Commit Graph

134 Commits

Author SHA1 Message Date
Sebastian Gierlinger
088d5131cf Merge pull request #6027 from reinoudk/bp-limit
Make bodyparser limit configurable to allow for posts larger than 100kB
2015-11-17 08:25:56 +01:00
Reinoud Kruithof
e5e699ad8f Set bodyparser limit to 1mb to allow for posts larger than 100kB
closes #5998
- added bodyparser limit of 1mb in core/server/middleware/index.js
2015-11-10 11:25:24 +01:00
Sebastian Gierlinger
bf65c136ce Move Public API behind labs flag
closes #5941
- added UI to labs page
- added method to determine if full authentication is required
- updated public_api tests to enable public api first
2015-11-02 14:18:58 +01:00
Sebastian Gierlinger
f48dfb09cf Public API
refs #4180
closes #4181
- added client and user authentication
- added authenticatePublic/authenticatePrivate as workaround for
missing permissions
- added domain validation
- added CORS header for valid clients
- merged authenticate.js and client-auth.js into auth.js
- removed middleware/api-error-handlers.js
- removed authentication middleware
- added and updated tests
2015-10-22 15:28:47 +02:00
Kevin Ansfield
ff73f1af92 deps: grunt-jscs@2.1.0
no issue
- update grunt-jscs dependency
- fix deprecated `validateJSDoc` configuration
- fix numerous linting errors, including:
  - use of future-reserved `public` and `private` variable names
  - use of `[]` instead of dot-notation (especially `express['static']` and `cacheRules['x']`)
  - extra spaces in `const { run } = Ember` style constructs

One issue that did become apparent is that there are conflicting rules that prevent the use of object function shorthand such that both of these:

```
{ myFunc() {} }
{ myFunc () {} }
```

are called out due to either the missing or the extra space before the `(`
2015-10-12 19:21:16 +01:00
Hannah Wolfe
4e29d9e987 Simplify theme middleware + improve tests
refs #5286, #4172, #5888

- no need to pass blogApp around in middleware
- improve test coverage to 100%
2015-10-11 22:26:43 +01:00
Sebastian Gierlinger
f22796ff7d Add dynamic client_id/client_secret
no issue
- added ghost-admin client_id to admin
- added ghost-admin client_secret to admin
- added client.read() api endpoint
- added random generation of client_secret to migration
- removed addClientSecret method
- updated tests
2015-09-02 16:39:34 +01:00
Sebastian Gierlinger
6120d0a80f Improve middleware coverage
refs #5286
- changed auth-strategies to be testable
- added tests
2015-08-21 23:46:42 +02:00
Sebastian Gierlinger
a993f80a51 Auth tests
- added tests for authentication middleware
- changed use of auth strategies
2015-08-09 12:50:05 +02:00
Fabian Becker
c1a2601514 Middleware Refactor
- Refactor SSL middleware into separate module.
- Refactor redirectToSetup to separate module + tests
- Refactor serveStaticFile + tests
- Refactor authentication middleware + tests
- Refactor private blogging middleware

refs #5286
2015-08-04 14:53:58 +02:00
Jason Williams
b6cbd2d4bd Merge pull request #5427 from ErisDS/api-reshuffle
API mini-cleanup + 405 errors
2015-06-15 10:26:11 -05:00
Hannah Wolfe
254e0f0597 Improve API error handling
close #2757, refs #5286

- moves error formatting from api/index into errors lib
- moves error handling from api/index into its own middleware
- adds extra middleware for method not allowed which captures all unsupported routes
2015-06-15 10:08:30 +01:00
Fabian Becker
b15f1daf5a Throw 405 - Method not allowed for api routes
closes #2757
- New error MethodNotAllowed
- Throw 405 if valid path but invalid method is used is apiRouter
- Adds api base tests
2015-06-15 09:43:39 +01:00
Alex Kleissner
05e49d9a96 Move uncapitalize into its own file.
refs #5286
- Moved the logic into its own file
- Added unit tests
2015-06-10 12:21:15 -07:00
Alex Kleissner
511684c436 Moves the decideIsAdmin into its own file.
refs #5286
- Moved the function into its own file
- Added unit tests for the function
2015-06-09 14:02:22 -07:00
Hannah Wolfe
7eacd2876d Ensure middleware functions are named
refs #5091

- adds names to all middleware functions, for debugging purposes
2015-06-02 14:49:18 +01:00
Alex Kleissner
766bf99de9 Move the spam prevention into its own file.
issue #5286
- Moved the spam prevention functions into their own file
- Added unit tests for the functions
2015-05-29 08:59:29 -07:00
Hannah Wolfe
023755c566 Cache invalidate for previews
no issue

