fixes https://github.com/TryGhost/Product/issues/3738https://www.notion.so/ghost/Member-Session-Invalidation-13254316f2244c34bcbc65c101eb5cc4
- Adds the transient_id column to the members table. This defaults to
email, to keep it backwards compatible (not logging out all existing
sessions)
- Instead of using the email in the cookies, we now use the transient_id
- Updating the transient_id means invalidating all sessions of a member
- Adds an endpoint to the admin api to log out a member from all devices
- Added the `all` body property to the DELETE session endpoint in the
members API. Setting it to true will sign a member out from all devices.
- Adds a UI button in Admin to sign a member out from all devices
- Portal 'sign out of all devices' will not be added for now
Related changes (added because these areas were affected by the code
changes):
- Adds a serializer to member events / activity feed endpoints - all
member fields were returned here, so the transient_id would also be
returned - which is not needed and bloats the API response size
(`transient_id` is not a secret because the cookies are signed)
- Removed `loadMemberSession` from public settings browse (not used
anymore + bad pattern)
Performance tests on site with 50.000 members (on Macbook M1 Pro):
- Migrate: 6s (adding column 4s, setting to email is 1s, dropping
nullable: 1s)
- Rollback: 2s
closes https://github.com/TryGhost/Product/issues/4133
- we were creating a new JSDOM instance every time we rendered a card which lowered performance because JSDOM instantiation is heavy
- updated Koenig packages to remove the need for passing in an external `createDocument` option method as they now re-use the renderer's internal single instance of JSDOM
refs https://github.com/TryGhost/DevOps/issues/105
- this will run a small benchmark on the boot time for Ghost, and push
the stats to another repository which has GitHub Pages enabled, so we
can visualise the change over time
- will only run on pushes to `main` so we don't pollute the stats with
commits from PRs
- just a test for now to see if we get stable numbers
no issue
- Currently our stack traces in Production include the admin build
version in the paths, e.g. `/admin/1633/assets` instead of
`admin/assets`
- This confuses the error grouping logic in Sentry, resulting in many
duplicate issues being created every time we release a new version of
admin
- Ultimately, this makes it really difficult to determine if a 'New'
issue in Sentry is actually new, or if it's just the first time we've
seen it in this release.
- This commit adds the `RewriteFrames` integration to the Admin Sentry
client, which will strip the build version from the paths in the stack
traces, and allow Sentry to group issues correctly.
- With this, hopefully we will have far fewer 'New' issues created, so
we can again start alerting on the 'New' condition in Sentry.
closesTryGhost/Product#4136
- the `/p/` route is only intended for drafts, not published content
(e.g. sent newsletters)
- email-only posts (newsletters) do not get assigned a slug, and could
still be viewed at `/p/:uuid`, which didn't hide paid/member content
Got some code for us? Awesome 🎊!
Please include a description of your change & check your PR against this
list, thanks!
- [ ] There's a clear use-case for this code change, explained below
- [ ] Commit message has a short title & references relevant issues
- [ ] The build will pass (run `yarn test:all` and `yarn lint`)
We appreciate your contribution!
---
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 3389126</samp>
Improved the Slovak translation of the Ghost blog demo by adding a
fictional author name and correcting a grammar error in `comments.json`.
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 79cfdef</samp>
This change adds a new translation for the comments feature in Ghost in
the Indonesian language. It is part of a larger effort to update and
improve the localization of the comments feature in different languages.
fixes https://github.com/TryGhost/Product/issues/4108
- Updates filters behind a new alpha feature flag so you can also filter
on members who have email disabled (because the email had a permanent
bounce, they reported spam or the email address is invalid)
- When returning members, we now also use the email_disabled flag to set
email_suppression.suppressed correctly (in case they are out of sync,
which should normally never happen).
closes https://github.com/TryGhost/Product/issues/4075
- when a member clicks on "Unsubscribe from that list" from Apple Mail,
the member's email is put into Mailgun's Unsubscribe suppression list.
