Commit Graph

39073 Commits

Author SHA1 Message Date
Sam Lord
0a9d2fadba Added honeypot field to prevent bot signup/signin
ref KTLO-1
Should prevent untargeted attacks using headless browser bots.
2024-08-22 22:32:04 +01:00
Sam Lord
244e612f53 Use config flag to change whether token integrity is checked
ref KTLO-1
Allows us to get this out to self-hosters much faster
2024-08-22 22:23:16 +01:00
Sam Lord
23c0882019 Added tests for request integrity token validation 2024-08-22 22:23:16 +01:00
Sam Lord
ebc87002ce Added integrity token to signup-form package
ref KTLO-1
2024-08-22 22:23:16 +01:00
Sam Lord
ef4f79370f Added support in Portal for integrity tokens on magic link API
ref KTLO-1
These tokens should prevent untargeted attacks, as the magic link
endpoint needs a token that was generated by the server, similar to a
CSRF token, but without needing any server-side state, or a cookie to
be set for unauthenticated users.
2024-08-22 22:23:16 +01:00
Sam Lord
a48b4e5cbf Added integrity token API & middleware for magic link requests
ref KTLO-1
Back-end implementation of request integrity tokens. The purpose here
is to prevent simple web bots from spamming the signup form.
2024-08-22 22:23:16 +01:00
Steve Larson
0053939185
Improved email analytics jobs system (#20809)
ref https://linear.app/tryghost/issue/ENG-952
- added persistence to the job timestamps

This set of changes reduces the potential for gaps in our email event
processing by adding persistence to the job timestamps. This avoids
expensive queries on the `email_recipients` table after every boot, and
reduces reliance on fallbacks in periods of heavy processing or reboot.

This is our first use of the jobs table to create a persistent line,
instead of its initial use case of single-run jobs. We may expand this
capability and move to use of the jobs model over knex.raw in order to
make this a bit friendlier.

Note: this works with sqlite but datetimes are stored as ints. It still
works fine. https://github.com/knex/knex/pull/5272
2024-08-22 15:20:42 -05:00
Steve Larson
827518c98b
🐛 Fixed shift selection in the posts list (#20818)
ref https://linear.app/tryghost/issue/ENG-1489/

The changes to improve posts loading in admin broke the shift selection
functionality. This restores that, as we need to be able to crawl across
the (now) three models when present.
2024-08-22 13:15:06 -05:00
Daniël van der Winden
7c992825ed
Publish modal updates (#20817)
The new modal for the updated publishing flow has an entirely new
layout, based on feedback previously received. In addition, this PR
includes a few tweaks to the underlying logic.
2024-08-22 14:49:29 +00:00
Steve Larson
cd7c27d3ad
🐛 Fixed fetching labels and offers in the editor (#20815)
ref https://linear.app/tryghost/issue/ONC-263/
- labels dropdown in sign up card was not successfully fetching labels
- offers dropdown suffered the same fate

When introducing the second editor instance, it appears we ran into some
race conditions with the Ember tasks used to fetch the resources. The
init instance was beating the other to the punch, and so the state was
never successfully updated, as it is only fetched once on mounting the
card.
2024-08-22 08:55:33 -05:00
Princi Vershwal
f984fbd47e
🎨 Improved the performance of the /members/events/ aggregated_click_event endpoint (#20790)
Ref https://linear.app/tryghost/issue/ONC-216/improve-the-performance-of-the-membersevents-aggregated-click-event
2024-08-22 18:26:10 +05:30
Ronald Langeveld
f2206fb232
Added one-time payments under "payments" for filtering (#20807)
ref PLG-153

- Scoped one-time payments (`donation_event`) under the "payments"
category in the member activity feed filter.
- Updated `toggleEventType` logic to ensure that toggling "payments"
also toggles one-time payments when the `tipsAndDonations` feature is
enabled.
- Refactored event type handling into utility functions for easier
testing.
- Added unit tests for the new utility functions to ensure correct
behaviour.
- Added acceptance testing.
2024-08-22 10:26:46 +00:00
Ronald Langeveld
ad3751bfa6
Added i18n support to tips and donations on portal (#20812)
ref PLG-159

- wrapped strings inside the translate function in Portal
- added new strings to i18n files
2024-08-22 15:28:08 +07:00
Princi Vershwal
309cb37cc6
Updated nql package (#20811)
Ref [ONC-216](https://linear.app/tryghost/issue/ONC-216/improve-the-performance-of-the-membersevents-aggregated-click-event)

