Commit Graph

742 Commits

Author SHA1 Message Date
Peter Zimon
7a4ae08b44 Added accent color to helper
refs https://github.com/TryGhost/Team/issues/1664
2022-07-12 10:24:02 +02:00
Fabien "egg" O'Carroll
903b8a1105 Added initial comment_count helper
refs https://github.com/TryGhost/Team/issues/1664
2022-07-12 10:24:02 +02:00
Simon Backx
96504008c1 Added member API for changing enable_comment_notifications and comments_enabled setting
refs https://github.com/TryGhost/Team/issues/1664

These changes are required for Portal to be able to edit the member notification preferences for comments, and to be able to know whether comments are enabled for the site.
2022-07-12 10:24:02 +02:00
Fabien "egg" O'Carroll
6a8c6e9081 Exposed comments_enabled setting publicly
refs https://github.com/TryGhost/Team/issues/1664
This also means that themes have access to this setting
2022-07-12 10:24:02 +02:00
Hannah Wolfe
78c15933e6 Implemented soft delete for comments
refs https://github.com/TryGhost/Team/issues/1664

- comments are marked as deleted, rather than deleted completely
2022-07-12 10:24:02 +02:00
Hannah Wolfe
42fc272433 Added members permission system
refs https://github.com/TryGhost/Team/issues/1664

- the new member comments API needs members to have permissions to edit and delete their own posts
- added members as a provider, and then wired up permissible logic at the model level
2022-07-12 10:24:02 +02:00
Fabien "egg" O'Carroll
ed7ce2c00f Added initial auth frame
refs https://github.com/TryGhost/Team/issues/1664

This has no security features, we need to replace usage of "*" with the origin of
the frontend site.
2022-07-12 10:24:02 +02:00
Kevin Ansfield
fc381b7626 Added comment CRUD+Moderate permissions
refs: https://github.com/TryGhost/Team/issues/1664

- added permissions for comments, including updating test fixtures

Co-authored-by: Simon Backx <simon@ghost.org>
2022-07-08 15:46:11 +02:00
Kevin Ansfield
b88212b603 Added comments_enabled setting
refs https://github.com/TryGhost/Team/issues/1664

- comments are disabled by default, but can be enabled on any site
2022-07-08 15:46:11 +02:00
Kevin Ansfield
301ae61aa9 Added users.comment_notifications field
refs: https://github.com/TryGhost/Team/issues/1668

- temporary solution until `user_settings` table is in place
2022-07-08 15:46:11 +02:00
Kevin Ansfield
fa59286eff Added comment related fields to members table
refs https://github.com/TryGhost/Team/issues/1664

- `last_commented_at` - to be used for filtering members list in Admin
- `bio` - short field used to show a "title" or similar context alongside name when commenting
- `enable_comment_notifications` - setting for turning on/off email notification of comment replies
2022-07-08 15:46:11 +02:00
Kevin Ansfield
a78eed1799 Added comment_reports table creation migration
refs https://github.com/TryGhost/Team/issues/1664

- new table to handle moderation reports on comments. This is not a join table, so it is comment_reports, rather than comments_reports
2022-07-08 15:46:11 +02:00
Kevin Ansfield
959786b71f Added comment_likes table creation migration
refs https://github.com/TryGhost/Team/issues/1664

- new table to handle likes on comments. This is not a join table, so it is comment_likes, rather than comments_likes
2022-07-08 15:46:11 +02:00
Kevin Ansfield
799a42062c Added comments table creation migration (#14998)
refs https://github.com/TryGhost/Team/issues/1664

Field notes:

- `parent_id` - used for nested comments but will be limited to 1 level in app-level validation
- `member_id` - when a member is deleted for now the member id is kept but in the future may be removed, hence `nullable: true`
- `status` - "hidden" status will be used when a staff user hides a comment, "deleted" is used when a comment author deletes
- `html` - will store pre-sanitised html
- `edited_at` - used to show an "X edited at Y" note when displaying comments, separate to `updated_at` because changing the status would also change `updated_at` but shouldn't show the "edited at" UI
2022-07-08 15:46:11 +02:00
Daniel Lockyer
6d521cc14c Added migration for Ghost Explore permissions
- this adds permissions so the Ghost Explore integration has permission
  to access the `/explore/` endpoint
2022-07-08 11:54:31 +02:00
Daniel Lockyer
3747df1bc8
Added migrations for Ghost Explore integration and API key (#15011) 2022-07-08 09:55:58 +02:00
Rishabh
ecce576bc8 Updated sodo search script to include admin url
refs https://github.com/TryGhost/Team/issues/1665