Ghost listens for "Unsubscribe" events from Mailgun, and unsubscribes
the member from all the newsletters
- now, the member is only unsubscribed from the newsletter they
unsubscribe to (not all of them)
- now, the email is also deleted from Mailgun's suppression list, so
that it doesn't affect any other membership
fixes https://github.com/TryGhost/DevOps/issues/99
- this inlines the `monobundle` script into the monorepo from an
external repo in order to avoid some caching issues we've seen
- it also makes it easier to maintain because you can change the script
alongside changes in the monorepo
closes https://github.com/TryGhost/Ghost/issues/18949
- added check for `isComposing` in Enter key handler to avoid the move-to-post-body behaviour when the Enter keypress is used to end IME composition
---------
Co-authored-by: t8m8 <tomomasa.matsunaga@gmail.com>
refs https://ghost.slack.com/archives/CTH5NDJMS/p1699359241142969
It's possible for `ObjectIDs` to have only numeric characters. We were
previously letting the type be inferred, which created a very rare but
possible edge case where the last recipient of an email batch had a
numeric ObjectID, resulting in a numeric comparison against alphanumeric
`ObjectIDs` in the database.
- updated the filter to add `'`'s around the `lastId` parameter
- updated tests to check for the type of the id filter parameter value
- can't fully test for numeric object IDs using what we have because
javascript cannot handle numerics of that size; may be able to look at
using fixture data loaded directly into the db
refs https://ghost.slack.com/archives/CTH5NDJMS/p1699359241142969
It's possible for `ObjectIDs` to have only numeric characters. We were
previously letting the type be inferred, which created a very rare but
possible edge case where the last recipient of an email batch had a
numeric ObjectID, resulting in a numeric comparison against alphanumeric
`ObjectIDs` in the database.
- updated the filter to add `'`'s around the `lastId` parameter
- updated tests to check for the type of the id filter parameter value
- can't fully test for numeric object IDs using what we have because
javascript cannot handle numerics of that size; may be able to look at
using fixture data loaded directly into the db
no issue
- The fingerprinting on chunk files was happening twice (once by ember
and once by webpack), resulting in the .js file and the .map file not
matching
- This change prevents ember from fingerprinting the chunk.*.map files,
so the resulting .map and .js files will have the same basename
- No real functional difference here, just a bit easier to find the
corresponding .map file for a given .js file
no issue
- ember-cli-terser 4.0.2 apparently has a regression that breaks the
sourcemap generation for the admin ember app
- this reverts the package to 4.0.1, which fixes the sourcemaps and
should generate much more readable stack traces in Sentry
- Validating the sourcemaps locally succeeded, but will need to test
this on staging to confirm everything is working properly in CI and with
the CDN.
refs https://github.com/TryGhost/Product/issues/4095
- Removes `min-height` of the card in order to make the template more
flexible half-empty states look better (missing description, short
description, featured image...)
- Fixes wrong variables used in Outlook-specific template
fixes https://github.com/TryGhost/Product/issues/4118
The newsletter uuids were not passed when fetching all the members current newsletters. Therefore, Portals logic broke to remove all newsletters that matched the uuid that was passed to the unsubscribe link. No newsletters were removed, still the notification toast said that the member was unsubscribed from the newsletter.
refs https://github.com/TryGhost/Product/issues/4086
- we're seeing random test timeouts on CI but not locally, these logs should help pinpoint if it's the require that's taking a long time, the conversion itself, or something else entirely
refs https://github.com/TryGhost/Product/issues/4098
- added basic metadata (title, description, image, url) on the password
wall for private sites
- when a private site recommends me, I can now see the usual metadata
ref https://github.com/TryGhost/Product/issues/4110
Made this change to increase clarity in data export
---
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 6c0508d</samp>
Renamed a column in posts export data and updated the corresponding test
case. This change makes the export data more consistent and clear for
users who have different member features enabled.
