Bug 34623

Summary: Update jQuery-validate plugin to 1.20.0
Product: Koha Reporter: Evelyn Hartline <evelyn>
Component: Architecture, internals, and plumbingAssignee: Owen Leonard <oleonard>
Status: Pushed to oldoldstable --- QA Contact: Nick Clemens (kidclamp) <nick>
Severity: normal    
Priority: P5 - low CC: 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, oleonard, victor
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.09,22.11.15
Bug Depends on: 35584, 30859    
Bug Blocks:    
Attachments: Bug 34623: Update jQuery-validate plugin to 1.20.0
Bug 34623: Update jQuery-validate plugin to 1.20.0
Bug 34623: Update jQuery-validate plugin to 1.20.0

Description Evelyn Hartline 2023-08-25 17:26:22 UTC
We've gotten reports that the jQuery-validate plugin is flagging in vulnerability scans (https://nvd.nist.gov/vuln/detail/CVE-2022-31147 for details on the associated CVE). 

I've put this in security to be on the safe side but if it should be moved, please do.
Comment 1 David Cook 2023-09-26 23:49:20 UTC
*** Bug 34914 has been marked as a duplicate of this bug. ***
Comment 2 Martin Renvoize 2023-09-27 13:51:06 UTC
CVE: https://nvd.nist.gov/vuln/detail/CVE-2021-43306 is also an issue here.
Comment 3 Owen Leonard 2023-12-20 17:08:04 UTC
Created attachment 160133 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.
Comment 4 Martin Renvoize 2024-01-26 10:11:15 UTC
Created attachment 161498 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2024-01-26 10:11:57 UTC
Thanks Owen, my apologies that it took me a while to get back to this.
Comment 6 Victor Grousset/tuxayo 2024-02-13 07:52:56 UTC
>    - Description, start date, and end date are required

Dates are not required with or without the patch. It's possible to submit the form without a date and it will silently fail server side. Not due to this patch so no problem for this ticket.

>    - Start date must be before end date

Something else (flatpickr likely) is already enforcing this first so can't really test it.

---

Additional testing:

acquisition => new contact
- Name
- end date after start date: Something else (flatpickr likely) is already enforcing this first.

installer, onboarding
- patron category
  - Enrollment period: months
  - Category code (when submitting the form)
  - Description (when submitting the form)
- Create Koha administrator patron
  - many fields
  - password

OPAC:
- personal details: change Primary email, Secondary email, Alternate address: email

additional content
- new news

tools
- patron image upload

---

note: to find (hopefully all) usage of the validator search the code with something equivalent to
rg "\.validate\(" -A 20
Displaying the 20 line following a match allow to see the rules that are validate and search some unusual ones.
Comment 7 Victor Grousset/tuxayo 2024-02-13 07:53:41 UTC
Created attachment 162086 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 8 Victor Grousset/tuxayo 2024-02-13 07:54:19 UTC
Works, makes sense, QA script happy, code looks good, passing QA :)
Comment 9 Martin Renvoize 2024-02-15 09:46:53 UTC
Pushed to master 24.05.00