Needed changes in nql package for this task.
2024-08-22 07:55:14 +00:00
Chris Raible
6d46dc26c7
🔒 Fixed admin forms defaulting to GET method (#20810)
ref
https://linear.app/tryghost/issue/ENG-1497/admin-signin-signup-and-setup-forms-default-to-get

- If method is not specified, the form will default to GET, which is
incorrect
- This commit sets the method to POST and action to javascript:void(0)
to prevent the form from submitting via GET if JavaScript is disabled or
not fully loaded yet
2024-08-21 15:49:52 -07:00
Chris Raible
c0471f0c28
🐛 Fixed frontend routing prioritizing collections over built in routes (#20765)
ref
https://linear.app/tryghost/issue/ONC-242/frontend-routing-prioritizes-collections-over-taxonomies

- Under a fairly specific edge case with a collection route that conflicts with a default, built-in route ("taxonomy" — like tags, authors, etc), the frontend routing would prioritize the collection over the taxonomy.

- For example, with the following in a custom `routes.yaml`:
```
collections:
  /:
    permalink: /{primary_tag}/{slug}/
    template: index
```

If a post exists with the same slug as its primary tag's slug, the frontend routing would redirect the `/tag/{slug}/` route to the post in the collection, rather than serving the tag itself.

- This commit changes that, so if a collection's route conflicts with e.g. a `/tag/{slug}/` default route, Ghost will still return the built in route, rather than the collection.
2024-08-21 13:45:59 -07:00
Kevin Ansfield
f08e4d4728 Hid tips and donation settings when Stripe is disabled
closes https://linear.app/tryghost/issue/PLG-178

- updated conditional to ensure we're ready for GA by showing when Stripe is enabled rather than only when the feature flag is enabled
2024-08-21 16:12:00 +01:00
Kevin Ansfield
b01d4287ad Fixed Admin test failures when running in Safari
no issue

- Safari's `innerText` sometimes includes a trailing `\n` depending on the markup used so we need to use `.to.have.rendered.trimmed.text()`
- reproducible when running tests via http://localhost:4200/tests (we don't yet run in Safari via our testem config)
2024-08-21 12:58:11 +01:00
Kevin Ansfield
fc501add94 Fixed editor not loading in Admin acceptance tests
closes https://linear.app/tryghost/issue/PLG-176

The editor files were previously stubbed for testing because we didn't have a way to load the externally-hosted files. This made testing slow and difficult because the only way to test the Admin integration was via Ghost's e2e browser tests.

- unstubbed the editor globals so `fetchKoenigLexical()` actually tries to import the external assets
- updated `ember-cli-build` to copy the Koenig UMD file over to the assets directory in development/test builds
- updated `environment.js` to set the required filename for the default asset import to successfully hit the test environment hosted files
- updated lexical editor acceptance tests to demonstrate the editor loads successfully for new and existing posts
2024-08-21 11:49:05 +01:00
Ghost CI
2627dd6aa0 Merged v5.89.6 into main 2024-08-21 09:58:53 +00:00
Ghost CI
1456fc2b03 v5.89.6 2024-08-21 09:58:51 +00:00
Ronald Langeveld
27ff27ce76 🐛 Fixed editor performance issues in Safari for posts with HTML or Markdown cards (#20806)
ref https://linear.app/tryghost/issue/ONC-261

- Previous method of hiding the second Lexical instance using `width:
0`, `height: 0`, and `overflow: hidden` caused CPU usage to spike,
likely due to CodeMirror continuously processing the element.
2024-08-21 16:48:37 +07:00
Ronald Langeveld
3645fd8a5c
🐛 Fixed editor performance issues in Safari for posts with HTML or Markdown cards (#20806)
ref https://linear.app/tryghost/issue/ONC-261

- Previous method of hiding the second Lexical instance using `width:
0`, `height: 0`, and `overflow: hidden` caused CPU usage to spike,
likely due to CodeMirror continuously processing the element.
2024-08-21 09:42:22 +00:00
Steve Larson
54b0b87633
Added additional tests for email analytics (#20805)
ref 4267ff9
- unit tests didn't cover what events were passed along to be fetched,
important now that it's split out
2024-08-20 23:30:54 +00:00
Steve Larson
3c9b8d682d
Fixed handling of await (#20804)
ref 8e1f552
2024-08-20 19:23:27 +00:00
Steve Larson
8e1f5529c7
Fixed value destructuring for null values (#20803)
ref 4267ff9