- draft updates now need to affect the preview route
2015-05-19 18:32:00 +01:00
Austin Burdine
2865662ee5 added password protection
closes #4993
- brings password protection to the frontend of blogs
- adds testing for password protection
- upgrades bcrypt-js to 2.1.0
2015-04-30 23:44:43 -05:00
Jason Williams
5cfb2e701e Allow admin app to run when active theme missing
Closes #5155
- If the theme that has been set to active is missing, set
  a default express-hbs instance on the express app and allow
  middleware processing to continue so that the admin client can
  be accessed.
- Log a warning when this happens.
- Fix issue where frontend error page was not being rendered
  correctly.
2015-04-25 20:00:04 +00:00
Hannah Wolfe
8d1e729f30 RSS Refactor with cache
refs #5091, refs #2263

- Move rss handling out of the frontend controller and into its own module
- Separate the code into logical blocks
- Wrap the generation code in a in-memory cache to prevent it being regenerated on every request
2015-04-10 21:32:14 +01:00
Hannah Wolfe
196bbfce18 Refactor sitemaps to use centralised events
fixes #5104, refs #4348, #2263

- Create a centralised event module
- Hook it up for posts, pages, tags and users
- Use it in sitemaps instead of direct method calls
- Use it for xmlrpc calls
- Check events are fired in model tests
- Update sitemap tests to work with new code
- Fix a bug where invited users were appearing in sitemaps
- Move sitemaps and xmlrpc into a directory together
2015-04-05 19:32:18 +01:00
Hannah Wolfe
4b05585631 Update express-hbs to 0.8.4
fixes #4364, refs #4439, refs #4799

- Update express-hbs to 0.8.5
- Use preventIndent option onCompile
- Update registerAsyncHelper to support passing through options when needed
2015-03-10 15:52:00 +00:00
Matt Enlow
58635b3e0a Serve files to core/built/assets/
- see core/client/lib/assets-delivery/index.js for how this is done
- Turn off ember-cli fingerprinting
- ember-cli 0.2.0; Update .npmignore
- Fallback to old version of ember-cli-sass due to lib-sass errors
- Keep ember-data at beta-14.1 until we find the dep that's breaking on snapshot.attr
- Fix release task to ignore blank lines in .npmignore
2015-03-12 15:59:02 -06:00
Matt Enlow
388a8dd3f0 Build assets with ember, and serve with ghost 2015-03-11 12:37:41 -06:00
Mark Stosberg
770317b834 Refactor: Make checkSSL unit-testable and add unit tests for it.
- Code was moved to core/server/middleware/middleware.js, which is the
  home for unit-testable middleware.

- Functional code coverage for this code also exists at:
  test/functional/routes/admin_test.js
2015-01-18 13:44:50 -05:00
Josh Vanderwillik
094d6dfc38 Make HTTPS compatible with a Ghost module
closes #4434
- Change an incorrect redirect
2015-01-17 21:23:31 -05:00
Jason Williams
d59f873aec Update dependencies
No Issue
- bluebird@2.4.2
- body-parser@1.10.0
- busboy@0.2.9
- connect-slashes@1.3.0 (remove base path option which is no
  longer needed)
- fs-extra@0.13.0
- glob@0.4.2
- passport@0.2.1
- passport-oauth2-client-password@0.1.2
- grunt-jscs@1.1.0
2014-12-25 00:22:45 +00:00
cobbspur
cbcda2faf8 Provide absolute blog url in sitemap
No issue

- Adds {{blog-url}} to sitemap.xsl
- Replaces all occurences of {{blog-url}} with absolute bkog url
2014-12-17 14:55:27 +00:00
cobbspur
7d79016af5 stop middleware converting favicon to string
closes #4658

- adds conditional to prevent favicon being processed as a string
2014-12-16 20:22:31 +00:00
cobbspur
9a0dc0be58 Adds complete url for Sitemap in robots.txt
closes #4589

- Adds {{blog-url}} to robots.txt
- Replaces {{blog-url}} with blog.url from config
2014-12-13 18:01:28 +00:00
Hannah Wolfe
818085f18c Add XSL for Sitemaps
fixes #4555

- There's no easy way to declare an XSL with the node xml module, so I
  needed to move the declarations to both be strings
- Ideally the code to serve the XSL would also be inside the sitemap
  module, but I think we need to refactor a bit to get there easily
- Added the XSL from #4559, with minor amends to make the tables and urls
  display correctly
2014-12-04 09:38:09 +00:00
Jacob Gable
2cfa18475a Generate sitemap files
Closes #623

