Commit Graph

391 Commits

Author SHA1 Message Date
jamesbloomer
9d114c7fa6 Lock down theme static directory to not serve templates, markdown and text files.
closes #942
- insert custom middleware to check for blacklisted files
- redirect to express.static if file accepted
- if not valid return next() to do nothing
- currently black listing .hbs, .txt, .md and .json
- debatable which is best, black list or white list, either one will probably need tweaks but erred on side of letting
a theme serve unknown types
2013-10-11 18:05:31 +01:00
Hannah Wolfe
c732cd2ccb Adding xss unit test
issue #938
2013-10-10 16:43:25 +01:00
Sebastian Gierlinger
6ff17c78a2 Fix filepaths for config and upload
no issue
- added appRoot to config-loader.js
- modified uploader to use correct path
- modified tests
2013-10-10 12:44:31 +02:00
Hannah Wolfe
95f9fce3be Swapping escape to sanitze
issue #938

- rather than using escape, use node-validatiors santize function which is designed for preventing xss vectors
- added listener for changes to both editor and settings page
- added more sanitization to the user model
- consistently use triple-braces when outputting blog post titles
2013-10-09 19:13:16 +01:00
Tim Griesser
c9235ccb0b Escaping several fields to prevent XSS
issue #938
- escapes post's title field
- escapes settings title, description, email
- escapes user's name field
- includes test for post title
2013-10-09 19:13:13 +01:00
William Dibbern
8ef27f0590 Refactored tests
Fixes #362

- There is no need to set the viewport on functional tests anymore
unless something other
than the default of 1280x1024 is desired.
- There is no need to invoke `casper.run` to trigger `test.done`
anymore for functional tests.
- Each test works independently of the rest; registration is handled
once for the lifetime of the test run and then login/logout can be
invoked automatically as desired.
- Mocha tests all utilize predefined, more realistic fixtures when
appropriate.
- Renamed old api tests that were really model tests as appropraite.
- Added example api test for posts.
2013-10-07 21:05:25 -05:00
Hannah Wolfe
6bd62538af Merge branch '0.3.1-wip'
Conflicts:
	core/server/controllers/admin.js
2013-09-27 17:22:55 +01:00
Hannah Wolfe
ee8d8102db Merge pull request #923 from ErisDS/0.3.1-wip-mysql
0.3.1 wip mysql
2013-09-27 05:04:45 -07:00
Hannah Wolfe
5c10f6608c Unit Test fixes for MySQL
issue #858

- there is no guaranteed order to arrays, so sort before testing them
- tests run much faster, date comparisons fail
- settings tests are more explicit, otherwise they fail random validations
- dates must be inserted as date objects
2013-09-27 12:52:31 +01:00
Hannah Wolfe
50a16ceb76 Test Cleanup 2013-09-27 11:36:12 +01:00
Hannah Wolfe
e411ed6889 No autolinking inside of code blocks
closes #865

- rejigged markdown to have some functionality before showdown runs, and other functionality before.
- autolinking now happens last, so it can be smarter
2013-09-27 11:35:44 +01:00
Hannah Wolfe
8c6519fde7 Don't output image tag for empty source
closes #866

 - ensures we don't end up creating any more empty image tags.
2013-09-27 11:30:41 +01:00
Jacob Gable
a9c0359f18 Add some unit tests for post saving
- Confirm published_at for new posts
- Confirm slug generating on saving posts
2013-09-26 23:15:43 +01:00
Jacob Gable
088518936c Configuration validation in config-loader
Added a couple sanity checks to the config during the loadConfig call.

