Skip to content

Commit

Permalink
revert last pr (tinacms#2805)
Browse files Browse the repository at this point in the history
  • Loading branch information
joshbermanssw authored Jan 29, 2025
1 parent f02ca4b commit b751e42
Show file tree
Hide file tree
Showing 138 changed files with 472 additions and 757 deletions.
3 changes: 0 additions & 3 deletions content/blog/2023-02-security-update.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,6 @@ title: 'TinaCMS Security Alert: Information Exposure for versions >= 1.0.0, < 1.
date: '2023-02-06T04:00:00.000Z'
last_edited: '2023-02-06T04:00:00.000Z'
author: TinaCMS Team
seo:
description: >-
'Security alert for TinaCMS versions >= 1.0.0, < 1.0.9, addressing information exposure and recommended updates.'
---

There has been a recent security vulnerability that has been discovered in our open-source library.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,23 +4,19 @@ date: '2024-12-23T13:00:00.000Z'
author: Matt Wicks
prev: content/blog/referential-integrity.mdx
next: ''
seo:
description: >-
'Public disclosure of a security breach in TinaCloud involving compromised
AWS access keys and unauthorized email activity.'
---

## Overview of the Incident

On 15th December 2024, TinaCMS identified unauthorized activity involving compromised AWS access keys. These keys were exploited to send unauthorized emails (targeting the general French community, not Tina customers specifically) using our Amazon Simple Email Service (SES) infrastructure.

![A screenshot of one of the phishing emails](/img/blog/2024-12-tinacloud-public-disclosure-security-breach/phishing-email.png 'Figure: the emails sent were in French')**Figure: the emails sent were in French**
![A screenshot of one of the phishing emails](/img/blog/2024-12-tinacloud-public-disclosure-security-breach/phishing-email.png "Figure: the emails sent were in French")**Figure: the emails sent were in French**

As an automated measure, the impacted key was revoked. Afterwards, our team confirmed the extent of the incident using CloudTrail logs, investigated root cause, and took steps (described below) to secure our systems.

Outbound email functionality, including user invitations, was impacted. This has since been resolved.

We apologize for this, and we are confident that it won't happen again.
We apologize for this, and we are confident that it wont happen again.

## Incident Details

Expand All @@ -32,20 +28,20 @@ Type of Incident: Unauthorized use of AWS access keys

Services Impacted:

- Amazon SES (email sending)
- User invitation workflows relying on outbound email
* Amazon SES (email sending)
* User invitation workflows relying on outbound email

Nature of Access:

- AWS access keys with root permissions were compromised and misused
* AWS access keys with root permissions were compromised and misused

Verification:

- CloudTrail logs were used to confirm which systems and services were accessed during the incident
* CloudTrail logs were used to confirm which systems and services were accessed during the incident

## Root Cause Analysis

The unauthorized access was traced to a vulnerability in our CI/CD pipeline. During the build process, a step in the GitHub Actions workflow inadvertently wrote the GitHub Actions Runner's environment variables, including sensitive AWS access keys, to a JavaScript file.
The unauthorized access was traced to a vulnerability in our CI/CD pipeline. During the build process, a step in the GitHub Actions workflow inadvertently wrote the GitHub Actions Runners environment variables, including sensitive AWS access keys, to a JavaScript file.

The JavaScript file containing the keys was subsequently deployed and served publicly as part of TinaCloud, allowing attackers to obtain the access keys directly from the front-end code.

Expand Down Expand Up @@ -74,13 +70,13 @@ This includes content databases, end user login information, access to applicati
MFA (Multi-Factor Authentication) is enabled on all user accounts that have console access
Revoked access to all unnecessary users
4. ✅ Done - Suspension of email sending:
Outbound email services were temporarily suspended whilst we were ascertaining root cause and AWS's review.
Outbound email services were temporarily suspended whilst we were ascertaining root cause and AWSs review.
Services have now been restored.
5. ✅ Done - CI/CD AWS access:
Authentication for the GitHub Actions has been upgraded from long lived Access Keys to OIDC
6. ✅ Done - Build process:
The build process was reviewed, and the handling of environment variables was updated.
The use of process.env was replaced with import.meta, following best practices outlined in [Vite's documentation](https://vite.dev/config/shared-options.html#define), to prevent sensitive data from being exposed in build artifacts.
The use of process.env was replaced with import.meta, following best practices outlined in [Vites documentation](https://vite.dev/config/shared-options.html#define), to prevent sensitive data from being exposed in build artifacts.
7. ✅ Done - Repository secrets audit:
A thorough audit of all GitHub repositories is being conducted to identify any other sensitive information that may have been inadvertently exposed in past builds or commits
8. \[TODO] Hardened IAM policies:
Expand All @@ -94,16 +90,16 @@ This includes content databases, end user login information, access to applicati

