Commit Graph

577 Commits

Author SHA1 Message Date
renovate[bot]
82441e943d Update dependency express to v4.18.2 2022-10-10 10:29:34 +07:00
Ghost CI
b5fd02c9e8 v5.18.0 2022-10-07 16:00:53 +01:00
Ghost CI
a6177b46b5 🎨 Updated Casper to v5.3.2 2022-10-07 16:00:52 +01:00
Aileen Booker
c4188c1a9e
Added Ghost Explore in Ghost as iframe app behind feature flag (#15495)
no issue

- Added Ghost Explore screen behind alpha flag
- Moved existing /explore route to /explore/connect which we'll redirect to for outside requests
- Added iframe communication with Ghost Explore App
2022-10-07 14:32:54 +01:00
Simon Backx
7e3b41f643
Removed emailClicks feature flag (#15556)
fixes https://github.com/TryGhost/Team/issues/2028

Since link clicks became GA, some older components and templates are no longer used.
2022-10-07 14:27:57 +02:00
Daniel Lockyer
9fc830e662
Removed patch from comments-ui version
- we only need to provide the patch if we want to force Ghost to use a
  specific version
- otherwise, we can just use major.minor because we use the tilde
  versioning method
- having the patch version here just encourages you to bump it
  unnecessarily, so removing it cleans up the usage for now
2022-10-07 16:22:16 +07:00
illiteratewriter
a0ec94fbfe
Added e2e test for member.added webhook (#15554)
refs https://github.com/TryGhost/Ghost/issues/15537

- this adds an e2e test and test snapshot for the `member.added` webhook so we can prevent regressions and bugs in the future
2022-10-07 15:54:24 +07:00
Shubhadeep Das
426168f73d
Added e2e test for tag.deleted webhook (#15553)
refs https://github.com/TryGhost/Ghost/issues/15537

- this adds an e2e test and test snapshot for the `tag.deleted` webhook so we can prevent regressions and bugs in the future
2022-10-07 15:50:16 +07:00
Naz
06f6fc11a7
Cleaned up tags e2e webhook test
refs https://github.com/TryGhost/Ghost/issues/15537
refs 4110ffaa2c

- The test had minor formatting issues not worth an extra back-forth during the PR review
2022-10-07 10:20:41 +08:00
Shubhadeep Das
4110ffaa2c Added e2e tests for tag.added webhook (#15537) 2022-10-07 09:46:21 +08:00
renovate[bot]
84549838a4 Update sentry-javascript monorepo to v7.14.2 2022-10-07 08:41:20 +07:00
renovate[bot]
0370dd258d
Update dependency body-parser to v1.20.1 2022-10-06 21:20:56 +00:00
Simon Backx
9d27014aff Reverted change in post email serializer
refs d4540012dc

This was committed by accident
2022-10-06 20:16:02 +02:00
James Morris
e871aabb70 Updated the comments to 0.10.2 2022-10-06 16:39:42 +01:00
Naz
1880c7c1ec
Updated webhook post.published test
refs https://github.com/TryGhost/Toolbox/issues/320

- Added more complex mobiledoc structure in the post.published test to check for correct transformation of special purpose `__GHOST_URL__`. The snapshot has a correct URL transformation, which gives confidence it works properly
2022-10-06 17:51:14 +08:00
Simon Backx
d4540012dc Added tests for click events in the activity feed
fixes https://github.com/TryGhost/Team/issues/2018

- Includes new test fixtures for redirects and click events
- Tests if post, and links are returned in the click events
2022-10-06 11:43:39 +02:00
Daniel Lockyer
7308bb9122
Switched to accessing config loader directly
- I lowered the code coverage on the repo to the point where
  it started failing because I added a new export to the config library
- this wasn't easy to add tests for because the existing config tests
  use the loader directly and not the library export
- instead, I'm just going to make the dev script access the loader, and
  make a note to clean this up in the future when we pull out the config
  module
2022-10-06 16:25:29 +07:00
Daniel Lockyer
0bfbee5523
Fixed yarn dev --stripe ignoring HTTPS configured sites
- because the cwd of `.github/dev.js` is not `ghost/core`, it doesn't
  pick up config.local.json files, so any configuration you set in there
  isn't applied
- this meant that developers with HTTPS configured locally couldn't use
  `--stripe` because it wouldn't configure the Stripe listening URL
  correctly
- this adds an exports to the config lib to allow passing options in,
  which I then utilize to pass the directory that config resides in
- this should fix the aforementioned problem with HTTPS
2022-10-06 15:58:51 +07:00
Naz
78c97d10a6
Improved post's webhook test annotations
refs https://github.com/TryGhost/Toolbox/issues/320

