Ghost Release: 0.5.0 RC2

TL;DR

Ghost 0.5.0-rc2 brings significant improvements to the admin experience with enhanced user management, better error handling, and improved security. This release candidate fixes numerous bugs, improves UI interactions, and adds spam prevention measures. It's a testing release that should not be used in production environments but represents an important step toward the stable 0.5.0 release.

Highlight of the Release

• Enhanced user management with working delete user modal and multiple user invites
• Improved security with spam prevention for password resets and sign-ins
• Fixed post authorship issues and improved author selection
• Better notifications system that prevents stacking
• Improved mobile experience with proper touch events and navigation

Migration Guide

Migration Notes for 0.5.0-rc2

This is a release candidate intended for testing purposes only. No specific migration steps are required when upgrading from 0.5.0-rc1 to 0.5.0-rc2.

Important Notes:

• This RC only works in production mode - the JavaScript files for dev mode are missing
• Installation should be done with:

  npm install --production
  npm start --production
  

• No grunt tasks are required

If you're testing this release candidate, please refer to the related issue #3622 for details on what is being tested and how to get involved.

Upgrade Recommendations

As this is a release candidate (RC2), it is not recommended for production environments. This release is intended for testing purposes only to help identify and fix issues before the stable 0.5.0 release.

If you're currently running 0.5.0-rc1 and want to help with testing, upgrading to rc2 is recommended to provide feedback on the fixes and improvements.

For production environments, continue using the latest stable release until 0.5.0 final is available.

Installation instructions are available at http://support.ghost.org/installation.

Bug Fixes

Post Management Fixes

• Fixed issue where the most recent post could be "stolen" by the last logged-in user
• Fixed post authorship assignment problems
• Ensured keyboard navigation matches custom post sorting
• Fixed embedded code being removed from posts

User Management Fixes

• Fixed issue where admins weren't shown "make owner" option
• Added check to only show "Make Owner" option if displayed user is admin
• Prevented revoking invites for already active users
• Added descriptive error if user by email not found

UI and Navigation Fixes

• Fixed Ghost logo navigation to respond correctly on mobile
• Handled toggling the content screen on mobile
• Fixed display restoration after window resizing
• Added missing body class for author pages

Error Handling Fixes

• Improved settings error handling
• Added proper messaging for password reset processes
• Provided cleaner spam prevention error messages
• Fixed token refresh issues

New Features

User Management Improvements

• Added working delete user modal and button
• Enhanced invite system allowing multiple user invites in one session
• Added owner role to setup user
• Changed Users API to default to active users on read

Security Enhancements

• Added spam prevention measures limiting forgotten password requests to five per IP per hour
• Limited forgotten password requests to five per email address
• Limited sign-in requests to ten failed attempts per IP per hour

UI Improvements

• Updated markdown help modal with clearer shortcuts
• Added inline code shortcut for the editor
• Changed user menu popover toggle from a link to a button
• Swapped notification close link for a button
• Added autofocus on input fields after routing

Security Updates

Security Enhancements

• Implemented rate limiting for forgotten password requests (5 per IP per hour)
• Limited forgotten password requests to 5 per email address
• Limited sign-in requests to 10 failed attempts per IP per hour
• Fixed token refresh issues that could occur due to spam prevention measures
• Changed user menu link to a button for better accessibility and security

Performance Improvements

Performance Optimizations

• Small performance tweak for Posts ordering by moving publishedAtCompare to standalone function in closure scope
• Avoided getting the same field (published_at) more than once
• Replaced "touchstart" with "tap" event provided by hammer.js for better mobile performance
• Improved error handling throughout the application to prevent timeouts

Impact Summary

Ghost 0.5.0-rc2 represents a significant step toward the stable 0.5.0 release with numerous bug fixes and enhancements focused on improving the admin experience. The release addresses key issues in user management, post authorship, and security.

The most notable improvements include enhanced user management capabilities with a working delete user modal and multiple user invite functionality, improved security through spam prevention measures, and fixes for post authorship issues. The notification system has been refactored to prevent stacking, providing a cleaner user experience.

Mobile users will benefit from improved navigation and touch events, while content creators will appreciate the fixed authorship issues and enhanced editor features like the inline code shortcut.

This release candidate is specifically intended for testing and should not be used in production environments. However, it provides a good preview of the improvements coming in the stable 0.5.0 release.

Full Release Notes