- Check that the config exists for the current NODE_ENV
- Check that the config.url exists and is valid structure
- Check that the config.database exists
- Check that the config.server exists and has a port and host value
2013-09-26 23:07:48 +01:00
jamesbloomer
55048d6a20 Fix image upload tests on windows
closes #826
- on windows the fs.exists call had windows style back slashes
- set up the test to cope with either (not the most elegant but works)
2013-09-26 15:19:05 +01:00
jamesbloomer
8e3ddcbdcc Trim version number to major and minor numbers only in meta tag
closes #880
- as the version number is under control from package.json use regex to trim
2013-09-26 15:00:05 +01:00
Hannah Wolfe
02a02054e8 Handle duplicate tags on import
closes #890

- importer only adds tags which don't exist.
- added back the import unit tests - these are basic for now
2013-09-25 11:30:59 +01:00
jamesbloomer
c215626d2b Use file mime type rather than extension to check server side if image upload is a valid file
closes #705
- uses the file type passed by express/connect
- relies on the type being set correctly by the browser upload
- doesn't reread the file to check
2013-09-20 13:20:59 +01:00
Hannah Wolfe
477c4c59fa Merge pull request #843 from cgiffard/500-errors
500 Series Error Handling & Stack Traces
2013-09-18 22:52:52 -07:00
Hannah Wolfe
43fe50ca7b New Tag in fixture breaks Tag tests 2013-09-19 06:50:32 +01:00
Christopher Giffard
9c8b02949a 500 Series Error Handling & Stack Traces
Fixes #825

- Changes the way the error middleware is delivered in server.js, moving
  all the logic back into errorHandling.js
- Alters error logging to use console.error (probably more appropriate) instead
  of console.log
- Changes error tests to accomodate for these alterations
- Alters user-error and error hbs templates to incorporate stack traces
- Adds additional styling for error pages to accomodate stack traces
- Added logic to parse and deliver formatted stack traces

Notes:
======

- Jslint gets in the way of the regex I've got to use to parse the stack.
  (It cites 'security reasons' which are not relevant in this case.)
  I needed to add a condition to relax it at the top of errorHandling.js
- The stack trace should probably be added as a partial, but I figured it
  was out of scope for this PR.
2013-09-19 13:01:20 +10:00
Hannah Wolfe
c7a91ffff1 Removing FancyFirstChar plugin
- requires removal of most of the plugin tests
2013-09-18 19:49:10 +01:00
jamesbloomer
36f218abaf Remove temporary files when uploading images
closes #502
part of #705
- copy the files but then remove the temporary ones
- moving instead of copying was problematic due to moving across devices
- still need to convert code to using promises
2013-09-18 09:15:21 +01:00
cobbspur
713e4c0d5c Adds slashes to urls
ref issue #448

- adds slashes to urls, templates and tests

TODO

Add function to add slash to urls automatically
2013-09-17 02:39:55 +01:00
Hannah Wolfe
0021fb7a95 Save image uploads in the editor
closes #295

- Maintain a list of markers for CodeMirror which reference image codes
- Upload start triggers a selection
- Upload success replaces the selection
- No ref-style image markdown handling
- Showdown image URL handling improved at the expense of titles
- Tests updated
2013-09-16 18:08:49 +01:00
Jacob Gable
63eb9581ea Compile assets with grunt
- Made a helper called ghostScriptTags that will spit out the relevant
  script tags with version parameter; 4 unminified files in development,
  1 minified file in production.
- Added grunt concat and uglify tasks to build files into core/built
- Fixed some unit tests by making them native date objects
2013-09-15 14:06:42 -05:00
Hannah Wolfe
8d038b8bf2 One exporter to rule them all
closes #733

- Exporter will read meta data to determine the tables which are present and export all data from those tables
- Exporter figures out which version to export, rather than requiring that information
- deleted old exporters
2013-09-15 17:04:42 +01:00
Hannah Wolfe
71a92194ca Improved error messaging
closes #748