- There noe "roles" attached to the post's author when the 'post.added' event is fired. Webhooks function based of the model events and differ slightly with it's output comparing to the API response. For example, in case of Posts API, there'a an additional 'findOne' call (ref.: https://github.com/TryGhost/Ghost/blob/main/ghost/core/core/server/models/post.js#L1224-L1227) before returning the post to the endpoint handler and then passing that to the output serializer.
- If we want to have 1:1 copy of webhooks outputs and API outputs, we should rethink how we rely on model event data which is never the same as API controller level data.
2022-10-06 10:50:02 +08:00
Naz
4315b21d25
Fixed note copy 2022-10-06 10:26:23 +08:00
Naz
fe1d0e44b4
Moved Ghost agent matcher to common framework
refs a499f866f3
refs d817e5830d

- The user-agent used in outgoing Ghost requests (webhooks mostly) is dependent on the Ghost version - snapshots break if the matcher is not dynamic.
- There will be a few more webhooks tests coming soon, so makes sense to have this matcher moved to a common "framework matchers"
2022-10-06 08:56:10 +08:00
renovate[bot]
57f09fc8b7 Update dependency semver to v7.3.8 2022-10-05 23:34:22 +00:00
renovate[bot]
fa7a582c78
Update dependency knex-migrator to v5.0.7 2022-10-05 15:06:09 +00:00
Simon Backx
a499f866f3 Prevented posts webhook tests from breaking on every release 2022-10-05 14:25:00 +02:00
Simon Backx
f17934a5d2 Updated snapshots for latest release 2022-10-05 14:18:29 +02:00
Daniel Lockyer
c4981a71a2
Merged v5.17.2 into main
v5.17.2
2022-10-05 18:33:12 +07:00
Ghost CI
267f1530f0 v5.17.2 2022-10-05 12:32:04 +01:00
Simon Backx
8900db8614
Fixed snapshots for Portal update
refs e86e78fb6b
2022-10-05 18:11:06 +07:00
Simon Backx
811f37e18a
Bumped used Portal version to v2.14.x
refs eac8fbfdfd
refs e7378520a0
refs https://github.com/TryGhost/Ghost/issues/14508
2022-10-05 18:11:06 +07:00
Simon Backx
41a0945592
🐛 Prevented member creation when logging in (#15526)
fixes https://github.com/TryGhost/Ghost/issues/14508

This change requires the frontend to send an explicit `emailType` when sending a magic link. We default to `subscribe` (`signin` for invite only sites) for now to remain compatible with the existing behaviour.

**Problem:**
When a member tries to login and that member doesn't exist, we created a new member in the past.

- This caused the creation of duplicate accounts when members were guessing the email address they used.
- This caused the creation of new accounts when using an old impersonation token, login link or email change link that was sent before member deletion.

**Fixed:**
- Trying to login with an email address that doesn't exist will throw an error now.
- Added new and separate rate limiting to login (to prevent user enumeration). This rate limiting has a higher default limit of 8. I think it needs a higher default limit (because it is rate limited on every call instead of per email address. And it should be configurable independent from administrator rate limiting. It also needs a lower lifetime value because it is never reset.
- Updated error responses in the `sendMagicLink` endpoint to use the default error encoding middleware.
- The type (`signin`, `signup`, `updateEmail` or `subscribe`) is now stored in the magic link. This is used to prevent signups with a sign in token.

**Notes:**
- Between tests, we truncate the database, but this is not enough for the rate limits to be truly reset. I had to add a method to the spam prevention service to reset all the instances between tests. Not resetting them caused random failures because every login in every test was hitting those spam prevention middlewares and somehow left a trace of that in those instances (even when the brute table is reset). Maybe those instances were doing some in memory caching.
2022-10-05 18:11:06 +07:00
Simon Backx
b96ff6ae4a Fixed snapshots for Portal update
refs e86e78fb6b
2022-10-05 12:52:50 +02:00
Simon Backx
e86e78fb6b Bumped used Portal version to v2.14.x
refs eac8fbfdfd
refs e7378520a0
refs https://github.com/TryGhost/Ghost/issues/14508
2022-10-05 12:47:03 +02:00
Simon Backx
e7378520a0
🔒 Prevented member creation when logging in (#15526)
fixes https://github.com/TryGhost/Ghost/issues/14508

This change requires the frontend to send an explicit `emailType` when sending a magic link. We default to `subscribe` (`signin` for invite only sites) for now to remain compatible with the existing behaviour.

**Problem:**
When a member tries to login and that member doesn't exist, we created a new member in the past.

- This caused the creation of duplicate accounts when members were guessing the email address they used.
- This caused the creation of new accounts when using an old impersonation token, login link or email change link that was sent before member deletion.

**Fixed:**
- Trying to login with an email address that doesn't exist will throw an error now.
- Added new and separate rate limiting to login (to prevent user enumeration). This rate limiting has a higher default limit of 8. I think it needs a higher default limit (because it is rate limited on every call instead of per email address. And it should be configurable independent from administrator rate limiting. It also needs a lower lifetime value because it is never reset.
- Updated error responses in the `sendMagicLink` endpoint to use the default error encoding middleware.
- The type (`signin`, `signup`, `updateEmail` or `subscribe`) is now stored in the magic link. This is used to prevent signups with a sign in token.