refs https://github.com/TryGhost/Ghost/pull/18587/files and
https://github.com/TryGhost/Ghost/pull/17475/files
- In October 2022, `juice`, a library Ghost uses to inline CSS for email
rendering, introduced a small change that began inlining `width: auto`
and `height: auto` from CSS on image tags, resulting in `width="auto"`
and `height="auto"` attributes being added to image tags in rendered emails
(cb62062794)
- This change in `juice` broke our email rendering in Outlook, which
doesn't play well with `width="auto"` attributes. The first two attempts
to workaround this new behavior in `juice` ended up fixing the issue in
Outlook, but breaking the rendering in other clients
- This commit stores the `height` and `width` attributes of all images
_before_ inlining the CSS with `juice`, and resets them to their
original values, only if they were set to `auto`
refs https://github.com/TryGhost/Ghost/pull/18587/files and
https://github.com/TryGhost/Ghost/pull/17475/files
- In October 2022, `juice`, a library Ghost uses to inline CSS for email
rendering, introduced a small change that began inlining `width: auto`
and `height: auto` from CSS on image tags, resulting in `width="auto"`
and `height="auto"` attributes being added to image tags in rendered emails
(cb62062794)
- This change in `juice` broke our email rendering in Outlook, which
doesn't play well with `width="auto"` attributes. The first two attempts
to workaround this new behavior in `juice` ended up fixing the issue in
Outlook, but breaking the rendering in other clients
- This commit stores the `height` and `width` attributes of all images
_before_ inlining the CSS with `juice`, and resets them to their
original values, only if they were set to `auto`
no issue
- we don't use `<i>` elements anywhere in our own code and this styling was causing odd in-editor previews of HTML cards when their content contained `<i>`
no issue
---
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 474a274</samp>
This pull request fixes a timezone display bug in the admin and post
settings. It also updates the `publishing.spec.js` file to test the
timezone functionality with a consistent option.
refs https://github.com/TryGhost/Product/issues/4055
---
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 3b24693</samp>
Removed unused components related to announcement settings, custom theme
settings, and file upload. These components were part of a deprecated
feature or a legacy UI.
no issue
When a custom welcome page is set for a tier, the recommendations modal
didn't show. If recommendations were disabled, there was also no toast
to confirm the sign up.
To fix this, we'll need to set the success and action query parameters
on the welcome page, but only if it is not an external site.
fixes https://github.com/TryGhost/Product/issues/4102
E.g. you recommend myghostsite.com, while that site redirects all
traffic to [www.myghostsite.com](#):
The redirect causes CORS issues, which means we cannot detect
one-click-subscribe support.
- This is fixed by moving the whole detection to the backend, which has
the additional benefit that we can update it in the background without
the frontend, and update it on every recommendation change.
- This change also fixes existing recommendations by doing a check on
boot (we can move this to a background job in the future).
no issue
- Somewhere along the process of building the admin app, the sourcemaps
are getting corrupted
- This commit is to test the theory that babel is the source of the
corruption, because it isn't generating sourcemaps, so we are missing a
step in the process
no issue
- The sourcemaps currently generated by the admin build do not include
the `sourcesContent` key
- This commit is to experiment with this change, in particular to see if
it improves the stacktraces available in Sentry from errors in the admin
app
- Currently the stacktraces in admin show the minified code — hopefully
this change will make the stacktraces show the original source code to
make it easier to debug issues from within Sentry
- Might thoroughly break the sourcemaps, in which case I will revert this
no issues
- The `path` tags added to Sentry events from admin aren't super useful, since they often include e.g. a
post id in the path, which isn't super useful for filtering/grouping
- We already have a `route` tag which can be used to filter to a
particular route, which renders the `path` tags unnecessary
no issue
- Follow up to
a382cd8a91
and
fb34e285fc
- The `sourcemap-postprocess` addon was ineffective because the assets
were being copied to `/ghost/core/core/built` before the addon was run,
so the changes weren't being applied in staging/production
- This change makes the required modifications to the sourcemaps before
copying them
refs https://github.com/TryGhost/Ghost/pull/18816
When opening a new post in the editor and immediately leaving we would hang because we attempted to save a revision rather than just throwing the blank post away.
