Commit Graph

13359 Commits

Author SHA1 Message Date
Naz
d9ddc2db6a Added extra validation for some settings of array type
refs https://github.com/TryGhost/Team/issues/754
refs a7dec233ba

- Additional validation protects from problems like the ones in refed commit from even getting through to the database.
- At the moment only used notificatons and couple more settings to ensure they are arrays when passed into the API. This is to avoid making big change in settings straight away - this is a problematic area which needs cautious approach.
- Ideally in the future the list of settings to check the "array" type (and other types) should be automatically generated based on the default-settings.json (or whatever way we define settings in the db a that moment)
- There's an ugly code-tripplication going on in this change. This is a separate topic that will be addressed once we work on API cleanup.
2021-06-28 14:26:18 +04:00
Renovate Bot
4fe723cd1b Update dependency @tryghost/url-utils to v2.0.1 2021-06-28 11:25:20 +01:00
Renovate Bot
3d5beb0c2a Update dependency @tryghost/helpers to v1.1.48 2021-06-28 11:01:23 +01:00
Hannah Wolfe
d9e8d9c148
Switched to using config-url-utils in boot.js
- config now exposes a few helpful methods: getSubdir, getSiteUrl, and getAdminUrl
- we can use these directly, instead of needing url-utils
- switching this inside of the boot process allows us to move the loading of url-utils into `initCore` which happens after the server has started and the database is ready
- this moves 100ms of loading time to later in the process
- also simplifies the initial loading
2021-06-28 10:50:41 +01:00
Hannah Wolfe
081d3b3a38
Cleaned comments in boot.js
- Cleaned up some of the comments
- Added proper method signatures where appropriate
- Split initDynamicRouting out from initServices, to make that clearer to read
2021-06-28 10:43:56 +01:00
Hannah Wolfe
218df4b5a4
Removed i18n.js from the bridge
- part of our work to deprecate our broken i18n implementation
2021-06-28 09:51:39 +01:00
Naz
23367ee0bb Added test checking notifications are not editable through API
refs https://github.com/TryGhost/Team/issues/754

- `notifications` settings are part of a "core" group and should not be editable through non-internal API calls
2021-06-28 11:59:38 +04:00
Naz
3f2327c4d1 🐛 Fixed update notification showing after upgrade
refs https://github.com/TryGhost/Team/issues/754
refs https://github.com/TryGhost/Team/issues/204
refs https://forum.ghost.org/t/critical-security-notification-keeps-displaying-even-after-updating-to-the-latest-version/23673

- After Ghost instance upgrade higher than v4.3.3 the security notification should not be shown any more, as the instance is now patched and fixes the issue.
- There was no way to derive the targetted Ghost version of the notification message so had to include matching based on other unique id of the message.
- Future improvements to update check/notifications should take this inconvenience into account (e.g. introduce a special field in notifications that tracks targetted Ghost instance version)
2021-06-28 11:25:04 +04:00
Naz
c328ab781b Fixed broken boot sequence
refs 0d0e09f173
refs https://github.com/TryGhost/Team/issues/754

- As per comment on the top of boot.js:

// IMPORTANT: The only global requires here should be overrides + debug so we can monitor timings with DEBUG=ghost:boot* node ghost

- Referenced change broke the rule above and would have caused all sorts of boot problems.
2021-06-28 10:02:51 +04:00
Renovate Bot
ce3a57a8ac
Update metascraper to v5.22.4 2021-06-28 00:15:47 +00:00
Renovate Bot
10d02e8343
Update dependency eslint-plugin-ghost to v2.4.0 2021-06-24 16:43:21 +00:00
Fabien O'Carroll
b894b2a913 Added products_benefits table
refs https://github.com/TryGhost/Team/issues/804

The associative table is used to implement the many-to-many relationship
between Products and Benefits. The `sort_order` column is needed because
a product's benefits should be orderable by an admin.
2021-06-24 17:21:01 +01:00
Fabien O'Carroll
65b2e8a0a5 Added benefits table
refs https://github.com/TryGhost/Team/issues/804

