Overview - Ghost

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
claude/ghost-nav-icon-save-bug-93f29b
b92da09d Merge 02964ede83c567fe3cd22fc45ec4c15046d0391b into aba044eb9b6b82a95b91b036c6c6792481791d63
by Austin Bur...
Succeeded
30476
02964ede 🐛 Fixed navigation icons failing to save on local installs ref https://forum.ghost.org/t/working-locally-on-navigation-and-cant-save-icons/63703 Navigation icon URLs are validated with `validator.isURL`, which defaults to `require_tld: true`. Admin uploads an icon and sends back the absolute site URL, so on a local install that is `http://localhost:2368/content/images/...`. `localhost` has no TLD, the icon regex only covers `/...` and `__GHOST_URL__/...`, and input validation runs before the URL transform in the serializer — so every save was rejected with a 422 "Please enter a valid navigation item". The navigation `url` field never hit this because its regex accepts any scheme prefix. Rather than dropping `require_tld` altogether, which would also accept arbitrary single-label hosts such as `http://intranet/icon.svg` on production sites, the TLD requirement is kept and an exception is made for a parsed hostname of exactly `localhost`. The protocol allowlist still applies, so `ftp://localhost:2368/icon.svg` stays invalid. The existing test passed because the test config URL is an IP address, which `isURL` accepts — the same reason `127.0.0.1:2368` was the forum workaround. The new tests use a literal localhost icon URL and lock down the scope of the exception from both sides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
by Austin Bur...
Succeeded
30476
0c0a94b7 🐛 Fixed navigation icons failing to save on local installs ref https://forum.ghost.org/t/working-locally-on-navigation-and-cant-save-icons/63703 Navigation icon URLs are validated with `validator.isURL`, which defaults to `require_tld: true`. Admin uploads an icon and sends back the absolute site URL, so on a local install that is `http://localhost:2368/content/images/...`. `localhost` has no TLD, the icon regex only covers `/...` and `__GHOST_URL__/...`, and input validation runs before the URL transform in the serializer — so every save was rejected with a 422 "Please enter a valid navigation item". The navigation `url` field never hit this because its regex accepts any scheme prefix. Turning off `require_tld` for icons keeps the protocol allowlist intact (ftp:, mailto:, javascript: and whitespace are still rejected) while allowing any TLD-less host, which also covers container hostnames. The existing test passed because the test config URL is an IP address, which `isURL` accepts — the same reason `127.0.0.1:2368` was the forum workaround. The new test uses a literal localhost icon URL. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
by Austin Bur...