Commit Graph

8893 Commits

Author SHA1 Message Date
kirrg001
f8b62a063b Removed more unused fields from Admin API v2 response
refs #10438

- these fields are not used
- no need to expose them in v2
- we will either remove them in the next major or use them for new features (will see)
2019-02-13 11:42:08 +01:00
Fabien O'Carroll
a3e7a7b3ea
Updated product hashseed to be hardcoded (#10484)
no-issue
2019-02-13 11:19:43 +01:00
Fabien O'Carroll
5472aa61ac
Added config endpoint to Member API (#10467)
no-issue

* Added getPublicConfig method to stripe payment processor
* Added getPublicConfig method to subscriptions service
* Added initial config endpoint for members api
* Added getConfig method to members gateway
2019-02-13 10:12:15 +01:00
kirrg001
36547a9c3a Removed ghost_auth_id from Admin API v2 response
refs #10438

- unused field
- no need to expose this field
2019-02-12 23:36:42 +01:00
kirrg001
db148e653f Removed tag.parent from Admin API v2 response
refs #10438

- this is an unused field
- no need to expose this field
- if we start working on nested tags, this field might become interesting/used
2019-02-12 19:26:31 +01:00
Nazar Gargol
20300cf002 🐛 Fixed error when inserting unexistent related tag
refs #10438

- Additional check for present 'name' property before generating a
'slug'. Setting slug should not succeed and throw validation error in later
stages.
2019-02-12 17:50:51 +00:00
Nazar Gargol
d0d299285c Fixed tests for post input serialization
refs #10472

- Moved config related variable into function scope, so it can be reset by unit tests
- e47d1e275f broke the build and is being fixed by this commit
2019-02-12 12:04:18 +00:00
Rish
7a6375f931 Version bump to 2.14.1 2019-02-12 16:36:32 +05:30
Rish
a20202db7d Updated Ghost-Admin to 2.14.1 2019-02-12 16:36:32 +05:30
Rish
7d3e1aa00b Upgrading Casper to 2.9.2 2019-02-12 16:31:41 +05:30
Nazar Gargol
e47d1e275f Fixed image URL to be stored as relative in mobiledoc
refs #10477
closes #10472

- Adds transformation for any asset absolute URL's into relative used in mobiledoc
2019-02-11 19:20:16 +00:00
Fabien O'Carroll
21e6242498
Removed unused greenkeeper config (#10479)
refs #9441
2019-02-11 20:16:23 +01:00
Fabien O'Carroll
bc59465b39
Updated .gitignore to remove tracked files (#10478)
refs #9441 

Removes these files from ignore:
- content/themes/casper
- core/server/public/ghost-sdk.min.js
- core/server/web/admin/views/.gitkeep
2019-02-11 18:32:19 +01:00
Hannah Wolfe
bcfe2c3686 Updated Security.md w/ ref to improved docs
- We have improved our vulnerabiltiy reporting procedures and docs
- These now live in a centralised place, and will be linked to from our main public repos
2019-02-11 16:40:29 +00:00
Hannah Wolfe
ba9398fdd8 Updated / simplified contributing.md
- Make our policy on what gets merged a little clearer
2019-02-11 16:38:59 +00:00
Fabien O'Carroll
92621159a6
Errored if grunt master run in dirty working directory (#10476)
refs #9441 

* Refactored master script
* Added check for working directory
2019-02-11 17:25:25 +01:00
Fabien O'Carroll
bdd57b36cf
Moved grunt-eslint to npm script executing eslint (#10474)
refs #9441

* Updated top-level ids to use const
* Removed one layer of indentation
* Added .eslintignore files for server and test tasks
* Added npm scripts for eslint
* Fixed lint command in w/ grunt
* Uninstalled grunt-eslint
* Added eslint config
2019-02-11 13:26:06 +01:00
Nazar Gargol
6e0409d6db Bumped ghost-ignition version
no issue
2019-02-11 12:18:29 +00:00
Fabien O'Carroll
986c6d1f07
Removed minimist dev dependency (#10475)
refs #9441
2019-02-11 13:16:09 +01:00
Kevin Ansfield
aa1b9574ab Updated oembed providers list
no issue
- switch away from forked version of `oembed-parser` - our changes are merged upstream
- latest `oembed-parser` has a newer version of the providers list
2019-02-11 12:13:33 +00:00
Fabien O'Carroll
8e75267bbb
🐛 Allowed data to be read from root of specified key for static pages (#10449)
refs #10434
2019-02-11 12:43:01 +01:00
kirrg001
38705ef91c Removed test from request_spec.js
no issue

