Commit Graph

9190 Commits

Author SHA1 Message Date
Fabien O'Carroll
feee3dc58f Cleaned up render{Subscribe,Upgrade}Page
no-issue

- ensured promises are returned
- removed unused prop
2019-04-17 10:35:17 +02:00
Fabien O'Carroll
0970fa6a6d Added CouponInput component
no-issue

This can be used in the subscribe pages to pass coupon info through
2019-04-17 10:35:17 +02:00
Fabien O'Carroll
b28f3a02d9 Added support for disabled form elements
no-issue

This can be used for a coupon input in future
2019-04-17 10:35:17 +02:00
Fabien O'Carroll
88368d0d94 Updated members api and gateway to pass coupo
no-issue

This will allow the auth pages and members sdk to pass coupons through
to the api.
2019-04-17 10:35:17 +02:00
Fabien O'Carroll
cdc3971ed8 Passed coupon from metadata through to stripe
no-issue

This will allow us to send through coupons from the api layer and have
stripe handle the rest :)
2019-04-17 10:35:17 +02:00
Hannah Wolfe
e830e334d2 Updated .travis.yml swap renovate build to push
- currently, we only build renovate PRs
- that means we can't use automerge branch, as we wouldn't run any checks
- this swaps to running only renovate pushes, which means the branch always gets checked
2019-04-17 09:24:00 +01:00
Rish
b377549bc7 Added spinner on member signup pages
no issue
2019-04-16 23:22:15 +05:30
Rish
874fceb077 Updated member signin page to show logged in status
no issue
2019-04-16 22:42:16 +05:30
Nazar Gargol
1211c70eb3 🐛 Fixed Ghost out of date notification
closes #9875

- The solution here is a quick patch and should be cleaned up once https://github.com/TryGhost/Ghost/issues/10236 is implemented
2019-04-16 18:29:51 +02:00
Zimo
17bc79d57e Added fade in for signup complete page 2019-04-16 17:51:16 +02:00
Peter Zimon
94ac33bc97
Members refinements (#10689)
* Updated close animation speed for members pages
* Updated responsive styles for members mobile screens 
* Adding spinner CSS to members pages
* Adding members signup complete page
2019-04-16 17:36:37 +02:00
Fabien O'Carroll
9aa9b39a59 Fixed require path of members-ssr
no-issue
2019-04-16 17:19:46 +02:00
Fabien O'Carroll
f9899cb8c4
Updated theme layer to use members-ssr (#10676)
* Removed support for cookies in members auth middleware

no-issue

The members middleware will no longer be supporting cookies, the cookie
will be handled by a new middleware specific for serverside rendering,
more informations can be found here:

https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5

* Removed members auth middleware from site app

no-issue

The site app no longer needs the members auth middleware as it doesn't
support cookies, and will be replaced by ssr specific middleware.

https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5

* Added comment for session_secret setting

no-issue

We are going to have multiple concepts of sessions, so adding a comment
here to be specific that this is for the Ghost Admin client

* Added theme_session_secret setting dynamic default

no-issue

Sessions for the theme layer will be signed, so we generate a random hex
string to use as a signing key

* Added getPublicConfig method

* Replaced export of httpHandler with POJO apiInstance

no-issue

This is mainly to reduce the public api, so it's easier to document.

* Renamed memberUserObject -> members

no-issue

Simplifies the interface, and is more inline with what we would want to export as an api library.

* Removed use of require options inside members

no-issue

This was too tight of a coupling between Ghost and Members

* Simplified apiInstance definition

no-issue

* Added getMember method to members api

* Added MembersSSR instance to members service

* Wired up routes for members ssr

* Updated members auth middleware to use getPublicConfig

* Removed publicKey static export from members service

* Used real session secret

no-issue

* Added DELETE /members/ssr handler

no-issue

This allows users to log out of the theme layer

* Fixed missing code property

no-issue

Ignition uses the statusCode property to forward status codes to call sites

* Removed superfluous error middleware

no-issue

Before we used generic JWT middleware which would reject, now the
middleware catches it's own error and doesn't error, thus this
middleware is unecessary.