**Notes:**
- Between tests, we truncate the database, but this is not enough for the rate limits to be truly reset. I had to add a method to the spam prevention service to reset all the instances between tests. Not resetting them caused random failures because every login in every test was hitting those spam prevention middlewares and somehow left a trace of that in those instances (even when the brute table is reset). Maybe those instances were doing some in memory caching.
2022-10-05 12:42:42 +02:00
Naz
0bf6268091
Updated content-length header matchers
no issue

- All content-length snapshots should be using the same matcher for consistency - anyContentLength. It's more explicit about what the matcher is all about and might be useful to have content-length matchers in one place if it ever changes (the header value should be a damn digit after all, not a string!) (ref. https://www.rfc-editor.org/rfc/rfc7230#section-3.3.2)
2022-10-05 17:34:17 +08:00
Fabien "egg" O'Carroll
28de1720c1 🔒 Fixed magic link endpoint sending multiple emails
refs https://github.com/TryGhost/Team/issues/2024

Without validation it was possible to send a string of comma separated
email addresses to the endpoint, and an email would be sent to each
address, bypassing any rate limiting.

This bug does not allow for an authentication bypass exploit. It is purely a
spam email concern.

Credit: Sandip Maity <maitysandip925@gmail.com>
2022-10-05 10:28:13 +01:00
Naz
2288289ae9
Added notes for maxAge config using express.static
no issue

- The milliseconds configuration here is different to "seconds" used in the max-age header value itself and other middlewares (like CORS). It's not going to be fixed upstream, so whenever this piece of code is touched again would be smart to get our own converter from seconds to milliseconds going, or some other mechanism making max-age configuration uniform across codebase
2022-10-05 17:26:21 +08:00
Naz
320c6e0dd3
Abstracted a hacky local URL matcher
refs https://github.com/TryGhost/Toolbox/issues/320

- The URL matcher is very likely to be reused in the future, so having it abstracted away gives two benefits:
1. Central place to document hacky behavior and easier future cleanup
2. The implementer of the e2e test does not have to see the "hacky note" and just concentrate on the implementation of the test
2022-10-05 17:23:02 +08:00
Naz
d817e5830d
Added header snapshots to webhook e2e tests
refs https://github.com/TryGhost/Toolbox/issues/320

- Header snapshot matching was missing from webhook e2e tests. With a bumped version of webhook-mock-receiver it's now possible to record and match webhook request headers.
2022-10-05 17:23:02 +08:00
renovate[bot]
2c2ee81adb
Update Test & linting packages 2022-10-05 00:36:08 +00:00
renovate[bot]
8751245fa5 Update sentry-javascript monorepo to v7.14.1 2022-10-04 08:07:37 +07:00
Daniel Lockyer
44f6840a26
Merged v5.17.1 into main
v5.17.1
2022-10-03 15:42:30 +07:00
Ghost CI
f1dad0519c v5.17.1 2022-10-03 09:41:39 +01:00
Fabien 'egg' O'Carroll
1613470a8c
Used the higher of click count and open count for email open count (#15508)
fixes https://github.com/TryGhost/Team/issues/2017

We process clicks much faster than we process Mailgun events which can result in a higher click rater than open rate shown on the dashboard. This ensures that the open rate will never be lower than the click rate. This is a stopgap solution until we can get click events updating the opened_at time for email_recipients
2022-10-03 10:29:58 +02:00
Simon Backx
b80c2cd81b 🐛 Fixed broken activity feed and click filter
fixes https://github.com/TryGhost/Ghost/issues/15515

- The link relation of a member-click-event was still using the link_id as foreign key instead of redirect_id.
- The members_link_click_events table was renamed to members_click_events, but this change was not reflected in a recent change in the member model (which has the custom filters).
2022-10-03 09:52:24 +02:00
renovate[bot]
5140f8a887 Update dependency sqlite3 to v5.1.2 2022-10-03 14:21:24 +07:00
renovate[bot]
828ad5915d Update dependency postcss to v8.4.17 2022-10-03 07:38:42 +07:00
Ghost CI
a7556ad9ea v5.17.0 2022-09-30 16:00:36 +01:00
Fabien 'egg' O'Carroll
45d65663f4
Simplified link tracking related tables naming (#15480)
- Removes superfluous "link" from table names
- Fixes type definititon of dropTables util
- Updates & renames models
- Noop existing migrations to avoid unnecessary work
2022-09-29 22:08:45 +01:00
Rishabh Garg
e3600d70ef
Added referrer attribution from request context (#15499)
closes TryGhost/Team#2007

- uses request context to add referrer source and medium for a new member
- uses integration name as referrer medium if exists
2022-09-29 22:31:48 +05:30
Simon Backx
648811690a Added email click tracking
no issue

Bumped flag to GA.
2022-09-29 18:14:15 +02:00