- added additional `hadDirtyAttributes` check to the forced-revision save when leaving
- added additional destroyed post checks to the save task to avoid saving a deleted post when leaving the editor
- removed unnecessary waits for save tasks that prevented leaving the editor when the title on a new post had been filled in but not saved (matches previous editor behaviour)
closes https://github.com/TryGhost/Product/issues/4046
- when editing the member's email in Admin, the email_disabled field was
not recalculated, making it inconsistent with the suppression list
- now, if the new email is part of the suppression list, we set
email_disabled to true. Otherwise set it to false
closes https://github.com/TryGhost/Product/issues/4098
- when a site is private, the metadata title is "My Site — Private Site
Access". When fetching the metadata via oembed, we get "Private Site
Access" as publisher, and "My Site — Private Site Access" as title
- this fix removes "- Private Site Access" from the metadata title when
a Ghost site is private
no refs
Fixed error caused by uploading empty redirects YAML file:
```
Cannot read properties of undefined (reading '302')
```
This error was occurring due to `yaml.load` returning `undefined` when
the provided yaml file was empty. I've made the check on the return
value of `yaml.load` stricter (i.e we only want an `object`) to prevent
this error from occurring.
no issue
- product card outputs the original width/height of the image in emails
which results in overflown images in Outlook
- Combined with https://github.com/TryGhost/Koenig/pull/983/files, this
change fixes rendering for product card images in Outlook
---------
Co-authored-by: Sodbileg Gansukh <sodbileg.gansukh@gmail.com>
no issue
- Follow up to https://github.com/TryGhost/Ghost/pull/18825
- Adding the sourceRoot key didn't seem to work, so I'm just removing
the `assets/` prefix from all the sources to hopefully correct the issue
no issues
- Added isAjaxError tag to all errors sent from admin with a true/false
value
- Removed all Ajax context and tags if the error is not an Ajax error
- Updated names of Ajax tags to use camelcase instead of dot notation
closes https://github.com/TryGhost/Koenig/pull/1038
- updated `<KoenigLexicalEditorInput>` to load `<EmojiPickerPlugin>` and compose it into the editor unless used with `<KoenigLexicalEditorInput @emojiPicker={{false}} />`
- bumped Koenig packages so `EmojiPickerPlugin` is available to import from `koenig-lexical`
no issue
- Currently AJAX errors that surface in Admin get logged to Sentry with
super generic messages like "Error"
- This commit adds more context to the information that's sent to sentry
and should make it easier to identify the error at a glance
refs TryGhost/Product#4083
- In the vast majority of cases, we shouldn't have SQL errors in our
code. Due to some limitations with validating e.g. nql filters passed to
the API, sometimes we don't catch these errors and they bubble up to the
user.
- In these rare cases, Ghost was returning the raw SQL error from mysql
which is not very user friendly and also exposes information about the
database, which generally is not a good practice.
- To make things worse, Sentry was treating every instance of these
errors as a unique issue, even when it was exactly the same query
failing over and over.
- This change improves the error message returned from the API, and also
makes sure that Sentry will group all these errors together, so we can
easily see how many times they are happening and where.
- It also adds more specific context to the event that is sent to
Sentry, including the mysql error number, code, and the SQL query
itself.
no issue
- The sourcemaps generated for the admin app use relative links to the
source code files e.g. `assets/ghost.js`
- Since the sourcemaps themselves are hosted at `/assets` already, this
was leading to issues with sourcemaps in Sentry and in the browser
looking for the sources at `/assets/assets/ghost.js`
- This commit adds a `sourceRoot` key to the sourcemaps, which should
allow Sentry and the Browser to find the source code files at
`../assets/ghost.js` instead of `assets/ghost.js`
- We may need to iterate on this — not 100% sure if this is the best way
to do this without trying it in staging. If the `../` doesn't work in
all environments, we can try including the CDN url directly
refs https://github.com/TryGhost/Product/issues/4088
The Content API should not expose the lexical/mobiledoc source content because it's not membership-gated and although not used at the present time may in future contain additional internal metadata. We were handling this for the more-typical `?formats` param but it was still possible to access this data using the `?fields` param.