* Removed console.logs

no-issue

* Updated token expirty to hardcoded 20 minutes

no-issue

This returns to our previous state of using short lived tokens, both for
security and simplicity.

* Removed hardcoded default member settings

no-issue

This is no longer needed, as defaults are in default-settings.json

* Removed stripe from default payment processor

no-issue

* Exported `getSiteUrl` method from url utils

no-issue

This keeps inline with newer naming conventions

* Updated how audience access control works

no-issue

Rather than being passed a function, members api now receives an object
which describes which origins have access to which audiences, and how
long those tokens should be allowed to work for. It also allows syntax
for default tokens where audience === origin requesting it. This can be
set to undefined or null to disable this functionality.

{
    "http://site.com": {
        "http://site.com": {
            tokenLength: '5m'
        },
        "http://othersite.com": {
            tokenLength: '1h'
        }
    },
    "*": {
        tokenLength: '30m'
    }
}

* Updated members service to use access control feature

no-issue

This also cleans up a lot of unecessary variable definitions, and some
other minor cleanups.

* Added status code to auth pages html response

no-issue

This was missing, probably default but better to be explicit

* Updated gateway to have membersApiUrl from config

no-issue

Previously we were parsing the url, this was not very safe as we can
have Ghost hosted on a subdomain, and this would have failed.

* Added issuer to public config for members

no-issue

This can be used to request SSR tokens in the client

* Fixed path for gateway bundle

no-issue

* Updated settings model tests

no-issue

* Revert "Removed stripe from default payment processor"

This reverts commit 1d88d9b6d73a10091070bcc1b7f5779d071c7845.

* Revert "Removed hardcoded default member settings"

This reverts commit 9d899048ba7d4b272b9ac65a95a52af66b30914a.

* Installed @tryghost/members-ssr

* Fixed tests for settings model
2019-04-16 16:50:25 +02:00
Fabien O'Carroll
b3f66c6c91 Blacklisted private member settings for HTTP calls
no-issue

Previously it was possible to fetch the private key and session secret
for the members service, this is a security issue as we do not have
specific permissions for individual settings yet, and could have
possibly exposed secrets to admin integrations.
2019-04-16 14:39:01 +02:00
Rish
770f6afa2a Version bump to 2.20.0 2019-04-16 16:42:31 +05:30
Rish
97c7c5aaf7 Updated Ghost-Admin to 2.20.0 2019-04-16 16:42:31 +05:30
Rish
2649cf112a Updated Casper to 2.9.10 2019-04-16 16:42:31 +05:30
Tim Birkett
2b75d1f9df Exposed new logging config options (#10678)
no issue

- Exposes the new name and gelf logging options.
2019-04-16 16:34:15 +05:30
Rish
1ca3ba9a6e Updated Ignition to 3.1.0
no issue

- Bumped Ghost Ignition to 3.1.0 to support more options
2019-04-16 16:32:50 +05:30
Chris McKulka
a6fc2f1514 🐛 Removed extraneous log message for missing en.json locale file (#10662)
no issue
- content is in english (en) by default so only show the missing translation file warning when a non-english locale is configured
2019-04-16 10:32:20 +01:00
Vikas Potluri
c58236e549 🐛 Disallowed locked/suspended users from being made owner via the API (#10647)
- closes #10555
- Added a check to the user modal that the new owner is active 
- Had to refactor Owner->Author unit test (also renamed it)
  - Based on the first 2 lines, owner->editor change is attempted (hence the rename)
  - Since both stubs return a 'modal' with owner role which means owner->owner change is actually attempted
  - Now that there's a user status check, added the `status` property to the user receiving owernship
2019-04-16 10:30:29 +01:00
Fabien O'Carroll
b50cff8753 Updated import to never use {active,instsalled}_apps
no-issue

This is so that new imports will not contain old default, or invalid
values.
2019-04-16 11:19:17 +02:00
Fabien O'Carroll
7461869f13 Updated import to only show warning when apps exist
no-issue

This is so that someone with empty defaults for installed_apps and
active_apps, or someone without the defaults at all, will not see the
warning message when importing.
2019-04-16 11:19:17 +02:00
Fabien O'Carroll
a947947ebd Removed support for apps from getContentPath
no-issue

There is no longer a need for this as external apps do not work.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
37bcdb0a83 Removed filters module
no-issue

This is no longer used now, as it was for apps to extend Ghost
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
90c2dbcd6b Removed use of filters module
no-issue

As we're deprecating apps, filters are no longer used.