Found while testing other code. Appears to fail destructuring which
prevents the job from running.
2024-08-20 14:04:35 -05:00
Steve Larson
4267ff9be6
Updated email analytics job to prioritize open events (#20800)
ref https://linear.app/tryghost/issue/ENG-1477
- updated email analytics job to prioritize open events
- put limits on non-open event fetching
- updated job to now restart itself until processing is at a
sufficiently low volume

Previously the EmailAnalytics job would process all event data equally.
When there's sufficient recipients (>20k), we could see delays in the
open rate data in Admin because of all the delivered events being
processed. Open events are far more important to users, so we've now
prioritized processing those events before any others.

Processing of events shouldn't be any faster or slower with this as this
doesn't change throughput, just order.

NOTE: Use the mailgun-mock-server in TryGhost/Toolbox for testing.
2024-08-20 17:25:01 +00:00
Steve Larson
2f36d6a4de
Fixed email integration tests (#20799)
ref dac2561

Among the mess of GH forks, it seems a few commits got lost patching up
these tests.
2024-08-20 15:12:53 +00:00
Kevin Ansfield
27123844dc Added donation notification toggle to user settings
closes https://linear.app/tryghost/issue/PLG-155

- added checkbox when "stripe enabled" check is true
2024-08-20 16:00:32 +01:00
Ghost CI
5effca4c5e Merged v5.89.5 into main 2024-08-20 14:33:31 +00:00
Ghost CI
eecd79a875 v5.89.5 2024-08-20 14:33:30 +00:00
Steve Larson
dac2561252
🔒 Added uuid verification to member endpoints not requiring a session
ref https://linear.app/tryghost/issue/ENG-1364
ref https://linear.app/tryghost/issue/ENG-1464

- credits to https://github.com/1337Nerd
- added a hashed value to endpoints that do not require a member sign in in order to verify the source of the link and resulting request
- added redirect to sign in page when trying to access newsletter
management
2024-08-20 16:24:02 +02:00
Sodbileg Gansukh
6413a30c35
Fixed missing stats on the analytics screen (#20797)
ref DES-716
2024-08-20 12:58:36 +00:00
Sodbileg Gansukh
9b41307a76
Replaced refresh button with a GhTaskButton (#20796)
ref DES-705
2024-08-20 20:06:12 +08:00
Sodbileg Gansukh
a8dc689823
Improved publish flow transition (#20794)
ref DES-697

- used client side navigation on the flow instead of hard refresh
- reduced layout shift on the analytics screen
- made the modal transition a bit smoother
2024-08-20 20:04:44 +08:00
Kevin Ansfield
d3c2c7b369 Updated donations browser tests for new default suggested value
ref https://github.com/TryGhost/Ghost/pull/20793

- now that there's a non-zero suggested value amount Stripe's UI shows a button to change the amount rather than showing the amount input field immediately
- added extra click to the tests and an expectation that the default value is set correctly
2024-08-20 12:43:02 +01:00
Kevin Ansfield
0b3f7d7705 Updated tips & donations default suggested value
closes https://linear.app/tryghost/issue/PLG-156

- updated all default fixtures to use `500` ($5) as the default suggested donation value
- added migration to update existing settings using the old default of `0` to `500`
  - this is fine to apply because the feature hasn't been released so there's no explicit `0` values in the wild
- added an acceptance test for the adminx-settings tips & donations section
2024-08-20 12:07:51 +01:00
Daniel Lockyer
0f3805e096 Changed color of adminX prefix for yarn dev
- red makes it look like an error, which is very misleading
- I've changed this to a random purple I found
- credits to @vershwal and @dvdwinden
2024-08-20 12:35:24 +02:00
Sodbileg Gansukh
5cce46e851
Share button improvements on publish flow modal (#20791)
ref DES-684

- switched social links from buttons to regular links 
- added post title to share links
2024-08-20 17:33:40 +08:00
Sodbileg Gansukh
cc545b55b0
Added default background and font styles to cards (#20676)
ref DES-609