- the test fails randomly, not sure why
- the test is not important, just removing it
2019-02-11 12:11:23 +01:00
Kevin Ansfield
6bae5e3c4c Added yarn fixmodulenotdefined dev task
no issue
- sometimes the Ghost-Admin build will succeed but show a `module is not defined` error. The only fix we've found so far is a computer restart (most reliable) or to clean the yarn cache and re-install the admin dependencies
- adds `yarn fixmodulenotdefined` that:
  1. runs `yarn cache clean`
  2. changes to `{ghost}/core/client` then deletes `node_modules`, `tmp`, and `dist`, before re-installing dependencies with `yarn`
  3. changes back to `{ghost}/`
- after running the command you'll need to run `grunt dev` or similar again
2019-02-11 10:44:42 +00:00
Nazar Gargol
d299e8676f Fixed JSON Schema validation error message format
refs #10438
2019-02-08 12:17:39 +00:00
Nazar Gargol
28986b3b77 Fixed post.tags validation schema
refs #10438

- Change oneOf to anyOf to allow any of the required fields
2019-02-08 11:29:42 +00:00
Nazar Gargol
96cdde80b9 Fixed validation error when creating new tag from PSM
refs #10438

- Expanded required fields for related tags to have either one of 'id', 'slug' or a 'name' field
2019-02-08 11:02:18 +00:00
Naz Gargol
19643c75dd
Added JSON Schema validation for /posts endpoint (#10468)
refs #10438

- Added  validation helper based on JSON schema
- Added schema validation for POST/PUT in /posts endpoints
- Refactored existing authors validation test suite
- Extended test coverage with a minimally required structure of post.add validator
2019-02-08 10:40:58 +00:00
kirrg001
e1436e2985 Required "event" & "target_url" for webhook creation
refs #10461
2019-02-07 23:21:59 +01:00
kirrg001
f8a286869a Allowed POST & DELETE webhooks endpoints for integrations
refs #9865

- was not sure about allowing to edit webhooks
2019-02-07 23:14:27 +01:00
kirrg001
b83232bf0c Added more webhooks & changed payload
refs #10461

- do not break the existing webhooks by keeping both payload formats for subscribers events
- refactored webhooks service to run models through target API version
- added new events described in the target issue reference
- this refactoring & enhancement is undocumented, further breaking changes will happen because we are actively working on: https://github.com/TryGhost/Ghost/issues/10438
2019-02-07 23:14:27 +01:00
kirrg001
a83aa6e184 Added ability to receive toJSON format of previous attributes
refs #9248

- e.g. model.toJSON({previous: true})
- includes previous relations
2019-02-07 23:14:27 +01:00
kirrg001
6616cfe617 Fixed triggering bookshelf event twice
no issue

- bumped bookshelf-relations
- IMO this bug is not critical, because our event listeners should be protected to run twice
2019-02-07 22:10:12 +01:00
kirrg001
50da5d9bab Corrected debug in base model
no issue
2019-02-07 22:08:52 +01:00
kirrg001
7810140f15 Avoided site.changed event if nothing has changed
refs #10461
2019-02-07 22:08:36 +01:00
kirrg001
82c5fc7f5a Ensured API can ask model.wasChanged
refs #10461

- the model layer (only post & user) fetches the model after update
- i assume it was added to ensure a response with all fields
- quick fixing it for now to ensure API layer can access ".wasChanged" to be able to decide if a request modified a resource or not

@NOTE: Bookshelf does not physically update a resource if nothing has changed.
2019-02-07 22:07:13 +01:00
kirrg001
4fca28e643 Made use of model.wasChanged
refs #10461
2019-02-07 22:06:13 +01:00
kirrg001
a157c147af Added model.wasChanged helper
refs #10461

- helpful if you need to ask if the model was changed
- Bookshelf does not support this feature yet
- https://github.com/bookshelf/bookshelf/issues/1943
2019-02-07 22:05:07 +01:00
kirrg001
2eb1f2a507 Avoided inserting actions if nothing has changed
refs #10431