- updated post mapper used in our API output serializers to strip the `mobiledoc` and `lexical` fields ready for API output
- credits to Prathap Puthran for reporting
closes https://github.com/TryGhost/Product/issues/4059
- modified `saveTask` so when it has the `leavingEditor` option it doesn't attempt to set a new post status
- save when leaving the editor is never a publish/unpublish-related event, rather it's a convenience autosave and a forced revision creation so modifying the post status should never happen for those saves
- updated the `willTransition` handling to avoid repeated saves
- sets a property on the controller whenever we attempt a save+transition retry on leaving the editor then skips any further attempted saves on transitions
- although it would be preferable we can't use `try/catch` on these saves because our save task always catches and doesn't re-throw, adjusting that would be a much larger change than we want to make for this fix
fixes https://github.com/TryGhost/Product/issues/4085
Increases the performance for the post analytics export by adding new
indexes. These indexes are used when counting the amount of (paid)
subscribers that were attributed to a given post. With the indexes, the
time required to export 700 posts with 300k members decreases from 40s
to 0.6s.
Tests show that adding these indexes should be very fast (< 1 s) if the
tables contain up to 300k rows.
no refs
- This enables supplying a username to connect to redis with when connection to an individual node rather than a cluster.
- It also allows for extra options to be given to the ioredis store used in the background.
closes https://github.com/TryGhost/Product/issues/4084
---
### <samp>🤖 Generated by Copilot at 9380e1f</samp>
This pull request adds a new UI for creating and managing offers for
members in the admin settings, which is controlled by an alpha feature
flag. It introduces new modal components for the offers UI, a new
sidebar item, new routes, and a new setting group. It also updates the
`labs.js` file to include the `adminXOffers` flag.
no refs
As part of the reduce Sentry noise work we decided to temporarily
prevent the submission of "handled" errors to Sentry. This is a
temporary measure to reduce noise while we work on improving the quality
of the error reporting / alerting
no issue
- All events sent from Admin should now be tagged with the current route
(e.g. `lexical-editor.edit`) and the path (e.g.
`editor/post/65388d98734d6ecc7bbafb87?test`)
- This will allow us to filter events by route and path in Sentry and
improve our alerting logic
no issue
- This change enables the Debug integration in Sentry when the app is
running in development mode (and Sentry is configured with a valid DSN).
- Whenever an event is sent to Sentry, the event & hint are passed to
the beforeSend() function will be logged to the browser console so you
can quickly see a) when events are sent to Sentry and b) exactly what
data & tags are sent with integration
no issue
- Unfortunately the RewriteFrames plugin was not successful in fixing
the duplicated `/assets/assets` in the Sentry stacktraces for admin
- This commit removes the RewriteFrames plugin and reverts the changes
so there will at least be some kind of source code reaching Sentry
no issue
- For whatever reason, our Sentry stack traces are adding an extra
`/assets` to the filenames in stacktraces from admin
- Attempted to fix this
[here](3e9ee16ffb)
but it didn't work because at this point the duplication hasn't occurred
yet
- This change strips the `/assets` segment from the filenames, so when
Sentry adds it back in, it doesn't duplicate anything. Would be good to
get to the bottom of why this is happening, but this should hopefully
improve our stacktraces in Sentry in the meantime.
no issue
- Our stack traces in Sentry are pointing to the wrong location for source code files. We attempted to fix this [here](https://github.com/TryGhost/Ghost/pull/18773) but this didn't work as expected in staging for some reason
- This commit just adds a few console logs to help with debugging in staging so we can figure out what's going wrong
fixes https://github.com/TryGhost/DevOps/issues/94
- we've seen in production that some filepaths contain a duplicate
assets folder, but we're not sure why
- instead of spending too much time trying to figure that out, we can
just fix that in preprocessing by using the RewriteFrames integration
in Sentry
- this should remove the duplicate folder from the stacktrace frame, if it exists
- resolves `DeprecationWarning: In future versions of Node.js, fs.rmdir(path, { recursive: true }) will be removed. Use fs.rm(path, { recursive: true }) instead` in tests
fixes https://github.com/TryGhost/DevOps/issues/91
- this adds a CI job that will run i18n tests if any of the packages
that use it have changed
- this helps prevent translations from going out of sync
refs TryGhost/Product#4064
- In Sentry we were seeing the error "Discarded unknown attribute 'user.role'" for most events sent from admin
- This small change removes this error in Sentry and restores the user.role tag for error events in admin
refs https://github.com/TryGhost/Product/issues/4053
This adds the feature flag. If enabled, the list-unsubscribe header
should be set. The value currently is only for testing purposes and
probably won't work yet.
