Ghost 5 is running, but the theme broke - then ghost broke

Developer help Self-hosting
1

While I can access my running ghost site, the theme (a slight variant of Caspar) is apparently broken.

I ran ghost backup then ghost doctor which recommended that I update the permissions of some files, which I did as it instructed:

sudo find ./ ! path "./versions/*" -type f -exec chmod 664 {} \;

at this point ghost doctor seemed okay and my backup ran but it recommended updating for 5.94.0 to 5.130.6 which it refused to do until I updated to ghost-cli@latest which failed, as did any attempt at ghost update or even, now ghost doctor – all fail complaining that code with require("inquirer") be re-written.

I really didn’t plan to need to rewrite an old version of Ghost just to fix some CSS. Can I just install v6 and populate from my backup?

2

You really really need to update. There are vulnerabilities — bad ones — for 5.x being actively exploited. If restoring from backup gets it done, great.

If you want to keep comments, history, etc, the trick will be to slowly walk both the cli and the ghost version forward.

3

I care less about comments and history than content. But I’m wondering how to do anything if even ghost doctor won’t run, much less ghost update etc.

4

…or even ghost stop – what to do to halt Ghost v5 so that I can get a docker w/v6 running on that server? Ah, :confused:

5

No one mentioned features. Cathy only mentioned security. If you want to be held liable for client information, go ahead and keep running your site insecurely.
Your content means nothing if it gets plagued by a bad actor.

6

Not really sure I follow your point, but I can’t imagine being held liable for anything on my site. Nothing there is sensitive.

It’s not that I don’t want to update, it’s that (CSS) resources from my Theme appear to have shifted, which broke under version 5.94.0, which in turn nose-dived when I tried to update it to a more recent edition. I’m being externally forced to update everything, apparently (which is a situation using open-source is supposed to help ameliorate, but that’s another issue). Just trying to find the least-hazardous path forward.

7

I can’t imagine what in the Ghost core would impact theme CSS though. Especially since 5.94.0 looks pretty harmless in itself.

FOSS does mean you can do what you want, yeah. You can choose not to update. Though that will leave you vulnerable to somebody literally fetching all data from your database, write new data into it, including putting malicious phishing and malware banners on your site through code injection:

You can do what you want – though I don’t see a logical argument in favour of staying on a known insecure version. The “external force”, in this case, is a known security vulnerability that we know is actively exploited. Not the Ghost Foundation or us telling you what to do.

The exact error trace would be a great start. What commands ran, what came back, etc.