search

SNathJr / ghost-on-heroku

One-button Heroku deploy for the Ghost 3.2.0 blogging platform.
https://snathjr.github.io/ghost-on-heroku/
Other
232 stars 251 forks source link

Update Ghost to 4.5.0 (incl. Security Update) #79

Closed fabiogermann closed 3 years ago

fabiogermann commented 3 years ago

Updated to 6.1 and from there to 6.3.3 as there was an XSS vulnerability.

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

codepar commented 3 years ago

@fabiogermann On your last commit, you have removed some themes (including Lyra). I'm using Lyra, anything wrong with it? (I was just about to copy your changes to my code as I can't seem to be able to upgrade my heroku installation with a simple 'npm upgrade ghost')

fabiogermann commented 3 years ago

@codepar: no, nothing in particular. I just removed all "non essential" dependencies as some of them contained vulnerable dependencies. As Casper is the default theme I just kept that one. Personally I use a custom theme, that is why for me it made sense to remove the others too. But please feel free to re-add the Lyra theme in your package.json.

I regularly check the latest version for ghost on github, edit the package json and adapt the version, "npm update", "npm install" (just to test again), git add ..., git push (to heroku).

codepar commented 3 years ago

@fabiogermann Many thanks Fabio.

For others in the future, with Fabio's contributions I've managed to update to Ghost 4.4 (I did not do 4.5 yet as it seems Ghost is seeing some issues with it and will re-release it soon again)

Thanks again for this contribution!

One completely unrelated question: Do you know of a way to do local development with this setup? I have created special extra pages (.hbs) in a slightly customized Lyra theme I have locally (I don't read from Ghost's theme repos) and would like to see what I am doing locally before I push them to prod. (right now I can only see those in production)

So far I've only been able to install a completely new instance locally and that does not read from my theme files (inside content/themes/lyra)

fabiogermann commented 3 years ago

@codepar I know what your talking about - I also have a custom theme. What I did was:

If you then want to commit the changes to the custom theme you must use git add -f as the themes directory is in the gitignore for obvious reasons.

I guess the important point here is that you can not customize a theme that is listed in the package.json - therefore you need to copy the folder as explained above.

codepar commented 3 years ago

Many thanks @fabiogermann for commenting again.

That far I had managed to implement. Things are ok in prod I can see my custom theme there (all as I wanted). But I cannot see my custom theme locally. Whenever I run "npm start" either on root or content folder I get to see the standard theme and not my custom theme.

I've tried fiddling with config.development.json but no luck to force the local development instance to reflect my custom theme. So right now I only see my changes in production.

Should you have any pointers I'd really appreciate it.

EDIT: Nevermind, I obviously had to point to Lyra inside the dashboard. All sorted now. Thanks again for your help!

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

rohitgehe05 commented 3 years ago

hey a little bit of a newbie here @fabiogermann @codepar how did you manage to upgrade ghost to 4.5.0? i ran the commands as mentioned in the readme but wasn't able to upgrade beyond 3.42.5 my node version is v10.24.1

for reference, these are the commands i ran

npm upgrade ghost
git add package.json package-lock.json
git commit -m 'Update dependencies'
git push heroku master
fabiogermann commented 3 years ago

@rohitgehe05 I feel your pain. Unfortunately the upgrade from 3.x to 4.x is a bit more complex. You really must change all the files that I changed in this pull request - feel free to copy my changes 1:1! A simple dependency update will not suffice. To be on the safe side if you have a custom theme I recommend to switch to a default theme before upgrade.

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

fabiogermann commented 3 years ago

@SNathJr is there any plan to support the 4.x version of ghost? the stale bot is quite strict and I would like to merge this if possible before it is auto-closed.

shyrz commented 3 years ago

Nice work! Better if update Ghost source code to v4.7.0. Its just released 12d ago.

shyrz commented 3 years ago

@fabiogermann Thx for ur works! However, I got some issues while publishing my post after the deployment, here's the output: 

select `sessions`.* from `sessions` where `sessions`.`session_id` = '88ZEn3hevot1bchvTSLOrQgyKPJGIJKK' limit 1 - ER_USER_LIMIT_REACHED: User 'o5fmxrd9cfl0s98z' has exceeded the 'max_questions' resource (current value: 3600)
fabiogermann commented 3 years ago

Sorry about the close/open - pushed the wrong button in the GitHub mobile app.

@shyrz this looks to me as if you reached some kind of limit either within Ghost or you Deployment. This usually doesn't have anything to do with the 'ghost-on-heroku' project. Did you update to 4.7.0 or 4.5.0?

On a side note: the reason for not updating to 4.7.0 are some features that they (ghost) rolled back in 4.6.x and will only re-introduce back in a future version (and those features I currently use in prod) therefore I will most likely skip 4.7.0.

rohitgehe05 commented 3 years ago

@fabiogermann Thx for ur works! However, I got some issues while publishing my post after the deployment, here's the output:

select `sessions`.* from `sessions` where `sessions`.`session_id` = '88ZEn3hevot1bchvTSLOrQgyKPJGIJKK' limit 1 - ER_USER_LIMIT_REACHED: User 'o5fmxrd9cfl0s98z' has exceeded the 'max_questions' resource (current value: 3600)

@shyrz — I ran into the same issue, it's a Heroku thing. The free dyno that you are using allows 3600 questions/hr for your JawsDB add-on. You can read more about it here image

rohitgehe05 commented 3 years ago

Sorry about the close/open - pushed the wrong button in the GitHub mobile app.

@shyrz this looks to me as if you reached some kind of limit either within Ghost or you Deployment. This usually doesn't have anything to do with the 'ghost-on-heroku' project. Did you update to 4.7.0 or 4.5.0?

On a side note: the reason for not updating to 4.7.0 are some features that they (ghost) rolled back in 4.6.x and will only re-introduce back in a future version (and those features I currently use in prod) therefore I will most likely skip 4.7.0.

@fabiogermann — looks like @SNathJr is Away, is there any way you can merge this? Else if you have the time, perhaps you could share your fork of the 4.0 version of Ghost-on-Heroku, I'm sure a lot of people are looking for this 😄 (obviously, if you're not busy)

fabiogermann commented 3 years ago

@rohitgehe05 thanks for the push :-) I now moved this PR to a branch of my fork and merged the changes to my master. Heroku-Deploy now works when clicking it on my fork with version 4.x (as it should). Feel free to add PRs and bugs to that fork.

New PR (with correct branch) for "old fork": https://github.com/SNathJr/ghost-on-heroku/pull/81 (just for completeness)

My now officially forked version in my repository for 4.x: https://github.com/intra-sh/ghost-on-heroku