom favicons are no longer served via `/favicon.png` or `/favicon.ico` (only for default favicon), but use their full path
- Added support for uploading more image extensions in Ghost as a favicon: .jpg, .jpeg, .gif, .webp and .svg are now supported (already supported .png and .ico).
- File extensions other than jpg/jpeg, png, or ico will always get transformed to the image/png format to guarantee browser support (webp and svg images are not yet supported as favicons by all browsers).

For all image formats, other than .ico files:
- Allowed to upload images larger than 1000px in width and height, they will get cropped to 256x256px.
- Allowed uploading favicons that are not square. They will get cropped automatically.
- Allowed to upload larger files, up to 20MB (will get served at a lower file size after being resized)

For .svg files:
- The minimum size of 60x60px is no longer required.

For .ico files:
- The file size limit is increased to 200kb (coming from 100kb)
2022-05-27 16:36:53 +02:00
Hannah Wolfe
f805f1637c
🐛 Fixed reading time for RTL languages
closes: https://github.com/TryGhost/Ghost/issues/14365
closes: https://github.com/TryGhost/SDK/issues/366
closes: https://github.com/TryGhost/SDK/issues/389
refs: https://github.com/TryGhost/SDK/pull/431

- our word count helper has been updated to handle RTL languages
- this should also fix the reading time as it uses the same underlying function

Co-authored-by: Emmanuel-Melon <emmanuelgatwech@gmail.com>
2022-05-27 15:15:29 +01:00