Benefits are tag-like resources which will be associated with Products.
The first iteration just requires a name for the benefit, which will be
stored as plaintext.
2021-06-24 17:21:01 +01:00
Daniel Lockyer
53b7eb227b v4.8.3
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNSBfAAKCRDSEYbwtHKV
 rdNyAP9sT2e/01PE1p8l0PoTbq6nOL08BIA8ZKDiX/tFDeJ7owD9EikupgI6snND
 VrvRyA3AIZf3+hooAfjxIogX7NhUrQU=
 =Aqm+
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNSCAwAKCRDSEYbwtHKV
 rWOLAQDCheD486UqjssUUaEAjNxjoSzwvqnHSpnfRJB809eOmAEAv0UzVYM+vcJ6
 7vJdRXK2ke/dIc50n0mgRR8ktue6XAs=
 =TQTw
 -----END PGP SIGNATURE-----

Merged v4.8.3 into main

v4.8.3
2021-06-24 14:00:41 +01:00
Daniel Lockyer
80fab83cf0
v4.8.3 2021-06-24 13:58:36 +01:00
Daniel Lockyer
3729dbf17c
Updated Ghost-Admin to v4.8.3 2021-06-24 13:58:36 +01:00
Daniel Lockyer
f2ab12bb91
🐛 Fixed incorrect data returned when using API fields
refs 188de00489

- this fix was incorrect - the function should have been on the
  prototype but I'd moved it over incorrectly into the static class functions
- this commit moves `defaultColumnsToFetch` to the prototype functions
  and reverts the referenced commit back to `this.prototype` as expected
- this wasn't including the custom columns from the `post` model, which
  was causing tests to fail
- pro tip: run tests!
2021-06-24 13:47:15 +01:00
Naz
828a66748a Fixed lint errors 2021-06-24 16:36:47 +04:00
Naz
07f7a7a158 Added JSDoc to notifications service's destroy
refs https://github.com/TryGhost/Team/issues/754

- Extra type intellisense is good!
2021-06-24 16:34:29 +04:00
Naz
b5fb439ae7 🐛 Fixed version update indicator on about page
refs https://github.com/TryGhost/Team/issues/754
closes https://github.com/TryGhost/Ghost/issues/13088
refs a7dec233ba

- The corrupted data recovery mechanism for notifications is needed to be able to fix the data stored in `settings` table under `notifications` key. There was no validation in place, which has caused some instances to store data in unreadable/writable state
- The recovery mechanism is in place to avoid adding migrations every time we spot a broken notifications data (will be fixed by validation soon).
- The notification data is also NOT critical but valuable for system functioning properly, that's the reason why the data "healing" happens in less secure  "fire-and-forget" way
- The referenced commit is where the "bigger" problem that was causing the data corruption was at. This change is a "cleanup" after what has happened there - storing Ghost error object in `value` for `notifications` key
2021-06-24 16:33:01 +04:00
Daniel Lockyer
e389a6d991 v4.8.2
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNR3tAAKCRDSEYbwtHKV
 rXcMAQDQd7EcEmIx3sHlA5wjMz9SMZaybaOqLMzgCdUft2KOagD/dFtZBYpK4DLB
 Kr42XrNMVvORHNPso5lL35s9KNbTlwM=
 =OqBv
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNR4ygAKCRDSEYbwtHKV
 rXtsAQDNUqm3qK0b8/hET9h7cIG5J5RpAo0WYJWxv01DwcTscAEAjlfK3vgUo3wD
 uHeeXH+DXOIhAqSxsXoJr7X+N/s+WQw=
 =BJTH
 -----END PGP SIGNATURE-----

Merged v4.8.2 into main

v4.8.2
2021-06-24 13:21:23 +01:00
Daniel Lockyer
d4a0295792
v4.8.2 2021-06-24 13:16:52 +01:00
Daniel Lockyer
1c1f41d0e2
Updated Ghost-Admin to v4.8.2 2021-06-24 13:16:52 +01:00
Daniel Lockyer
188de00489
🐛 Fixed error when using API to search for tags
refs a457631a20

