sneak
e422a5b10d
check / check (push) Waiting to run
Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`, passes at the default settings and while bodies are read. It covers public pages, members' sign-up and sign-in, the admin, the editor saving and publishing posts and pages with code blocks and HTML cards, tags, settings, staff invitations, uploads, newsletter settings, and both APIs. Ghost's fixes, in the new `ghost.conf`, let through `filter`, the member `search` and the embed `url` in the query, and plain text, addresses, articles, code injection and passwords in JSON bodies. A `<script>` element and a `javascript:` link stay refused in articles and code injection. `SWW_APPS` names Ghost `ghost`. `README.md` lists Ghost; `SPEC.md` lists its fixes. Model: opus-5-5