Ghost Release: 2.20.1

TL;DR

Ghost 2.20.1: Bug Fixes and Members Authentication Improvements

This patch release focuses on fixing critical bugs related to content handling and notifications, while also implementing significant security improvements to the members authentication system. The update introduces a new server-side rendering approach for members authentication, enhances security by blacklisting private member settings for HTTP calls, and fixes several bugs including crashes with empty posts and outdated notifications.

Highlight of the Release

• Fixed critical bugs with empty post handling in RSS feeds and reading time calculations
• Enhanced security by preventing exposure of private keys and session secrets
• Improved members authentication with new server-side rendering approach
• Added support for coupon codes in the subscription process
• Improved UI for members pages with better animations, responsive design, and loading indicators

Migration Guide

Members Authentication Changes

If you're using custom code that interacts with the members authentication system, you'll need to be aware of the following changes:

• The members middleware no longer supports cookies. Cookie handling is now managed by middleware specific to server-side rendering.
• The site app no longer uses the members auth middleware.
• Several API changes have been made:
  • memberUserObject has been renamed to members for simplicity
  • The export of httpHandler has been replaced with a POJO apiInstance
  • Added getPublicConfig method
  • Added getMember method

If you're using any of these features directly, you'll need to update your code accordingly.

No database migrations are required for this update.

Upgrade Recommendations

This is a recommended upgrade for all Ghost users, especially for those who:

1. Use the members/subscription features
2. Have posts with empty content that might affect RSS feeds or reading time calculations
3. Were experiencing issues with incorrect out-of-date notifications

The release contains important security improvements for the members system and fixes for critical bugs that could cause crashes with empty posts.

The upgrade process follows the standard Ghost update procedure and doesn't require any database migrations. However, if you have custom code that interacts with the members authentication system, please review the migration guide.

Bug Fixes

Critical Fixes

• Fixed crash in calculating reading time for empty posts
• Fixed fetching RSS in case of posts with no content
• Fixed Ghost out-of-date notification that was incorrectly appearing
• Fixed theme loading crash when enableDeveloperExperiments is switched off
• Fixed subscription issues with null coupons

Other Fixes

• Fixed missing code property in error handling
• Fixed path for gateway bundle
• Fixed failing integration tests

New Features

Members Authentication Improvements

• Server-Side Rendering for Members: Implemented a new members-ssr approach for the theme layer, improving security and performance
• Coupon Support: Added support for passing coupon codes from metadata through to Stripe for subscriptions
• Members UI Enhancements:
  • Added signup complete page with fade-in animation
  • Added loading spinners to provide better feedback during authentication
  • Updated responsive styles for better mobile experience
  • Improved animation speeds for members pages
  • Added support for disabled form elements
  • Created CouponInput component for subscription pages

API Improvements

• Added getMember method to members API
• Added getPublicConfig method for better configuration access
• Exported getSiteUrl method from URL utilities
• Improved audience access control with more flexible configuration options
• Added DELETE handler for /members/ssr to enable theme-layer logout

Security Updates

Security Enhancements

• Blacklisted private member settings for HTTP calls: Previously, it was possible to fetch the private key and session secret for the members service, which could have potentially exposed secrets to admin integrations
• Improved session handling: Added theme_session_secret setting with dynamic default for secure session signing
• Enhanced token security: Updated token expiry to a hardcoded 20 minutes for improved security
• Improved audience access control: Updated how audience access control works with more granular configuration options

Performance Improvements

Authentication Performance

• Optimized token handling with a 20-minute expiry for improved security and performance
• Improved members authentication flow by removing unnecessary middleware
• Enhanced API structure with cleaner interfaces and reduced coupling between Ghost and Members services

UI Performance

• Improved animation speeds for members pages
• Enhanced responsive design for better performance on mobile devices

Impact Summary

Ghost 2.20.1 is primarily a bug fix and security enhancement release that addresses several critical issues while improving the members authentication system. The most notable impacts are:

1. Improved Stability: Fixed crashes related to empty posts in RSS feeds and reading time calculations, ensuring more reliable content delivery.

2. Enhanced Security: Blacklisted private member settings for HTTP calls, preventing potential exposure of sensitive information like private keys and session secrets.

3. Better Authentication: Implemented a new server-side rendering approach for members authentication, improving both security and user experience.

4. Subscription Enhancements: Added support for coupon codes in the subscription process, enabling more flexible pricing options.

5. UI Improvements: Enhanced the members pages with better animations, responsive design, and loading indicators for a more polished user experience.

These changes collectively improve Ghost's stability, security, and user experience without requiring any complex migration steps for most users.

Full Release Notes