## Advice to Tina Customers

1. Report suspicious emails: If you received unauthorized or suspicious emails from TinaCMS, please report them to [[email protected]](mailto:[email protected])
1. Report suspicious emails: If you received unauthorized or suspicious emails from TinaCMS, please report them to [[email protected]](mailto\:[email protected])
2. Verify email origin: Ensure any emails claiming to be from TinaCMS are legitimate
3. Stay updated: Follow our official communication channels for real-time updates

## Contact Information

For questions, concerns, or further information, please contact:

- Email: [[email protected]](mailto:[email protected])
- Website: [https://tina.io/security](https://tina.io/security)
* Email: [[email protected]](mailto\:[email protected])
* Website: [https://tina.io/security](https://tina.io/security)

TinaCMS remains committed to protecting our systems and maintaining transparency.

Expand Down
3 changes: 0 additions & 3 deletions content/blog/two_factor_authentication.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,6 @@ last_edited: '2024-12-15T05:00:00.000Z'
author: Kelly Davis
prev: content/blog/referential-integrity.mdx
next: ''
seo:
title: Two-Factor Authentication Now Available in Tina Cloud | TinaCMS Blog
description: Tina Cloud now supports Multi-Factor Authentication (MFA), adding an extra layer of security to protect your content management system
---

Introducing Multi-Factor Authentication (MFA) Support in Tina Cloud
Expand Down
3 changes: 0 additions & 3 deletions content/blog/version-2.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,6 @@ date: '2024-07-20T14:00:00.000Z'
last_edited: '2024-07-24T14:00:00.000Z'
author: Jack Pettit
draft: false
seo:
title: Announcing TinaCMS Version 2.0 | TinaCMS Blog
description: Discover TinaCMS 2.0's powerful new features, SSW acquisition news, and upcoming enhancements to revolutionize content management
---

### Announcing TinaCMS Version 2.0: A New Era of Content Management
Expand Down
2 changes: 0 additions & 2 deletions content/docs/cli-overview.mdx
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
---
title: The TinaCMS CLI
next: content/docs/reference/media/overview.mdx
seo:
description: Learn about the TinaCMS command-line interface (CLI) tools for building, developing, and managing your Tina-powered website
---

## Available Commands
Expand Down
7 changes: 3 additions & 4 deletions content/docs/contextual-editing/overview.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
---
id: /docs/contextual-editing/overview
title: Visual Editing Overview
next: content/docs/contextual-editing/router.mdx

title: Visual Editing
next: content/docs/contextual-editing/react.mdx
previous: content/docs/features/data-fetching.mdx
seo:
description: Introduction to TinaCMS's Visual Editing feature that enables inline content editing directly on your website's frontend
---

Out of the box, once you define a new collection in Tina, its content becomes available through the "basic editor".
Expand Down
8 changes: 3 additions & 5 deletions content/docs/contextual-editing/react.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/contextual-editing/react
title: React Components
next: content/docs/contextual-editing/tinafield.mdx
previous: content/docs/contextual-editing/router.mdx
seo:
description: Guide to implementing Visual Editing in React applications using TinaCMS's React components and hooks
title: Visual Editing in React
next: content/docs/contextual-editing/vue.mdx
previous: content/docs/contextual-editing/overview.mdx
---

> **Visual Editing Requirements:**
Expand Down
8 changes: 3 additions & 5 deletions content/docs/contextual-editing/router.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/contextual-editing/router
title: Router Setup
next: content/docs/contextual-editing/react.mdx
previous: content/docs/contextual-editing/overview.mdx
seo:
description: Guide to configuring TinaCMS's router integration for Visual Editing, with examples for different routing frameworks

title: Setting up a Router for Visual Editing
previous: content/docs/contextual-editing/vue.mdx
---

## Accessing contextual-editing from the CMS
Expand Down
7 changes: 2 additions & 5 deletions content/docs/contextual-editing/tinafield.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,6 @@
---
id: /docs/contextual-editing/tinafield
title: TinaField Component
next: content/docs/contextual-editing/vue.mdx
previous: content/docs/contextual-editing/react.mdx
seo:
description: Documentation for TinaCMS's TinaField component, enabling click-to-edit functionality in your Visual Editing interface
title: The tinafield helper
---