- sodo search script only needs the admin url for fetching data from content api
- removes site url and updates the main url to use admin domain
2022-07-07 11:01:21 +02:00
Ronald Langeveld
2bf4344a63
🐛 Fixed API excerpt field issue (#15005)
* 🐛 Fixed API excerpt field issue
ref https://github.com/TryGhost/Ghost/issues/10396

This fix now allows the API user to add field `excerpt` without the need for `plaintext` as format.
Also added new tests for these functions.
* Added new logic that takes `custom_excerpt` into account if all posts gets queried.
* Removed limits in excerpt & plaintext post.
* Updated snapshot.
2022-07-06 17:57:04 +02:00
Ronald Langeveld
9e8bbc028d Revert "migrated excerpt fix"
This reverts commit 35ab123499.
2022-07-06 12:42:22 +02:00
Ronald Langeveld
f20618679a Revert "fixed linting"
This reverts commit bb509ee02c.
2022-07-06 12:42:13 +02:00
Ronald Langeveld
e8306ffa29 Revert "Revert "Updated sodo search test script with version data""
This reverts commit 7c1ef4ecd0.
2022-07-06 12:41:42 +02:00
Ronald Langeveld
7c1ef4ecd0 Revert "Updated sodo search test script with version data"
This reverts commit 7cb37d9091.
2022-07-06 12:28:10 +02:00
Ronald Langeveld
bb509ee02c fixed linting 2022-07-06 11:07:06 +02:00
Ronald Langeveld
35ab123499 migrated excerpt fix 2022-07-06 11:07:06 +02:00
Rishabh
7cb37d9091 Updated sodo search test script with version data
refs https://github.com/TryGhost/Team/issues/1665

- sodo search now includes version data in config to allow fetching css directly
2022-07-06 10:47:07 +02:00
Naz
b996eadbd4 Renamed sodo search identification attribute
refs https://github.com/TryGhost/Team/issues/1665

- The search script should be uniquiely identifiable in DOM. Previously element for portal scipt element and search element both had `data-ghost` attributes` for identification. Having `data-sodo-search` makes naming unique
2022-07-04 16:44:01 +02:00
Naz
f6b2a83761 Added sodoSearch script output from ghost_head helper
no issue

- The sodoSearch needs to be injected into rendered HTML the same way portal scripts are.
- The feature is behind a `sodoSearch` alpha flag, so the scripts are injected conditionally
2022-07-04 16:44:01 +02:00
Kevin Ansfield
3da839e80e Fixed unit tests failing on unknown helper
refs dc49871837

- added the `comments` helper to the experimental helpers list
2022-07-04 15:42:18 +02:00
Daniel Lockyer
c50658953c Renamed API canary/ folder to endpoints/
- now we only have one API version, it doesn't make sense to keep
  "canary" around
- renaming it to `endpoints/` makes more sense for this
- this commit renames the `core/server/api/canary/` folder to
  `core/server/api/endpoints/`
- it also fixes the naming in test titles and the various other places
  we relied on this
2022-07-04 11:14:37 +02:00
Fabien "egg" O'Carroll
b82dc7ae7c 🔒 Fixed RCE exploit with date helper & locale setting
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-7v28-g2pq-ggg8

A vulnerability in an upstream library means an attacker can abuse locale input
to execute arbitrary commands from a file that has previously been uploaded
using the file upload functionality in the post editor.
2022-06-14 22:50:22 -04:00
Simon Backx
a30e42404b
Added getLazyRelation model helper method (#14943)
closes https://github.com/TryGhost/Team/issues/1626