Quick typo fix line 4, "aanmedling" -> "aanmelding"
Got some code for us? Awesome 🎊!
Please include a description of your change & check your PR against this
list, thanks!
- [ ] There's a clear use-case for this code change, explained below
- [ ] Commit message has a short title & references relevant issues
- [ ] The build will pass (run `yarn test:all` and `yarn lint`)
We appreciate your contribution!
---
<!-- Leave the line below if you'd like GitHub Copilot to generate a
summary from your commit -->
<!--
copilot:summary
-->
### <samp>🤖 Generated by Copilot at 280cadb</samp>
Fixed a typo in the Dutch translation of a sign up message in
`ghost/i18n/locales/nl/ghost.json`.
no issue
- flag is no longer used in Admin so we can clean it up in Core too
- updated Post model to set blank document to `lexical` field rather than `mobiledoc` as a default value
- switched over to returning `mobiledoc,lexical` as default formats in Admin API
no issue
- updates `@tryghost/koenig-lexical` with indent improvements
- prevents indents on paragraphs/headings etc which are not supported when rendering for front-end display
- improves indent behaviour for lists so <kbd>Tab</kbd> can be pressed anywhere in a list item to indent rather than only at the beginning of the list
closes https://github.com/TryGhost/Product/issues/4037
- bumps `@tryghost/kg-html-to-lexical` that includes better node normalization to handle `<br>` in top-level text nodes and after a nested block-level element
- also includes fix for button hrefs having `about:blank` prefixed to hash URLs
refs https://github.com/TryGhost/Product/issues/3831
---
### <samp>🤖 Generated by Copilot at 539c2d3</samp>
This pull request updates and adds some test cases for the date picker
and newsletter features in the Ghost admin panel. It introduces a test
helper function for the date picker in `editor-test.js`, and removes a
redundant test case from `publish-flow-test.js`. It also adds two new
test cases in `publishing.spec.js` using the Playwright framework to
verify the timezone and recipient settings for publishing posts.
closes https://github.com/TryGhost/Ghost/issues/18448
- improved slash menu positioning when opening at the bottom of a post
- fixed backspace sometimes deleting a preceding card (e.g. backspace at end of link inside a paragraph preceded by a card)
- fixed `?source=html` issues
- images not rendering in front-end output after import
- images wrapped in links losing their link after import
- fixed inline styles in HTML card content not displaying in the editor
- fixed broken help link in the email card
no issue
- Casper and Source theme files were out of date — this commit updates the theme fixtures, and fixes up a few tests to pass with the updated themes
Now complete (comments.json, ghost.json, portal.json, and
signup-form.json) Croatian language translation.
Co-authored-by: Daniel Lockyer <hi@daniellockyer.com>
Co-authored-by: Ryan Feigenbaum <48868107+royalfig@users.noreply.github.com>
closesTryGhost/Product#4032
- the api flag ?convert_to_lexical converts a mobiledoc string to
lexical
- if run on a post/page with lexical content, would null it out
- this optimizes the number of `get` calls we need to do to the adapter
for settings cache
- for example, this prevents ~187 calls to the adapter during boot
- right now we use the in-memory adapter for settings, so there's probably
not much benefit, but if we ever switch to the Redis adapter, this will
help prevent a lot of extra Redis calls
no issue
Some flaky tests found, and it seems as though they're being caused by an invalid Stripe account id.
It's possible that by re-using the worker after a test which calls `setupStripe` could cause some Stripe functionality to not work.