- Removed use of filters in helpers
- Removed use of filters from routing service
- Removed use of filters from rss service
- Removed use of filters in base model
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
54ac98037b Refactored proxy to not take name param
no-issue

This was only used as context to api methods, but those have been removed.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
ca2dc1889a Removed unused filters object from apps proxy
no-issue

This is not used by any current apps, and apps are considered
deprecated.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
65f16f77a7 Removed unused api object from apps proxy
no-issue

This is not used by any current apps, and apps are considered deprecated.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
9ed6da588a Removed content/apps directory
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
0d40952232 Removed apps from update-check
no-issue

This only read external apps, so can be removed now we don't support them
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
f74d459dad Removed active and installed apps default settings
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
4a22fcf73a Removed unused translations for apps service
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
7ae139c6b4 Removed apps lifecycle test
no-issue

This module didn't really seem to be tetsing anything, it was all based
on internally set properties, which if there was a bu, likely the bug
would be reflected in this property too - resulting in useless test.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
7fcad145c7 Updated app proxy test to ignore permissions
no-issue

The module has no concepts of permissions anymore, so all tests can
ignore this concept too. Also refactors tests to match the new signature
of the module.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
a77b38cb09 Deleted tests for removed apps service modules
no-issue

The companion moduleis for these tests have been deleted.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
29948da3bc Refactored app service init to load config
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
d31395412b Removed sandbox from apps service
no-issue

The instansiation of a Module object was only used so that we could
override the require method inside external apps, now we have no support
for them, we are free to require the internal apps directly. This has no
functionality change.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
4696d70de0 Refactored app proxy module to not use Constructor
no-issue

Rather than creating a whole instance, we can replace it with a helper
method - his is less memory intensive and a little easier to parse for
something this small.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
ca8c5c4907 Removed app permissions module and updated loader
no-issue

The permissions module is no longer necessary as we only suppot internal
apps, which have all permissions. This allowed us to delete the module,
but required that we update the loader to remove references to it.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
e4db1eed81 Removed support for external apps from Proxy
no-issue

This also removes the need for permissions, as internal apps have all permissions
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
4b74c11abb Removed installAppByName method
no-issue

Only external apps needed the install step, we can safely remove this now.
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
ad9d142174 Refactored Sandbox to be singleton
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
fd9fc92dd5 Removed external app support in Sandbox
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
fc1aa58dc0 Removed external app support from app service loader
no-issue
2019-04-16 11:05:33 +02:00
Fabien O'Carroll
d63d3f77eb Removed external app support from app service init
no-issue
2019-04-16 11:05:33 +02:00
Rishabh Garg
62f5bdac4c
Updated to use count words/images helpers from SDK (#10686)
refs #10618

- Added @tryghost/helpers dependency to use Ghost-SDK helpers
- Updated countWords, countImages helpers and removed local copy
2019-04-16 08:00:01 +05:30
Fabien O'Carroll
5460de9c58 Updated gscan to 2.5.0
no-issue

This includes a bump to handlebars -> 4.1.2, which fixes a potential RCE
https://github.com/wycats/handlebars.js/blob/v4.1.2/release-notes.md#v412---april-13th-2019
2019-04-15 14:30:37 +02:00
Fabien O'Carroll
0f5ca616b8 Updated express-hbs to 1.1.1
no-issue

This includes a bump to handlebars -> 4.1.2, which fixes a potential RCE
https://github.com/wycats/handlebars.js/blob/v4.1.2/release-notes.md#v412---april-13th-2019
2019-04-15 14:30:37 +02:00
Fabien O'Carroll
32a4798d76 Added skip of active/installed apps settings during import (#10681)
no issue
- the `{active,installed}_apps` settings related to a very old, minimally implemented, unreleased, and problematic approach to custom apps
- this is the first step towards full removal of the old "apps" concept

Credits: Kacper Szurek
2019-04-15 11:10:10 +01:00