## Introduction
Expand Down Expand Up @@ -147,3 +143,4 @@ styles are encouraged. Here's an example of overriding the outline color to red:
.__tina-quick-editing-enabled [data-tina-field]:hover {
outline: 2px dashed rgba(254, 34, 56, 1);
}
```
8 changes: 3 additions & 5 deletions content/docs/contextual-editing/vue.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/contextual-editing/vue
title: Vue Support
next: content/docs/editing/overview.mdx
previous: content/docs/contextual-editing/tinafield.mdx
seo:
description: Information about upcoming Vue.js support in TinaCMS's Visual Editing feature, including planned features and implementation details
title: Visual Editing in Vue
next: content/docs/contextual-editing/router.mdx
previous: content/docs/contextual-editing/react.mdx
---

Supporting Vue is currently in [our backlog](https://github.com/tinacms/tinacms/issues/4691 "Vue support PBI"). In the meantime, you can use the basic editor to edit your content.
2 changes: 0 additions & 2 deletions content/docs/contributing/guidelines.mdx
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
---
id: /docs/contributing/guidelines
title: Contribution Guidelines
seo:
description: Guidelines for contributing to TinaCMS through bug reports, feature suggestions, documentation, testing, and code contributions
---

<WarningCallout body="This page is out of date - check out [the TinaCMS GitHub](https://github.com/tinacms/tinacms/blob/main/CONTRIBUTING.md) for the latest contribution information" />
Expand Down
2 changes: 0 additions & 2 deletions content/docs/contributing/releasing.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,6 @@ consumes:
- file: README.md
details: 'Shows crelease process, should mirror'
title: Contribution Releases
seo:
description: Guide to TinaCMS release process for contributors, including version management, publishing packages, and release documentation
---

<WarningCallout body="This page is out of date - check out [the TinaCMS GitHub](https://github.com/tinacms/tinacms/blob/main/CONTRIBUTING.md) for the latest contribution information" />
Expand Down
3 changes: 0 additions & 3 deletions content/docs/contributing/setting-up.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,6 @@ consumes:
details: 'Shows commands, how to get started'
title: Contribution Set-up
last_edited: '2021-02-18T13:05:33.946Z'
seo:
description: Step-by-step guide for setting up your local development environment to contribute to the TinaCMS open source project

---

<WarningCallout body="This page is out of date - check out [the TinaCMS GitHub](https://github.com/tinacms/tinacms/blob/main/CONTRIBUTING.md) for the latest contribution information" />
Expand Down
2 changes: 0 additions & 2 deletions content/docs/contributing/style-guide.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,6 @@ title: Style Guide
last_edited: '2024-09-11T05:35:54.162Z'
next: ''
previous: ''
seo:
description: Guidelines for maintaining consistent branding, tone, and writing style when contributing to TinaCMS documentation and blog posts
---

This document should be used as a guideline when writing documentation and blog posts on [tinacms.io](http://tinacms.io)
Expand Down
2 changes: 0 additions & 2 deletions content/docs/contributing/troubleshooting.mdx
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
---
id: /docs/contributing/troubleshooting
title: Contribution Troubleshooting
seo:
description: Solutions to common problems encountered while developing for TinaCMS, including package building and dependency management issues
---

<WarningCallout body="This page is out of date - check out [the TinaCMS GitHub](https://github.com/tinacms/tinacms/blob/main/CONTRIBUTING.md) for the latest contribution information" />
Expand Down
2 changes: 0 additions & 2 deletions content/docs/data-fetching/custom-queries.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,6 @@ title: Writing Custom Queries
last_edited: '2024-12-04T06:28:14.144Z'
next: ''
previous: content/docs/data-fetching/overview.mdx
seo:
description: Learn how to write custom GraphQL queries in TinaCMS for advanced data fetching scenarios and extend the auto-generated client queries
---

For most simple cases, you should be able to leverage the Tina Client's generated queries to do your data fetching:
Expand Down
6 changes: 2 additions & 4 deletions content/docs/data-fetching/overview.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/data-fetching/overview
title: Data Fetching

title: Querying content
next: content/docs/data-fetching/custom-queries.mdx
previous: content/docs/schema.mdx
seo:
description: Learn how to fetch and query content in TinaCMS using the Content API, with support for filtering, sorting, pagination, and relational data
---

## Introduction
Expand Down
7 changes: 3 additions & 4 deletions content/docs/drafts/drafts-fields.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
---
id: /docs/drafts/drafts-fields
title: Using Draft Fields
id: /docs/drafts/draft-fields

title: Draft Fields
next: content/docs/drafts/editorial-workflow.mdx
previous: content/docs/drafts/overview.mdx
seo:
description: Learn how to implement draft functionality in TinaCMS using draft fields to manage document states in your content collections
---

Adding a "Draft Field" is one approach to handling "drafts" in TinaCMS
Expand Down
7 changes: 3 additions & 4 deletions content/docs/drafts/editorial-workflow.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
---
id: /docs/drafts/editorial-workflow

title: Editorial Workflow
last_edited: '2023-06-14T04:00:00.000Z'
previous: content/docs/drafts/drafts-fields.mdx