- On top of bookmark card, this update adds default background color and font to file, audio, and product cards
- The main purpose of this is keeping embedded look across these cards consistencly regardless of the theme background color and default font
- Themes can still override the styles
2024-08-20 16:46:47 +08:00
Ghost CI
0a2f2adefd Merged v5.89.4 into main 2024-08-20 07:55:48 +00:00
Ghost CI
beb70e9c11 v5.89.4 2024-08-20 07:55:46 +00:00
Steve Larson
ad9aa47400
Added Sentry message logging for generating magic links (#20789)
ref https://linear.app/tryghost/issue/ONC-258
2024-08-20 08:38:12 +01:00
Kevin Ansfield
19b8674c3a
Fixed excerpt blur saving non-draft posts
ref https://linear.app/tryghost/issue/PLG-174

- forcing autosave on excerpt blur caused posts to revert to `draft` and save immediately even when they were published/scheduled
- updated the save-on-excerpt-blur to only autosave drafts
- added acceptance tests for title and excerpt change+blur on published posts
2024-08-20 08:38:06 +01:00
Kevin Ansfield
d6df261446
🐛 Fixed editor unsaved changes modal showing too often (#20787)
ref [ENG-661](https://linear.app/tryghost/issue/ENG-661/) 
ref [ONC-253](https://linear.app/tryghost/issue/ONC-253/)
ref [PLG-174](https://linear.app/tryghost/issue/PLG-174/)

- restored the original but reverted fix for unsaved changes modal from https://github.com/TryGhost/Ghost/pull/20687
- updated code to remove some incorrect early-falsy-return logic in `editorController.hasDirtyAttributes` that prevented save of unsaved changes on the underlying model (e.g. excerpt)
- updated unit tests so they are testing real post model instances and therefore are testing what we expect them to test
- added acceptance tests to ensure autosave is working for title and excerpt fields

---------

Co-authored-by: Ronald Langeveld <hi@ronaldlangeveld.com>
2024-08-20 08:37:57 +01:00
Kevin Ansfield
b6582e6623
Updated Admin editor unit tests to use real model instances
ref https://linear.app/tryghost/issue/PLG-176

- we recently had to revert code because it caused unexpected problems despite the unit tests passing
- the setup for the editor unit tests was very basic and did not represent the real world because it tested a simple EmberObject instance rather than an Ember Model instance meaning the tests weren't covering the real code paths
- updated the unit test with a more realistic environment ready for re-working the reverted code+tests
2024-08-20 08:37:49 +01:00
Kevin Ansfield
25c31c31c9
🐛 Fixed autosave not triggering when in-editor excerpt is changed (#20785)
ref https://linear.app/tryghost/issue/PLG-174

- added `blur` handler to excerpt field so it acts the same as the title field and triggers a save when it loses focus
2024-08-20 08:37:41 +01:00
Steve Larson
9f4bc9c132
Added Sentry message logging for generating magic links (#20789)
ref https://linear.app/tryghost/issue/ONC-258
2024-08-19 21:28:15 +00:00
Kevin Ansfield
9dfbd3e293 Fixed excerpt blur saving non-draft posts
ref https://linear.app/tryghost/issue/PLG-174

- forcing autosave on excerpt blur caused posts to revert to `draft` and save immediately even when they were published/scheduled
- updated the save-on-excerpt-blur to only autosave drafts
- added acceptance tests for title and excerpt change+blur on published posts
2024-08-19 21:04:15 +01:00
Kevin Ansfield
887f4d3ac2
🐛 Fixed editor unsaved changes modal showing too often (#20787)
ref [ENG-661](https://linear.app/tryghost/issue/ENG-661/) 
ref [ONC-253](https://linear.app/tryghost/issue/ONC-253/)
ref [PLG-174](https://linear.app/tryghost/issue/PLG-174/)

- restored the original but reverted fix for unsaved changes modal from https://github.com/TryGhost/Ghost/pull/20687
- updated code to remove some incorrect early-falsy-return logic in `editorController.hasDirtyAttributes` that prevented save of unsaved changes on the underlying model (e.g. excerpt)
- updated unit tests so they are testing real post model instances and therefore are testing what we expect them to test
- added acceptance tests to ensure autosave is working for title and excerpt fields

---------

Co-authored-by: Ronald Langeveld <hi@ronaldlangeveld.com>
2024-08-19 18:03:13 +00:00