- `defaultColumnsToFetch` was moved to the CRUD plugin in the referenced
  commit, which makes it a function on `this` instead of `this.prototype`
- this means the function doesn't exist and Admin throws an error when
  you start typing in the search bar because the API 500s
- this commit switches it to `this.defaultColumnsToFetch()`
2021-06-24 13:08:05 +01:00
Daniel Lockyer
ac8029680c v4.8.1
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNRcHQAKCRDSEYbwtHKV
 rQJeAP9ufmgIztn1oj8kF7tZMZk4xaVCakqIgyQBlPvFKc+aawD8Dv44mmZ4Ntar
 7FQ52i07TCwk/b8lCUwxD4maYBuZNAE=
 =fgVN
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNRciwAKCRDSEYbwtHKV
 rRatAQCJ27vyVeGYlnXVWF0XSgj3+QEwl2eEgh4GoVp4BPzHAwD/WrGvKRvddDtA
 kiqv93vRTda3GV1R4FGYVl34MwbGFAA=
 =+Yci
 -----END PGP SIGNATURE-----

Merged v4.8.1 into main

v4.8.1
2021-06-24 11:20:53 +01:00
Daniel Lockyer
13adff145c
v4.8.1 2021-06-24 11:19:09 +01:00
Daniel Lockyer
a91a790d0d
Updated Ghost-Admin to v4.8.1 2021-06-24 11:19:09 +01:00
Daniel Lockyer
ce68b2e4a9
Reverted destroy function of CRUD plugin to chained promises
refs https://github.com/TryGhost/Team/issues/808

- see referenced issue for context, but turning this function into
  async-await seems to have broken error handling when deleting things
  that don't exist
- i'm really not sure why - but my running theory is that it's something
  to do with Bluebird Promises vs native Promises
- this should keep the same functionality until I can investigate what
  is going on
2021-06-24 10:17:40 +01:00
Daniel Lockyer
323074f106
🐛 Fixed error when deleting non-existent snippet
fixes https://github.com/TryGhost/Team/issues/809

- Bookshelf won't throw a `NotFoundError` unless `require=true` in the
  options
- this is present in most other API endpoints, so it's just simply
  missing from the snippet one
- without this, Ghost will crash with a 500 saying `Cannot read property
  'destroy' of null`
- this commit adds `require=true` to the destroy options for both the canary +
  v3 endpoints
2021-06-24 09:58:35 +01:00
Matthew Schmoyer
7bac21d591
🐛 Fix test email member uuid (#12809)
refs: #12808

- we need to use the uuid, not the id, so that e.g. unsubscribe urls are set correctly
- this is only for test emails, but it's still important to be able to test things fully!
2021-06-24 09:42:15 +01:00
Hannah Wolfe
0ef9a7e415
Added quick commands for resetting yarn
- We keep having test issues caused by yarn, these fix commands help quickly check it's not a yarn problem
- Have renamed fixmodulenotrequired to fix:client to make a nice consistent naming pattern that's easy to remember and type
2021-06-23 20:55:03 +01:00
Thibaut Patel
dc91eabe3c Moved the "Reset all passwords" permission migration to Ghost 4.9
commit f12f64e87b
2021-06-23 17:08:44 +02:00
Naz
42e11ca859 Fixed update check logging when run within a job
refs https://github.com/TryGhost/Team/issues/754

- The logging wasn't working for the update check when run from the scheduled job. Fixed package method signature to allow for "logging" parameter. The sideeffect of this change was such that we need to instantiate a new instance of the UpdateCheckService on every method call to differentiate the call from within the code (controller) or from the job level
- Also added an await before returning the check method call as it didn't execute properly on the job level - the `await` wasn't waiting for the update check to actually do it's job!
2021-06-23 18:38:05 +04:00
Hannah Wolfe
c12edf4bbd
Removed unnecessary return with typo
refs: https://github.com/TryGhost/Ghost/pull/12735

- this property doesn't exist - it should be this.resourcesConfig
- but we don't use the return value, so simply removed it
2021-06-23 14:20:00 +01:00
Thibaut Patel
f12f64e87b
🔒 Added a "reset all passwords" feature (#13005)
issue https://github.com/TryGhost/Team/issues/750