- I thought i have added this protection, but got removed via the simplification in cca3317a11
2019-02-07 20:49:35 +01:00
kirrg001
b25da62cca Ensured defaults when creating resources
no issue

- the model & api layer suffered from missing fields when creating resources
- usually there is only a handful of fields which are required to insert a resource
- the other fields are nullable and/or get defaults assigned
- the API only returned the configured default fields and the fields you have sent to the API
  - this resulted in a response with missing fields
- if you have listend on "created" event, the same happend
  - you received a model with missing fields
- we now set the undefined fields to null on purpose to ensure a full model for both cases

@NOTE:
There is no endpoint to serve webhooks (not for v0.1, not for v2).
Exposing the secret is required if an integration fetches it's api keys and it's webhooks.
The secret is currently un-used and not implemented.
2019-02-07 20:20:10 +01:00
Kevin Ansfield
52a482cba8 Version bump to 2.14.0 2019-02-07 14:35:06 +00:00
Kevin Ansfield
1331cc29e6 Updated Ghost-Admin to 2.14.0 2019-02-07 14:35:06 +00:00
Kevin Ansfield
68d73d31b2 Bumped express-hbs dependency
no issue
- express-hbs has been updated to depend on handlebars@4.0.13 which protects against a potential RCE
- Ghost itself was not vulnerable to the RCE due to protection by gscan which does not allow themes using unknown helpers to be installed/activated
2019-02-07 14:16:37 +00:00
John O'Nolan
ae5ed03488
Update admin redirects
Refs https://github.com/TryGhost/Ghost/pull/10079
2019-02-07 17:59:35 +07:00
kirrg001
1e90126760 Remembered changed fields on destroy
refs #9248
2019-02-07 11:35:00 +01:00
kirrg001
865366c7c8 Ensured consistency for event handlers in the model layer
no issue

- the event chain works like this:
  - if a model registers an event, it get's triggered, because it's stronger than the base model
- but you have to call the base model to agree on a contract, because base model implements generic logic in event handlers
- this was inconsistently used
2019-02-07 11:02:35 +01:00
Fabien O'Carroll
46bf5270df
Added initial subscription support with stripe to Members API (#10460)
These changes introduce a new "service" to the members api, which handles getting and creating subscriptions.

This is wired up to get subscription information when creating tokens, and attaching information to the token, so that the Content API can allow/deny access. 

Behind the subscription service we have a Stripe "payment processor", this holds the logic for creating subscriptions etc... in Stripe.

The logic for getting items out of stripe uses a hash of the relevant data as the id to search for, this allows us to forgo keeping stripe data in a db, so that this feature can get out quicker.
2019-02-07 10:41:39 +01:00
Fabien O'Carroll
5f66026647
Refactored auth pages for future flows (#10458)
no-issue

* Used camelCase for gateway method calls
* Added some components for building blocks of forms
* Added input specific components
* Added Form component
    This handles collecting the data to submit and sharing state between forms
* Added Pages component to handle urls
* Added the pages for the popup
* Added MembersProvider component
    This is designed to give its children access to gateway methods
* Added Modal component
    This wraps the pages and handles dispatching form submissions to the members gateway
* Refactored index.js to use new components/pages
* Fixed default page from Signup -> Signin
2019-02-07 10:39:55 +01:00
kirrg001
cca3317a11 Simplfied action trigger in base model
refs #10431

- the model layer triggers a couple of events on resource update
  e.g. post to page -> post.deleted, post.added
- the resource_type must be always "post", because "page" is not an official model (Bookshelf won't be able to resolve the resource anymore)
- the action streams looks very confusion if you see deleted and added actions when toggling the post to a static page
- therefor the easiest approach for now is to only store actions for: added, edited, deleted
- and we will add the context information asap
  - e.g. you will see that status was changed from "draft" to "published"
- we can also introduce extra published actions if we want
- relying on the internal event system right now makes things just more complicated and we want to keep it simple
2019-02-06 22:21:06 +01:00
kirrg001
dbd3832967 Allowed browse actions for integrations
refs #9865
2019-02-06 21:36:09 +01:00
kirrg001
5f4cf42c14 Fixed tests
no issue
2019-02-06 21:36:09 +01:00