seo:
description: Learn about TinaCMS's Editorial Workflow feature that enables content teams to work on multiple branches and manage content through pull requests
---

<Youtube embedSrc="https://www.youtube.com/embed/gYukiULGqGc" />
Expand Down Expand Up @@ -45,7 +44,7 @@ When you are ready to publish your content, merge the draft pull request into th

## GitHub Pull Request links

In the branch list modal, you can click on the dropdown and click "View Pull Request" to view the pull request on GitHub. This will open a new tab in your browser. This link will only appear if the pull request has been created with TinaCMS and not if it was created manually.
In the branch list modal, you can click on the dropdown and click "View Pull Request" to view the pull request on GitHub. This will open a new tab in your browser. This link will only aprear of the pull request has been created with TinaCMS and not if it was created manually.

![PR Links](/img/docs/editorial-workflow/preview-link.png)

Expand All @@ -63,7 +62,7 @@ This will allow you to preview your content changes before merging them into the
export default defineConfig({
// ...
ui: {
// Eg. If you're deploying to Vercel, and your repo name is 'my-app', Vercel's preview URL would be based on the branch:
// Eg. If you're deplying to Vercel, and your repo name is 'my-app', Vercel's preview URL would be based on the branch:
previewUrl: (context) => {
const repoName = 'my-app'
// `https://<project-name>-git-<branch-name>.vercel.app`
Expand Down
6 changes: 2 additions & 4 deletions content/docs/drafts/overview.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/drafts/overview
title: Draft Content Overview

title: Drafts in TinaCMS
next: content/docs/drafts/drafts-fields.mdx
previous: content/docs/data-fetching/custom-queries.mdx
seo:
description: Explore different ways to implement draft functionality in TinaCMS, including document-based draft states and working with Git branches
---

TinaCMS supports a few implementations of "drafts".
Expand Down
9 changes: 4 additions & 5 deletions content/docs/editing/blocks.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
---
id: /docs/editing/blocks
title: Block-Based Editing
next: content/docs/editing/markdown.mdx
previous: content/docs/editing/overview.mdx
seo:
description: Guide to implementing block-based content editing in TinaCMS, allowing flexible page composition with reusable content blocks
title: Block-based editing
last_edited: '2024-12-04T04:48:32.050Z'
next: content/docs/editing/single-document-collections.mdx
previous: content/docs/editing/markdown.mdx
---

Tina supports block-based editing, so that your editors can build out full pages using your pre-defined blocks.
Expand Down
8 changes: 3 additions & 5 deletions content/docs/editing/markdown.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/editing/markdown
title: Markdown Editing
next: content/docs/editing/single-document-collections.mdx
previous: content/docs/editing/blocks.mdx
seo:
description: Learn how to use TinaCMS's Markdown editor for content creation, with support for rich text formatting and media embedding
title: Markdown & MDX
next: content/docs/editing/blocks.mdx
previous: content/docs/editing/overview.mdx
---

## Overview
Expand Down
8 changes: 3 additions & 5 deletions content/docs/editing/overview.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
---
id: /docs/editing/overview
title: Content Editing Overview
next: content/docs/editing/blocks.mdx
previous: content/docs/contextual-editing/router.mdx
seo:
description: Overview of TinaCMS's content editing features, including block-based editing, Markdown support, and single document collections

title: Editing with Tina
next: content/docs/editing/markdown.mdx
---

Tina is very flexible & extendable, so there are lots of different supported ways to edit content with Tina.
Expand Down
6 changes: 2 additions & 4 deletions content/docs/editing/single-document-collections.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@
id: /docs/editing/single-document-collections
title: Single Document Collections
last_edited: '2023-03-28T04:00:00.000Z'
next: content/docs/extending-tina/overview.mdx
previous: content/docs/editing/markdown.mdx
seo:
description: Guide to creating and managing single document collections in TinaCMS for global site settings and standalone content pages
next: ''
previous: content/docs/editing/blocks.mdx
---

## Overview
Expand Down
4 changes: 1 addition & 3 deletions content/docs/errors/ambiguous-template.mdx
Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
---
title: Ambiguous Template
last_edited: '2023-10-23T04:00:00.000Z'
seo:
description: Troubleshooting guide for the ambiguous template error in TinaCMS, which occurs when a required template key is missing from a document
---

This error happens when a collection uses templates and there is no template key found in the document. It is common for this to happen when migrating from fields to templates or during forestry migration.

## How to fix

This error can be fixed by adding a root level field of _template to every document with this error. There is not currently any way to automatically migrate the content and it must be done manually or with custom scripts.
This error can be fixed by adding a root level field of \_template to every document with this error. There is not currently any way to automatically migrate the content and it must be done manually or with custom scripts.

Ex:
If you had a markdown file you would add:
Expand Down
Loading

0 comments on commit b751e42

Please sign in to comment.