- Only accessible by admins
- Resets all staff users' passwords and prevents them to log-in
- Sends them a reset email password to give them back access to their account
- Closes all existing staff user sessions
2021-06-23 14:54:28 +02:00
Fabien O'Carroll
c46542532d Added support for importing products column
refs https://github.com/TryGhost/Team/issues/765

This supercedes the `complimentary_plan` flag, as it is more precise
because it determines _which_ product(s) a member has access to. Because
of this, if the `products` column is present the `complimentary_plan`
column is not used.
2021-06-23 13:53:34 +01:00
Fabien O'Carroll
1de88f7397 Included products when exporting member csv
refs https://github.com/TryGhost/Team/issues/765

Since Members can be given complimentary access to one of many products,
we must include which products a member has access to when exporting
from Ghost. This will allow us to reimport without losing information.
2021-06-23 13:53:34 +01:00
Fabien O'Carroll
ccd917ff8c Handled products column for CSV import & export
refs https://github.com/TryGhost/Team/issues/765

This includes the changes to @tryghost/members-csv so that we can read
and write the `product` column from/to csv files. Allowing us to include
products in exports, as well as use them in imports.
2021-06-23 13:53:34 +01:00
Fabien O'Carroll
b197d71c4e Linked comped members to default product for imports
refs https://github.com/TryGhost/Team/issues/765

As part of the multiple products feature, we're not longer using Stripe
subscriptions to denote Complimentary access, instead we're linking
members directly to products. Here we update the importer to follow
suit, so long as the flag is enabled.
2021-06-23 13:53:34 +01:00
Fabien O'Carroll
9fc69d8f07 Moved MembersCSVImporter out of index.js file
no-issue

This cleans up the importer to match the standards of the rest of our
codebase.
2021-06-23 13:53:34 +01:00
Renovate Bot
f9dab79d2e
Update metascraper to v5.22.2 2021-06-23 11:32:05 +00:00
Naz
0d0e09f173 Moved update check scheduling logic out of boot.js
refs https://github.com/TryGhost/Team/issues/754

- This is a minor cleanup. There should be no logic in the boot.js file other than calling services to "initialize themselves"
2021-06-23 15:01:43 +04:00
Naz
90cc801394 Added JSDoc and unit tests for email replacement parser
refs 474e6c4c45

- The method was not easy to understand after skimming through it.
- As we are working on developing a similar pattern for upcoming similar featured created a basic test suited to see input/output relation clearly
2021-06-23 12:00:03 +04:00
Naz
5edd056a61 Renamed bulk-email index to bulk email processor
no issue

- idex.js files are meant to expose the API of the module and not contain code
- Next step would be reworking the code to use class/injection pattern
2021-06-22 20:19:57 +04:00
Ikko Ashimine
cb9ca30f72 Fix typo in image-size.js
withing -> within
2021-06-22 15:47:41 +01:00
Daniel Lockyer
d2adc08c18
v4.8.0 2021-06-22 15:25:52 +01:00
Daniel Lockyer
d1eeee114e
Updated Ghost-Admin to v4.8.0 2021-06-22 15:25:52 +01:00
Daniel Lockyer
c0dc381c5e
Revert "Added GScan to Renovate ignore list"
refs 3f00800132

- this reverts commit 384a1d0a83.
- globally ignored in the commit referenced above
2021-06-22 15:01:48 +01:00
Daniel Lockyer
384a1d0a83
Added GScan to Renovate ignore list
refs 0d2c990013

- we've had to temporarily hold back a GScan update whilst we think
  about theme loading in Ghost
- this commit adds GScan to the Renovate ignore list so it won't
  automatically bump the package
2021-06-22 14:57:43 +01:00
Naz
0d2c990013 Reverted Added detection of conditional partials in themes"
This reverts commit bab12ca3d1.

- Revert was due to 500 errors which would come up when the Ghost instance runst in "production" mode.
2021-06-22 17:49:12 +04:00