- Add basic init and eventing scaffold
- Add sitemap-index.xml generation
- Broke out generators to individual files, added request handler
- Add page, author and tag xml files; add index mapping
- Add SiteMapManager unit tests
- Add Generators tests
- Cache invalidation headers for sitemap-*.xml
- Redirect sitemap.xml to index and rename to sitemap-index
- Handle page convert and publish/draft changes
- Add very basic functional test for route existence
- Add cache headers to sitemap routes
2014-11-30 10:49:45 -08:00
Jason Williams
1d562c8914 Add Ghost version to config object.
No Issue
- Use Ghost version value that is already loaded instead of
  reading package.json from the filesystem and parsing it on
  every call into the configuration API.
2014-11-28 18:08:50 +00:00
Fabian Becker
1d1f24d3d4 Properly server shared files
refs #3992
- Don't use path.join for URLs
- Cache robots.txt for 1h instead of 1y
2014-09-25 14:14:20 +02:00
Hannah Wolfe
e5e7488d4d Fix cache-control header for API routes
closes #4157

- adds cache-control header back to api routes
- moves cache rules object into testUtils
- adds cache-control header test to every existing API test
2014-09-25 11:06:28 +01:00
Fabian Becker
2c3abeee03 Naming cleanup
closes #4069
- Rename everything from camelCase to lowercase + dashes
- Remove usage of `server`, `app` and `instance`
2014-09-20 21:09:16 +02:00
Jason Williams
12957b1918 Adjust morgan call to avoid deprecation warning
No Issue
- Change the invocation of the morgan logging package to
  conform to the new function signature introduced in
  morgan 1.2.0.
2014-09-19 16:31:22 +00:00
Fabian Becker
9394fad6aa Have /ghost use its own express instance
closes #1961
- Refactor admin to use its own express instance
- Refactor middlewares to work with /ghost mounted admin express instance
2014-09-19 08:57:13 +00:00
Matt Enlow
a5f4fca7b2 Merge pull request #3992 from halfdan/favicon
Let Ghost serve favicon instead of using dependency
2014-09-18 18:40:22 -06:00
Fabian Becker
f2fcb5b62b Let Ghost serve favicon instead of using dependency
no ref
- Remove static-favicon dependency
- Refactor robots.txt middleware to also serve favicon
- Add ETag
2014-09-18 13:51:41 +02:00
Hannah Wolfe
aad595de7d Updating express to 4.9.2 & related packages
ref #3795

- express updated to 4.9.2
- express 4.9.0 introduced res.sendStatus() to replace res.status().end()
- we no longer need express-session, connect or cookie-parser
- body-parser, busboy, compression, express-hbs, morgan, all bumped to
  latest versions as well - there doesn't seem to be any breaking changes
2014-09-18 11:50:28 +01:00
Harry Wolff
469aaa398c Add jscs task to grunt file and clean up files to adhere to jscs rules.
resolves #1920

- updates all files to conform to style settings.
2014-09-17 21:44:29 -04:00
Hannah Wolfe
b7fdf7d872 Merge pull request #3947 from hswolff/goodbye-config-theme
Removes config.theme and restructures how theme variables are cached
2014-09-15 21:30:44 +01:00
Harry Wolff
66845def85 Moves storage module to use prototypes for inheritance and structure.
addresses #2852

- Moves storage modules to use prototypes and to create prototypes
that inherit from the base storage ctor.

- Makes storage/base conform to an all Promise interface.
2014-09-12 21:41:29 -04:00
Matt Enlow
9c0b203dce Merge pull request #3867 from hswolff/middleware-work
Makes the Ghost application more express middleware friendly.
2014-09-08 13:43:48 -06:00
Harry Wolff
2bb1b14ebd Removes config.theme and restructures how theme variables are cached
resolves #1789

- removes config/theme.js
- moves caching of theme variables to api/settings.js which is where the
rest of the settings cache occurs.  this removes the requirement of having
to push changes to cache, now it simply occurs alongside when settings
are changed.
- updates relevant tests.
2014-09-02 23:15:15 -04:00
Fabian Becker
5ab8c661ec Fix regex from #3898
refs #3898
2014-09-01 15:39:53 +02:00
Fabian Becker
a0b7941439 Restrict uncapitalise middleware for API
no ref
- Do not lowercase anything after /api/v0.1/<resource>/ to protect :key/:slug
2014-09-01 12:38:06 +00:00
Harry Wolff
8bc6a6e633 Makes the Ghost application more express middleware friendly.
refs #827

- Moves ./index to use Ghost in a similar manner to how someone uses
Ghost as an npm module.
- Allows Ghost to be cleanly mounted on another express application
on any arbitrary endpoint, all you need to customize is the mount path.
2014-08-29 17:30:16 -04:00