Bug 29155

Summary: Upgrade jquery version to 3.6.0
Product: Koha Reporter: Lucas Gass <lucas>
Component: Architecture, internals, and plumbingAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, eugenegf, jonathan.druart, kyle, nick, oleonard, victor, wizzyrea
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00
Bug Depends on: 11873, 14862, 15883, 30011    
Bug Blocks: 30975, 30640, 30709, 31358, 31653    
Attachments: Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
Bug 29155: Update links to jQuery and jQuery Migrate files
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
Bug 29155: Update links to jQuery and jQuery Migrate files
Bug 29155: (follow-up) Work around change to jQueryUI tab API
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
Bug 29155: Update links to jQuery and jQuery Migrate files
Bug 29155: (follow-up) Work around change to jQueryUI tab API
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
Bug 29155: Update links to jQuery and jQuery Migrate files
Bug 29155: (follow-up) Work around change to jQueryUI tab API

Description Lucas Gass 2021-10-01 22:11:02 UTC
Koha currently jQuery version 2.2.3 on the staff client and 3.4.1 on the OPAC. 

There are known vulnerabilities in versions less than 3.5.0:
https://www.cvedetails.com/cve/CVE-2020-11023/


Perhaps it is time to upgrade to a more secure version.
Comment 1 Liz Rea 2021-11-09 19:48:00 UTC
This vulnerability really seems like it could be not great, we use the mentioned methods a lot.

This will be a fairly big job I reckon?
Comment 2 Eugene Espinoza 2022-01-13 08:39:10 UTC
Addendum for vulnerability for Jquery 3.4.1 (OPAC): https://snyk.io/vuln/npm:jquery@3.4.1
Comment 3 Owen Leonard 2022-02-07 14:19:21 UTC Comment hidden (obsolete)
Comment 4 Owen Leonard 2022-02-09 17:50:52 UTC Comment hidden (obsolete)
Comment 5 Owen Leonard 2022-02-09 17:50:56 UTC Comment hidden (obsolete)
Comment 6 David Cook 2022-04-13 00:30:23 UTC
Sorry, Owen. It looks like this needs a rebase.

root@kohadevbox:koha(bug29155)$ git bz apply 29155

Bug 29155 - Upgrade jquery version

130408 - Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
130409 - Bug 29155: Update links to jQuery and jQuery Migrate files

Apply? [(y)es, (n)o, (i)nteractive] y
Applying: Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions
Applying: Bug 29155: Update links to jQuery and jQuery Migrate files
error: sha1 information is lacking or useless (koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc).
error: could not build fake ancestor
Patch failed at 0001 Bug 29155: Update links to jQuery and jQuery Migrate files
hint: Use 'git am --show-current-patch=diff' to see the failed patch
When you have resolved this problem run "git bz apply --continue".
If you would prefer to skip this patch, instead run "git bz apply --skip".
To restore the original branch and stop patching run "git bz apply --abort".
Patch left in /tmp/Bug-29155-Update-links-to-jQuery-and-jQuery-Migrat-86JbZg.patch
Comment 7 David Cook 2022-04-13 00:32:55 UTC
In 6.5 hours, I'm on holidays until Tuesday, but I could take a look at this tonight if you rebase and shoot me an out-of-band message to let me know.
Comment 8 David Cook 2022-04-13 07:14:38 UTC
(In reply to David Cook from comment #7)
> In 6.5 hours, I'm on holidays until Tuesday, but I could take a look at this
> tonight if you rebase and shoot me an out-of-band message to let me know.

It looks like I got my timezones a bit confused and it's unlikely that we'll cross paths tonight/this morning. 

If no one else comes along first, I'd be happy to sign this off on Tuesday when I'm back at work.
Comment 9 Owen Leonard 2022-04-13 13:07:46 UTC
Created attachment 133252 [details] [review]
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions

jQuery is upgraded from 2.2.3 to 3.6.0.
jQuery Migrate is upgraded from 1.3.0 to 3.3.2.

The next patch will update links to point to the new assets.
Comment 10 Owen Leonard 2022-04-13 13:07:52 UTC
Created attachment 133253 [details] [review]
Bug 29155: Update links to jQuery and jQuery Migrate files

With these patches, jQuery versions in the OPAC and staff interface are
both updated to 3.6.0. The latest version of jQuery Migrate is installed
to allow us to take a slower approach to updating out-of-date syntax.

To test, apply the patch and try as many pages as you can, paying
attention to the browser console to watch for errors.
Comment 11 Owen Leonard 2022-04-13 13:13:01 UTC
(In reply to David Cook from comment #6)
> error: sha1 information is lacking or useless

Applying on master resulted in a little auto-merging but nothing like this. I don't know what was happening for you. Please try again!
Comment 12 Victor Grousset/tuxayo 2022-04-14 01:02:40 UTC
Applies without issue on master (412d4f4864)
Comment 13 Victor Grousset/tuxayo 2022-04-15 00:28:42 UTC
Issues found:
- make a hold
- go the patron detail page
- click on the holds tab
- list is empty, but it shouldn't
- js console:

Uncaught TypeError: can't access property "id", ui.newTab.context is undefined
    activate http://localhost:8081/intranet-tmpl/prog/js/pages/circulation_21.1200033.js:14
    jQuery 32
    <anonymous> http://localhost:8081/intranet-tmpl/prog/js/pages/circulation_21.1200033.js:12
Comment 14 Owen Leonard 2022-04-15 12:07:10 UTC
Created attachment 133356 [details] [review]
Bug 29155: (follow-up) Work around change to jQueryUI tab API

For some reason, with the combination of jQuery 3.6.0 and jQueryUI
1.13.1, the way to access the current active tab's link has changed.
Previously the tab activate event would provide information about the
link as "ui.newTab.context." It appears that "context" is no longer
available.