- getLazyRelation is a safer shorthand for `model.related('relationName').fetch()`
- prevents doing a `fetch` operation on a relation that is already loaded, which can cause issues when `formatOnWrite` has a custom implementation
- uses the already loaded relation if it exists, or loads the relation
- doesn't reload if already loaded
- reload is forceable using the forceRefresh option
2022-05-31 13:21:53 +02:00
Simon Backx
a051ab3b69
🎨 Reduced favicon requirements and added image formatting (#14918)
fixes https://github.com/TryGhost/Team/issues/1652
fixes https://github.com/TryGhost/Ghost/issues/13319

**Image formatting**
Added support for changing the format of images via the `handle-image-sizes` middleware (e.g. format SVG to png, jpeg, webp)

This change was required:
- Not all browsers support SVG favicons, so we need to convert them to PNGs
- We can't fit image resizing and formatting in the `serve-favicon` middleware: we need to store the resized image to avoid resizing on every request. This system was already present in the `handle-image-sizes` middleware.

To format an uploaded image:
- Original URL: https://localhost/blog/content/images/2022/05/giphy.gif
- To resize: https://localhost/blog/content/images/size/w256h256/2022/05/giphy.gif (already supported)
- To resize and format to webp: https://localhost/blog/content/images/size/w256h256/format/webp/2022/05/giphy.gif
- Animations are preserved when converting Gifs to Webp and in reverse, and also when only resizing (https://github.com/TryGhost/Ghost/issues/13319)

**Favicons**
- Custom favicons are no longer served via `/favicon.png` or `/favicon.ico` (only for default favicon), but use their full path
- Added support for uploading more image extensions in Ghost as a favicon: .jpg, .jpeg, .gif, .webp and .svg are now supported (already supported .png and .ico).
- File extensions other than jpg/jpeg, png, or ico will always get transformed to the image/png format to guarantee browser support (webp and svg images are not yet supported as favicons by all browsers).

For all image formats, other than .ico files:
- Allowed to upload images larger than 1000px in width and height, they will get cropped to 256x256px.
- Allowed uploading favicons that are not square. They will get cropped automatically.
- Allowed to upload larger files, up to 20MB (will get served at a lower file size after being resized)

For .svg files:
- The minimum size of 60x60px is no longer required.

For .ico files:
- The file size limit is increased to 200kb (coming from 100kb)
2022-05-27 16:36:53 +02:00
Simon Backx
ad349bb3a5
Removed GA feature flags (#14915)
refs https://github.com/TryGhost/Team/issues/1616

- Removed all GA feature flags
- Removed `tweetGridCard` alpha flag
- Changes to `members-api` and `members-importer` packages: https://github.com/TryGhost/Members/compare/%40tryghost/members-api%408.1.1...%40tryghost/members-api%408.1.2
2022-05-26 09:54:30 +02:00
Simon Backx
c052652559
Updated settings API to return all settings in edit endpoint (#14889)
refs https://github.com/TryGhost/Team/issues/1650

Since we introduced calculated settings, we need to return all settings when editing a setting, because those calculated settings can change.

- When editing settings, return all the settings. Previously we didn't include the calculated settings (which caused issues with admin not having up to date values for those)
- Updated Stripe <head> script to be injected based on the calculated settings

Required for https://github.com/TryGhost/Admin/pull/2405
2022-05-24 16:42:15 +02:00
Hannah Wolfe
cdb365c29d Fixed minor weirdnesses with excerpts
- remove HRs ---- and blockquote > symbols from excerpts
- we want the excerpt to not contain "markdown-like" symbols, but just be plaintext
2022-05-24 12:35:59 +01:00
Matt Hanley
eae0a6a3b9
Added products and Stripe data to exports and imports (#14873)
- The migration path from 4.x on SQLite to 5.0 on MySQL requires an export/import
- Exports don't include the Stripe info required to map members to tiers correctly on import. This change fixes that.