- Removed the alpha software warning
- Better error message output for the whole app - can now specify an error, a context, and a help message
- Improved invalid node version, start and stop messaging
- Listens for Ctrl+C and exits nicely
- Minor improvements to handling and errors with old DBs (temporary)
2013-09-15 13:52:58 +01:00
Hannah Wolfe
a144d677e6 Updating unit tests
- Commented out import/export tests until they are refactored
- Updating tests to ensure they create objects which conform to the new much stricter schema.
2013-09-15 00:22:16 +01:00
Hannah Wolfe
9fcc0a6ed6 Renamed currentVersion setting to databaseVersion to avoid confusion with software version 2013-09-14 22:13:59 +01:00
Hannah Wolfe
d968495996 Mass renaming of things
Conflicts:
	core/client/views/settings.js
	core/server/models/user.js
2013-09-14 21:56:07 +01:00
Hannah Wolfe
0b1ffcd1f5 Updating settings types
- issue #573, issue #632
2013-09-14 19:04:41 +01:00
Hannah Wolfe
3fab1f708a Merge pull request #728 from skattyadz/default-settings-validations
Conflicts:
	Gruntfile.js
	core/server.js
	core/server/data/default-settings.json
	core/test/unit/admin_spec.js
2013-09-14 14:37:52 +01:00
Adam Howard
3823d10c35 Restructure default-settings.json and add validations to important settings. 2013-09-14 14:29:27 +01:00
Hannah Wolfe
63d8cbb87c Unit tests require config file to be present.
Conflicts:
	Gruntfile.js
	core/test/unit/admin_spec.js
2013-09-14 14:07:05 +01:00
Sebastian Gierlinger
35a32279d9 Clean up config (drop 'env')
closes #628
- removed .env from config.js
- ghost.config() returns correct config for NODE_ENV
- removed .env[process.env.NODE_ENV]
- updated tests
- deleted users.hbs, plugins.hbs, appearance.hbs (forgot to delete in PR #649)
2013-09-14 13:14:00 +01:00
ericterpstra
e2bc5257a6 Added post-settings menu with edit permalink field
closes #370
- Added new Backbone view for post settings menu
- Moved sass styles to global.scss for post settings menu items
- Added field to change post slug (permalink) using existing slug
  validation
2013-09-13 12:36:38 -05:00
Hannah Wolfe
e9d2646997 Refactoring tests to always run as expected
closes #721

- we now have grunt test-unit for safely running unit tests.
2013-09-13 15:12:38 +01:00
Adam Howard
f6b86a98ff Fix bug preventing tags from being saved when a Post is created.
Fixes #658
2013-09-13 14:30:22 +01:00
Hannah Wolfe
7d3eb512f6 Unit tests require config file to be present. 2013-09-13 08:24:28 +01:00
Sebastian Gierlinger
212521712d Clean up config (drop 'env')
closes #628
- removed .env from config.js
- ghost.config() returns correct config for NODE_ENV
- removed .env[process.env.NODE_ENV]
- updated tests
- deleted users.hbs, plugins.hbs, appearance.hbs (forgot to delete in PR #649)
2013-09-12 15:25:58 +01:00
Hannah Wolfe
821106b5f0 Merge pull request #697 from jamesbloomer/619-image-upload-overwrites-existing-images-merge
Ensure image uploads do not overwrite if they have the same name
2013-09-11 06:51:55 -07:00
jamesbloomer
3e28803672 Ensure image uploads do not overwrite if they have the same name
closes #619
- check if uploaded image name exists in month/year path
- if unique then save
- if not unique then add -1 to the end of the name eg. image-1.jpg
- if image-1.jpg exists then increment to -2
- keep going until a unique name is found
- uses tail recursion as normal path will be to save the first filename and deep recursion will be the exception
- (the alternative of loading the names of all the files in the directory could result in a large in memory array)
2013-09-10 22:02:28 +01:00
William Dibbern
2329b34be7 Publish button fixes
Fixes #352

- Ensure publish button's default status is set in the `render`
function.
- Ensure publish button's popup arrow has animation reverted when a
status has been selected.
- Bumped up timeout in failing mocha test for exports-002.
2013-09-10 09:32:02 -05:00
Hannah Wolfe
773fe0f3d9 Further improvements to markdown implementation
closes 644

