TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-12-29 13:52:10 +03:00
Code Issues Projects Releases Wiki Activity
abc7af8082
Ghost/ghost
History
Ronald Langeveld abc7af8082 Added test email rate limiting (#17505) 
refs https://github.com/TryGhost/Product/issues/3651

- This is a security fix that addresses an issue causing malicious users
to abuse the test / preview email API endpoint.
- We have multiple procedures in place now to limit such users.
- First, we now only allow one email address to be passed into the
`sendTestEmail` method. This method only have one purpose, which is to
compliment the test email functionality within the Editor in Admin and
therefore have no reason to send to more than one email address at a
time.
- We then add an additional rate limiter to prevent a user from making
multiple requests, eg via a script.
- The new imposed limit is 10 test emails per hour.
2023-07-27 09:22:26 +02:00
..
adapter-cache-memory-ttl Update Test & linting packages 2023-07-11 15:26:07 +02:00
adapter-cache-redis Update Test & linting packages 2023-07-11 15:26:07 +02:00
adapter-manager Update Test & linting packages 2023-07-11 15:26:07 +02:00
admin Fixed loading assets from CDN URL 2023-07-27 09:22:11 +02:00
announcement-bar-settings Update Test & linting packages 2023-07-11 15:26:07 +02:00
api-framework Update Test & linting packages 2023-07-11 15:26:07 +02:00
api-version-compatibility-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
audience-feedback Update Test & linting packages 2023-07-11 15:26:07 +02:00
bootstrap-socket Update Test & linting packages 2023-07-11 15:26:07 +02:00
collections Cleaned up CollectionsService from unused code 2023-07-21 19:46:22 +08:00
constants Update Test & linting packages 2023-07-11 15:26:07 +02:00
core Added test email rate limiting (#17505) 2023-07-27 09:22:26 +02:00
custom-theme-settings-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
data-generator Update Test & linting packages 2023-07-11 15:26:07 +02:00
domain-events Update Test & linting packages 2023-07-11 15:26:07 +02:00
dynamic-routing-events Update Test & linting packages 2023-07-11 15:26:07 +02:00
email-analytics-provider-mailgun Update Test & linting packages 2023-07-11 15:26:07 +02:00
email-analytics-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
email-content-generator Update Test & linting packages 2023-07-11 15:26:07 +02:00
email-events Update Test & linting packages 2023-07-11 15:26:07 +02:00
email-service Added test email rate limiting (#17505) 2023-07-27 09:22:26 +02:00
email-suppression-list Update Test & linting packages 2023-07-11 15:26:07 +02:00
event-aware-cache-wrapper Update Test & linting packages 2023-07-11 15:26:07 +02:00
express-dynamic-redirects Update Test & linting packages 2023-07-11 15:26:07 +02:00
external-media-inliner Update Test & linting packages 2023-07-11 15:26:07 +02:00
extract-api-key Updated to use assert/strict everywhere (#17047) 2023-06-21 09:56:59 +01:00
html-to-plaintext Update Test & linting packages 2023-07-11 15:26:07 +02:00
i18n Updated Spanish translations (#17424) 2023-07-21 09:44:30 +02:00
importer-handler-content-files Update Test & linting packages 2023-07-11 15:26:07 +02:00
importer-revue Update Test & linting packages 2023-07-11 15:26:07 +02:00
in-memory-repository Improved monorepo tooling setup 2023-07-12 16:27:39 +02:00
job-manager Update Test & linting packages 2023-07-11 15:26:07 +02:00
link-redirects Update Test & linting packages 2023-07-11 15:26:07 +02:00
link-replacer Update Test & linting packages 2023-07-11 15:26:07 +02:00
link-tracking Update Test & linting packages 2023-07-11 15:26:07 +02:00
magic-link Update Test & linting packages 2023-07-11 15:26:07 +02:00
mail-events Improved monorepo tooling setup 2023-07-12 16:27:39 +02:00
mailgun-client Update Test & linting packages 2023-07-11 15:26:07 +02:00
member-attribution Update Test & linting packages 2023-07-11 15:26:07 +02:00
member-events Update Test & linting packages 2023-07-11 15:26:07 +02:00
members-api ✨ Added support for importing Stripe Coupons as Offers (#17415) 2023-07-19 14:26:42 +02:00
members-csv Update Test & linting packages 2023-07-11 15:26:07 +02:00
members-events-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
members-importer Added search by email for Stripe Customer ID during member import (#17326) 2023-07-13 13:20:54 +02:00
members-ssr Update Test & linting packages 2023-07-11 15:26:07 +02:00
mentions-email-report Update Test & linting packages 2023-07-11 15:26:07 +02:00
milestones Update Test & linting packages 2023-07-11 15:26:07 +02:00
minifier Update Test & linting packages 2023-07-11 15:26:07 +02:00
model-to-domain-event-interceptor Removed CollectionResourceChangeEvent handling 2023-07-21 19:46:22 +08:00
mw-api-version-mismatch Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-cache-control Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-error-handler Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-session-from-token Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-update-user-last-seen Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-version-match Update Test & linting packages 2023-07-11 15:26:07 +02:00
mw-vhost Update Test & linting packages 2023-07-11 15:26:07 +02:00
oembed-service Update metascraper to v5.34.9 2023-07-20 08:39:36 +00:00
offers ✨ Added support for importing Stripe Coupons as Offers (#17415) 2023-07-19 14:26:42 +02:00
package-json Update Test & linting packages 2023-07-11 15:26:07 +02:00
payments Update Test & linting packages 2023-07-11 15:26:07 +02:00
post-revisions Improved monorepo tooling setup 2023-07-12 16:27:39 +02:00
posts-service Fixed ability to remove post from an automatic collection 2023-07-21 19:46:22 +08:00
referrers Update Test & linting packages 2023-07-11 15:26:07 +02:00
security Update Test & linting packages 2023-07-11 15:26:07 +02:00
session-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
settings-path-manager Update Test & linting packages 2023-07-11 15:26:07 +02:00
slack-notifications Fixed timezone configuration in package tests (#17087) 2023-07-20 07:46:27 +00:00
staff-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
stats-service Update dependency @types/luxon to v3.3.1 2023-07-21 09:23:24 +02:00
stripe Added request throttling to stay under the Stripe Search API rate limits (#17393) 2023-07-18 09:41:42 +00:00
tiers Update Test & linting packages 2023-07-11 15:26:07 +02:00
update-check-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
verification-trigger Update Test & linting packages 2023-07-11 15:26:07 +02:00
version-notifications-data-service Update Test & linting packages 2023-07-11 15:26:07 +02:00
webmentions Update Test & linting packages 2023-07-11 15:26:07 +02:00
tsconfig.json Removed jest from tsconfig types array 2023-07-21 14:50:52 +02:00