Co-authored-by: Simon Backx <simon@ghost.org>
Co-authored-by: Hannah Wolfe <github.erisds@gmail.com>
2022-05-20 21:13:58 +01:00
Hannah Wolfe
d6d6841186
Added benefits, offers and snippets to exporter
- These are more things that we should write an importer for
2022-05-20 20:30:55 +01:00
Matt Hanley
3471f6cca0
Updated tests 2022-05-20 20:30:55 +01:00
Naz
1cc3f66d5f Reworked preview controller output
refs https://github.com/TryGhost/Toolbox/issues/332

- With 'page' property being gone from page/post resources we need consistency across internal "preview API" too
- the handling is still hacky as we are exposing the "type" property to the preview pages, which is not exposed through Content API. this a long outstanding issue will have to be handled separately
2022-05-17 17:21:38 +08:00
Hannah Wolfe
8ec8a21b71
Renamed "client" references to "admin"
refs: https://github.com/TryGhost/Toolbox/issues/299

- renamed lots of things that reference Ghost admin as "client"
- these things make even less sense in a post core/client world
2022-05-17 09:05:44 +01:00
Naz
5abd67809d Cleaned up AMP rendering of "page" resources
refs https://github.com/TryGhost/Toolbox/issues/332

- After dropping support for `page: (true|false)` for post resources in Content API there is no need to check for `body.post.page` in the AMP renderer. Furthermore, the AMP router uses `public-post` controller that **only** returns "post" resources. This check was a redundant, unnecessary piece of logic
2022-05-17 11:39:52 +08:00
Hannah Wolfe
5090d75d96
Improved theme asset handling - permissible assets
refs: https://github.com/TryGhost/Team/issues/1633

- this makes /assets/ a more permissible folder - it can serve anything _except_ hbs files
- meanwhile the root folder becomes less permissible, and won't serve theme dev files commonly found in the root
2022-05-16 19:54:33 +01:00
Matt Hanley
09804244f5 Added newsletters table to default export
refs https://github.com/TryGhost/Team/issues/1629

- We want to export the default newsletter so that we don't lose the post<>newsletter relationship when exporting
- The newsletter_id is currently ignored in the post importer (https://github.com/TryGhost/Ghost/pull/14720) so imports won't work right now
- This change means that exports created in 5.0+ will work later on with no data loss once the importer supports it
- The counts displayed for the newsletters are a count of email records, not post records - and we don't export/import emails so the count will always be 0 after importing a newsletter
2022-05-16 17:49:25 +01:00
Hannah Wolfe
12aff14dff Removed oauth experiment
refs: https://github.com/TryGhost/Team/issues/1625

- this didn't work the way we wanted to
- removing this will free up the namespaces to start over
2022-05-16 17:37:13 +01:00
Hannah Wolfe
18cf73c3b3
Updated output logic to correctly use excerpt 2022-05-16 15:51:14 +01:00
Naz
0c097f6532 Fixed frontend rendering of page resource
refs https://github.com/TryGhost/Toolbox/issues/332

- After removing the concept of a boolean "page: true" from the page/post resources frontend resource rendering didn't have enough information to pick the correct template
- Resolved this issue through passing of additional "context" to the template picker. Something nicer should be worked on in the future, as context pattern feels dirty here.
2022-05-16 22:06:55 +08:00
Naz
44c72ddd81 Removed output of "page" filter in Admin/Content APIs
closes https://github.com/TryGhost/Toolbox/issues/332
refs https://github.com/TryGhost/Ghost/issues/10922

- The "page" attirbute has been deprecated long time ago and was kept around in the output for back compatibility reasons. With Ghost 5.0 there's no longer need to return this field or keep around any of the code supporting "page" attribute processing
2022-05-16 22:06:55 +08:00
Hannah Wolfe
9957c2a77c
Revert "Updated plaintext to be a partial doc"
This reverts commit 8f90ca949d.

- plaintext is used in search features so this is probably a bad idea
2022-05-16 10:20:26 +01:00
Hannah Wolfe
8f90ca949d Updated plaintext to be a partial doc
refs: https://github.com/TryGhost/Ghost/issues/11407

- there's no need for us to process the whole document as it's only used for excerpts
- emails need the whole document, but they're managed seprately now
- this is more efficient and means we could potentially do it on the fly 🤔
2022-05-16 09:38:16 +01:00
Hannah Wolfe
9d4d6688d8 Removed links and figcaptions from excerpts
refs: https://github.com/TryGhost/Team/issues/1609
refs: https://github.com/TryGhost/Ghost/issues/11532
refs: https://github.com/TryGhost/Ghost/issues/11407

- these don't read correctly in an excert context
2022-05-16 09:38:16 +01:00