- replaced showdown's implementation of bold and emphasis with a version close to marked's
- reverted the underscore-in-word handling to only deal with 2 or more underscores & commented the test this causes to fail - this was causing problems with double underscores.
2013-09-09 22:55:32 +01:00
William Dibbern
9064914829 Added redirect to get rid of /page/1/
Fixes #592

- Added *permanent* redirect to ensure `/page/1/` isn't used and that
`/` is used instead.
- Added pageUrl helper (and unit tests) to generate client side url
fragment for blog pages conforming to the above standard.
- Updated pagination helper to use new `pageUrl` theme helper.
- Added functional tests for redirects and added scaffolding for
functional frontend tests in general.
2013-09-09 18:32:44 +01:00
Sebastian Gierlinger
1da0a15be2 Remove {{nav}} helper
closes #626
- removed nav from config.js
- removed navHelper
- removed navHelper tests
- removed core/server/filters
2013-09-09 13:00:56 +02:00
Jacob Gable
e56a0badb5 Fix FancyFirstChar nested tag content
Added some white space skipping and inner tag checking to the fancify
method.
2013-09-06 20:32:20 -05:00
Hannah Wolfe
630c03d4d4 Fixing issues with {{url}}
closes #639

Updated url helper to work
Updated tests
Changed helper.js in tests/unit to be called testUtil to avoid confusion
2013-09-06 18:23:22 +01:00
Hannah Wolfe
c469d05c46 Mail settings are per environment
closes #624

- example mail setting in development config
- updated mail module & tests
2013-09-04 16:15:21 +01:00
Hannah Wolfe
c45f911a1e Improving underscore handling
Additional changes to how underscores are handled.
This more closely matches codemirror, but is still not 100%.
2013-09-04 15:20:26 +01:00
Adam Howard
e24b5c3382 Proper settings infrastructure, allowing new features without compromising old data.
On server load, check for settings which have not been set, and apply a default value to the settings table from a JSON file.
2013-09-03 22:56:34 +01:00
Hannah Wolfe
978502579f Fixing incorrect stub in mail test
- This test was failing on macs
2013-09-03 21:57:39 +01:00
Hannah Wolfe
36874badd5 Merge pull request #587 from javorszky/iss288
Email sending with Sendgrid plus password reset
2013-09-02 15:44:48 -07:00
Hannah Wolfe
599d233be9 RSS Feed Autodetection
closes #599

- {{ghost_head}} now outputs feed link tag
2013-09-02 21:57:26 +01:00
cobbspur
e43029e894 Modified body_class helper
closes #591

- body_class helper returns archive-template class on archive pages
- added to unit tests
2013-09-02 20:13:48 +01:00
Hannah Wolfe
859e20d8a3 Merge pull request #590 from ErisDS/showdown-gfm-fix
GFM Auto-linking fixes
2013-09-02 10:58:34 -07:00
Hannah Wolfe
7570599252 Merge pull request #564 from skattyadz/tags-squashed
Add post tagging functionality
2013-09-01 17:50:21 -07:00
Hannah Wolfe
684150d36d GFM Auto-linking fixes
closes #577

- auto-linking was interfering with things that were already a link
- now checks to ensure we are not in a HTML or markdown link already
- added tonnes of new tests
2013-09-01 16:32:54 +01:00
Ricardo Tomasi
56619a87f8 Implement e-mail sending 2013-08-31 22:21:33 +02:00
Adam Howard
d90df55b75 Add post tagging functionality
closes #367
closes #368

- Adds Tag model with a many-to-many relationship with Post
- Adds Tag API to retrieve all previously used Tags (needed for suggestions)
- Allows setting and retrieval of Tags for a post through the Post's existing API endpoints.
- Hooks up the editor's tag suggestion box to the Ghost install's previously used tags
- Tidies the client code for adding tags, and encapsulates the functionality into a Backbone view
2013-08-30 16:20:22 +01:00
William Dibbern
94f262a697 Strip whitespace on titles
Fixes #469

