Ghost Release: 2.31.0

TL;DR

Ghost 2.31.0 introduces magic link sign-in for members, Stripe checkout integration, and several bug fixes including improved error handling and CORS issues with private sites. This release enhances the membership functionality while improving overall stability and user experience.

Highlight of the Release

• Magic link sign-in for members
• Stripe checkout integration for paid memberships
• Improved error handling for malformed paths and asset helpers
• Fixed CORS issues with private sites using separate admin URLs
• Member data caching for better performance

Migration Guide

Members Table Schema Changes

The name and password columns have been removed from the members table as they are no longer needed. If you have custom code that relies on these columns, you will need to update it.

Members API Changes

If you're using the members API directly:

• getMember now returns null rather than throwing an exception when a member is not found
• You can remove try/catch statements without having to pass the Ghost/bookshelf specific require: false option

Members JavaScript

The members.js file has been converted to ES5 for better compatibility. If you have custom code that extends or modifies this file, you may need to update it.

Upgrade Recommendations

This release is recommended for all Ghost users, especially those using or planning to use the Members feature. The introduction of magic link sign-in and Stripe checkout integration significantly enhances the membership capabilities.

How to upgrade:

1. Back up your database before upgrading
2. If using Ghost-CLI: Run ghost update to update to Ghost 2.31.0
3. If using Docker or custom installation: Follow your standard upgrade process

Special considerations:

• If you have custom code interacting with the members table, note that the name and password columns have been removed
• If you're using a custom theme with members functionality, test the magic link sign-in and Stripe checkout features after upgrading

Bug Fixes

Fixed "View site" Screen on Private Sites

Fixed an issue where the "View site" screen in admin would fail on private sites with separate admin URLs due to missing CORS headers. The solution implements a dynamic CORS options function that allows requests from:

• Same-origin requests
• Localhost or 127.0.0.1 with any protocol and port
• Origins matching the configured URL hostname/port
• Origins matching the configured admin URL hostname/port

Fixed Browser Back Button Behavior

Resolved a long-standing issue (#1306) with browser back button behavior after clicking "x posts" on the tags screen.

Improved Error Handling

• Fixed storage adapter to return correct error codes for malformed paths instead of 500 errors
• Added guard to asset helper for missing paths to prevent 500 errors
• Added better error handling for unusual handlebars syntax
• Switched private login brute force errors to use 429 status code instead of 500

Other Fixes

• Fixed regression tests expecting relative URLs for admin redirects
• Reverted oembed-parser dependency to 1.2.2 to fix oembed regression tests

New Features

Magic Link Sign-in for Members

Ghost now supports passwordless authentication for members through magic links. This provides a more seamless login experience without requiring members to remember passwords.

Stripe Checkout Integration

This release adds support for Stripe checkout, enabling paid memberships:

• Added stripe.js to ghost_head when members are enabled
• Implemented multiple members-forms support
• Added endpoint for identity token to link payments to correct members

Member Data Caching

Implemented caching of member data in the ghost-members-ssr-cache cookie, improving performance for member-related operations.

Developer Improvements

• Added createColumnMigration helper for database migrations
• Updated getMember to return null rather than throw exceptions, simplifying error handling in members code

Security Updates

Improved Error Handling for Malformed Paths

Fixed an issue where malformed paths in image URLs (such as http://localhost:2368/content/images/2018/02/%c0%af) were throwing 500 errors instead of properly handling the error. This could potentially have been exploited to cause server errors.

Proper Status Codes for Login Brute Force Protection

Changed the error status code for too many login attempts on the /private/ form from 500 to the more appropriate 429 ("Too Many Requests"), which is consistent with other rate-limiting endpoints in Ghost. This improves security by properly identifying and handling brute force attempts.

Performance Improvements

Member Data Caching

Implemented caching of member data in the ghost-members-ssr-cache cookie, which reduces the need for repeated API calls and improves overall performance for member-related operations.

Dependency Updates

Several dependencies were updated to newer versions which may include performance improvements:

• Updated bookshelf-relations to v1.1.2
• Updated knex to v0.19.3
• Updated @tryghost/helpers to v1.1.9
• Updated @tryghost/url-utils to v0.3.1
• Updated @tryghost/html-to-mobiledoc to v0.6.0

Impact Summary

Ghost 2.31.0 represents a significant enhancement to the membership functionality with the introduction of magic link sign-in and Stripe checkout integration. These features make it easier for publishers to monetize their content through paid memberships while providing a seamless experience for members.

The release also addresses several important bugs, particularly fixing CORS issues with private sites using separate admin URLs and improving error handling throughout the system. This results in a more stable and secure platform.

For developers, the release includes helpful improvements like the new createColumnMigration helper, better error handling patterns, and dependency updates. The alphabetical sorting of dependencies in package.json will result in cleaner diffs when installing or updating packages.

Overall, this release enhances Ghost's capabilities as a professional publishing platform with improved membership features while maintaining stability and security.

Full Release Notes