This patch updates the two instances in Koha where this process is
broken.

To test, apply the patch and check out to a patron with holds on their
account.

- When the checkout page loads, confirm that each tab loads its contents
  correctly when clicked.
- Check that the correct tab is activated when you append the tab link
  to the page url, e.g.

  /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments

  ...which should select the "Restrictions" tab for you. You may need to
  try this in a new tab or shift-reload to get the browser to look for
  the hash.

- Perform the same tests on the patron details page.
Comment 15 David Cook 2022-04-19 04:38:10 UTC
(In reply to Owen Leonard from comment #11)
> (In reply to David Cook from comment #6)
> > error: sha1 information is lacking or useless
> 
> Applying on master resulted in a little auto-merging but nothing like this.
> I don't know what was happening for you. Please try again!

I'd say that there was probably somehow an ancestor commit that only existed in your local repo. All good though this time!
Comment 16 David Cook 2022-04-19 04:48:22 UTC
While I'm finding issues in master, they don't appear to be related to this change. Looking good to me.
Comment 17 David Cook 2022-04-19 04:50:14 UTC
Created attachment 133378 [details] [review]
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions

jQuery is upgraded from 2.2.3 to 3.6.0.
jQuery Migrate is upgraded from 1.3.0 to 3.3.2.

The next patch will update links to point to the new assets.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 18 David Cook 2022-04-19 04:50:19 UTC
Created attachment 133379 [details] [review]
Bug 29155: Update links to jQuery and jQuery Migrate files

With these patches, jQuery versions in the OPAC and staff interface are
both updated to 3.6.0. The latest version of jQuery Migrate is installed
to allow us to take a slower approach to updating out-of-date syntax.

To test, apply the patch and try as many pages as you can, paying
attention to the browser console to watch for errors.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 19 David Cook 2022-04-19 04:50:24 UTC
Created attachment 133380 [details] [review]
Bug 29155: (follow-up) Work around change to jQueryUI tab API

For some reason, with the combination of jQuery 3.6.0 and jQueryUI
1.13.1, the way to access the current active tab's link has changed.
Previously the tab activate event would provide information about the
link as "ui.newTab.context." It appears that "context" is no longer
available.

This patch updates the two instances in Koha where this process is
broken.

To test, apply the patch and check out to a patron with holds on their
account.

- When the checkout page loads, confirm that each tab loads its contents
  correctly when clicked.
- Check that the correct tab is activated when you append the tab link
  to the page url, e.g.

  /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments

  ...which should select the "Restrictions" tab for you. You may need to
  try this in a new tab or shift-reload to get the browser to look for
  the hash.

- Perform the same tests on the patron details page.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 20 Jonathan Druart 2022-04-21 09:19:23 UTC Comment hidden (obsolete)
Comment 21 Jonathan Druart 2022-04-21 11:36:08 UTC Comment hidden (obsolete)
Comment 22 Jonathan Druart 2022-04-22 12:09:08 UTC
Created attachment 133671 [details] [review]
Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions

jQuery is upgraded from 2.2.3 to 3.6.0.
jQuery Migrate is upgraded from 1.3.0 to 3.3.2.

The next patch will update links to point to the new assets.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 23 Jonathan Druart 2022-04-22 12:09:13 UTC
Created attachment 133672 [details] [review]
Bug 29155: Update links to jQuery and jQuery Migrate files

With these patches, jQuery versions in the OPAC and staff interface are
both updated to 3.6.0. The latest version of jQuery Migrate is installed
to allow us to take a slower approach to updating out-of-date syntax.

To test, apply the patch and try as many pages as you can, paying
attention to the browser console to watch for errors.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 24 Jonathan Druart 2022-04-22 12:09:18 UTC
Created attachment 133673 [details] [review]
Bug 29155: (follow-up) Work around change to jQueryUI tab API

For some reason, with the combination of jQuery 3.6.0 and jQueryUI
1.13.1, the way to access the current active tab's link has changed.
Previously the tab activate event would provide information about the
link as "ui.newTab.context." It appears that "context" is no longer
available.

This patch updates the two instances in Koha where this process is
broken.

To test, apply the patch and check out to a patron with holds on their
account.

- When the checkout page loads, confirm that each tab loads its contents
  correctly when clicked.
- Check that the correct tab is activated when you append the tab link
  to the page url, e.g.

  /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments

  ...which should select the "Restrictions" tab for you. You may need to
  try this in a new tab or shift-reload to get the browser to look for
  the hash.

- Perform the same tests on the patron details page.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 25 Jonathan Druart 2022-04-22 12:10:09 UTC
I haven't caught anything obvious, we should push this ASAP to let us a bit of time to find possible regressions before the release.
Comment 26 Fridolin Somers 2022-04-25 20:01:30 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 27 Victor Grousset/tuxayo 2022-08-12 21:11:43 UTC
Bisecting shows offline circulation was broken after this. Check-ins and checkouts.
See Bug 31358