- Added client-side trimming of title on blur if it is not already
trimmed.
- Added server-side trimming of title on 'saving' event of post model.
2013-08-30 08:04:32 -05:00
Hannah Wolfe
ab7da3f5db Pagination unit test updates 2013-08-29 17:04:42 +01:00
John O'Nolan
ce3909d6d9 Updated pagination helper with cleaner markup. 2013-08-29 16:43:47 +01:00
Hannah Wolfe
f318d164d4 Adding Github Flavored Markdown support
closes #422, issue #295

- Added GFM mode to codemirror
- Took the github.js extension for Showdown and added all useful behaviour
- Now supports strikethrough, line breaking and
  multiple underscores, and auto linking urls & emails without breaking
  definition urls
- Also added definition url handling in preparation for #295
- Added unit tests for the extentions individually and integrated with
  showdown
2013-08-29 14:32:09 +01:00
cobbspur
5c12c78d00 added url handlebars helper
closes #528

- adds method (isPost)to models index.js that returns true if content, content_raw, title and slug are valid properties
- adds url helper which checks context is post using  isPost method
- adds unit test to check a url is prefixed with  /
-adds unit test which checks for empty string if either of the 4 properties above are not present.
2013-08-26 23:58:35 +01:00
John O'Nolan
12d53dead6 Move pagination to class rather than ID
Pagination could conceivably be used in more than one place on a page (eg. both top and bottom). For that reason it should probably have a class rather than an ID.
2013-08-26 02:29:44 +02:00
Hannah Wolfe
c70dfde7e3 Agressive stripping of the model attributes
- fixes #517
- prevents this from occuring again in future with other relations
- validation function & stripping done for all models
- casper test for flow, plus validation & logged out tests
2013-08-25 18:12:27 +01:00
cobbspur
ce0f1aae46 renamed helpers to body_class and post_class
closes #508

- changed bodyclass helper to body_class and updated unit test
- changed postclass helper to post_class and updated unit test
2013-08-25 14:49:57 +01:00
Hannah Wolfe
fafead5718 Merge pull request #520 from gotdibbs/Timeouts
Patch to prevent timeouts in unit tests
2013-08-25 06:41:57 -07:00
Hannah Wolfe
c63012a678 Merge pull request #524 from cobbspur/helpers
added ghost_head and ghost_foot helpers
2013-08-25 06:41:34 -07:00
cobbspur
00d36e976d added ghost_head and ghost_foot helpers
closes #382, closes #383

 - added helper called ghost_head to insert meta data with current version of ghost
 - added helper called ghost_foot to insert script tag for jquery
 - added unit test for both helpers
 - removed trailing slash from ghost.js for 'shared' path and removed from outside of loop as it is shared on front and backend
2013-08-25 14:34:35 +01:00
John O'Nolan
8ac173aa19 Rename classes applied to {{bodyclass}} to be less generic 2013-08-25 12:06:52 +02:00
William Dibbern
ff3a9dde00 Patch to prevent timeouts in unit tests
Temporary patch for #362

- Split out database teardown and initialization so they each have their
own 2 second timeout.
- Added some test-specific increased timeouts.
2013-08-24 16:07:15 -05:00
Hannah Wolfe
60c7643a58 Merge pull request #438 from cgiffard/hbs-helper-author
Template Helpers: Added author hbs helper
2013-08-24 07:45:36 -07:00
Christopher Giffard
4397bcf86e Template Helpers: Added author hbs helper
Fixes #358

 - Altered post model to enable eager loading of author and
   user relationships
 - Fixed broken base model toJSON method, which prevented
   eager resolution of relationships (thanks @tgriesser)
 - Passes author information to template.
 - Added unit tests for author helper.
 - Added unit tests for findOne and findAll additions to Post Model
   which take into account the eager relationships

 Usage:
 `{{author}}` -- returns the full name of the post author
 `{{author.attribute}}` -- returns property of the current post author
 as described by the user model
2013-08-23 19:13:32 +10:00
Hannah Wolfe
98e4923077 Added bodyclass and postclass helper
closes #472

- filterable as array, output as string
- with unit tests
2013-08-22 21:01:20 +01:00
Hannah Wolfe
2d3e2f36b1 Merge pull request #493 from ErisDS/helpers
Added excerpt helper
2013-08-22 12:56:01 -07:00
cobbspur
3ac82f14a0 rename helpers paginate -> pagination, dateFormat -> date
closes #381

- renamed entries for dateFormat in helpers to date
- renamed entries for paginate in helpers  and unit tests to pagination
2013-08-22 20:42:54 +01:00
Hannah Wolfe
2afa81bc1e Added excerpt helper
closes #471

- strips HTML aggressively
- with unit tests
2013-08-22 15:51:30 +01:00
Hannah Wolfe
3ce7b9d251 Moving misplaced test file 2013-08-20 21:28:19 +01:00
Hannah Wolfe
5ff0a2816b Dropping !image[] & other regex fixes
closes #452

- changed keyboard shortcut to insert ![].. not !image[]
- changed regex in ghostdown to only work for ![]
- added a further regex in ghostdown to properly match for URLs inside the parens
2013-08-20 21:22:41 +01:00
Hannah Wolfe
fd33b276a0 Merge pull request #419 from jgable/postPermissions
Edit Post Permissions
2013-08-18 12:11:55 -07:00
Jacob Gable
53061a4c04 Fix multiple title slug generation
Change slug generation to not append multiple hyphens
2013-08-18 13:23:15 -05:00
Jacob Gable
bbe5105048 Edit Post Permissions 2013-08-18 12:28:05 -05:00
Christopher Giffard
e484d9224e Themes: Added truncation to hbs content helper
Fixes #256

- Developed and linked new module, downsize, for tag-safe truncation
- Altered existing content handler to accept options for truncation
- Added tests for handler

Using truncation:

{{content words=10}}
{{content characters=256}}
2013-08-07 19:45:37 +10:00
Jacob Gable
0238909281 Initial Plugin API Implementation
Implements basic functionality described in #227 for loading plugins
from a specific directory and having a specific workflow with an init()
method and a disable() method.
2013-08-05 11:15:17 -05:00
Hannah Wolfe
338109c762 Data models import, export, and reset for 002
- added line to index.js to set node_env to development if it is not set
 - fixed a small bug with the persistent notifications and used them on debug page from server side
 - added 002 files to manage export and import for 002
 - 002 import is somewhat smarter than 001, merging settings (except version), replacing user & clearing primary keys
 - added reset to models and migration, which does the down operation the same way that init does the up operation
 - import and reset clear session & redirect to login / signup
 - additional unit tests
2013-08-05 13:56:30 +01:00
Jacob Gable
d40c08218e Allow theme partials to override helper templates
Added an existence check to the loadTemplates function
2013-08-02 13:36:37 -05:00
Christopher Giffard
d72dab071c Added simple unit tests for ghostdown extensions
(RE: discussion in pull #317)

-   Unit tests enforce well formedness of ghostdown processor function
    and what it returns.
-   Ensures image markup is recognised and replaced accurately.
2013-08-01 16:04:42 +10:00
Hannah Wolfe
2b9be5376e Added functional tests for Ghost Admin UI using Casperjs
Hacky implementation of a suite of casper tests. This is here so that we can start to build up some tests.
Main thing missing is being able to simulate keypresses for CodeMirror
Making the tests run nicely with grunt, travis and be independent rather than interdependent can all come later.
- See tests/functional/base.js for full usage instructions & implementation notes
2013-07-31 08:33:28 +01:00