Koha currently jQuery version 2.2.3 on the staff client and 3.4.1 on the OPAC. There are known vulnerabilities in versions less than 3.5.0: https://www.cvedetails.com/cve/CVE-2020-11023/ Perhaps it is time to upgrade to a more secure version.
This vulnerability really seems like it could be not great, we use the mentioned methods a lot. This will be a fairly big job I reckon?
Addendum for vulnerability for Jquery 3.4.1 (OPAC): https://snyk.io/vuln/npm:jquery@3.4.1
Remote branch here: https://gitlab.com/koha-dev/koha-dev/-/commits/bug-29155-upgrade-jquery With these patches, jQuery versions in the OPAC and staff interface are both updated to 3.6.0. The latest version of jQuery Migrate is installed to allow us to take a slower approach to updating out-of-date syntax. To test, apply the patches and try as many pages as you can, paying attention to the browser console to watch for errors.
Created attachment 130408 [details] [review] Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions jQuery is upgraded from 2.2.3 to 3.6.0. jQuery Migrate is upgraded from 1.3.0 to 3.3.2. The next patch will update links to point to the new assets.
Created attachment 130409 [details] [review] Bug 29155: Update links to jQuery and jQuery Migrate files With these patches, jQuery versions in the OPAC and staff interface are both updated to 3.6.0. The latest version of jQuery Migrate is installed to allow us to take a slower approach to updating out-of-date syntax. To test, apply the patch and try as many pages as you can, paying attention to the browser console to watch for errors.
Sorry, Owen. It looks like this needs a rebase. root@kohadevbox:koha(bug29155)$ git bz apply 29155 Bug 29155 - Upgrade jquery version 130408 - Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions 130409 - Bug 29155: Update links to jQuery and jQuery Migrate files Apply? [(y)es, (n)o, (i)nteractive] y Applying: Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions Applying: Bug 29155: Update links to jQuery and jQuery Migrate files error: sha1 information is lacking or useless (koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc). error: could not build fake ancestor Patch failed at 0001 Bug 29155: Update links to jQuery and jQuery Migrate files hint: Use 'git am --show-current-patch=diff' to see the failed patch When you have resolved this problem run "git bz apply --continue". If you would prefer to skip this patch, instead run "git bz apply --skip". To restore the original branch and stop patching run "git bz apply --abort". Patch left in /tmp/Bug-29155-Update-links-to-jQuery-and-jQuery-Migrat-86JbZg.patch
In 6.5 hours, I'm on holidays until Tuesday, but I could take a look at this tonight if you rebase and shoot me an out-of-band message to let me know.
(In reply to David Cook from comment #7) > In 6.5 hours, I'm on holidays until Tuesday, but I could take a look at this > tonight if you rebase and shoot me an out-of-band message to let me know. It looks like I got my timezones a bit confused and it's unlikely that we'll cross paths tonight/this morning. If no one else comes along first, I'd be happy to sign this off on Tuesday when I'm back at work.
Created attachment 133252 [details] [review] Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions jQuery is upgraded from 2.2.3 to 3.6.0. jQuery Migrate is upgraded from 1.3.0 to 3.3.2. The next patch will update links to point to the new assets.
Created attachment 133253 [details] [review] Bug 29155: Update links to jQuery and jQuery Migrate files With these patches, jQuery versions in the OPAC and staff interface are both updated to 3.6.0. The latest version of jQuery Migrate is installed to allow us to take a slower approach to updating out-of-date syntax. To test, apply the patch and try as many pages as you can, paying attention to the browser console to watch for errors.
(In reply to David Cook from comment #6) > error: sha1 information is lacking or useless Applying on master resulted in a little auto-merging but nothing like this. I don't know what was happening for you. Please try again!
Applies without issue on master (412d4f4864)
Issues found: - make a hold - go the patron detail page - click on the holds tab - list is empty, but it shouldn't - js console: Uncaught TypeError: can't access property "id", ui.newTab.context is undefined activate http://localhost:8081/intranet-tmpl/prog/js/pages/circulation_21.1200033.js:14 jQuery 32 <anonymous> http://localhost:8081/intranet-tmpl/prog/js/pages/circulation_21.1200033.js:12
Created attachment 133356 [details] [review] Bug 29155: (follow-up) Work around change to jQueryUI tab API For some reason, with the combination of jQuery 3.6.0 and jQueryUI 1.13.1, the way to access the current active tab's link has changed. Previously the tab activate event would provide information about the link as "ui.newTab.context." It appears that "context" is no longer available. This patch updates the two instances in Koha where this process is broken. To test, apply the patch and check out to a patron with holds on their account. - When the checkout page loads, confirm that each tab loads its contents correctly when clicked. - Check that the correct tab is activated when you append the tab link to the page url, e.g. /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments ...which should select the "Restrictions" tab for you. You may need to try this in a new tab or shift-reload to get the browser to look for the hash. - Perform the same tests on the patron details page.
(In reply to Owen Leonard from comment #11) > (In reply to David Cook from comment #6) > > error: sha1 information is lacking or useless > > Applying on master resulted in a little auto-merging but nothing like this. > I don't know what was happening for you. Please try again! I'd say that there was probably somehow an ancestor commit that only existed in your local repo. All good though this time!
While I'm finding issues in master, they don't appear to be related to this change. Looking good to me.
Created attachment 133378 [details] [review] Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions jQuery is upgraded from 2.2.3 to 3.6.0. jQuery Migrate is upgraded from 1.3.0 to 3.3.2. The next patch will update links to point to the new assets. Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 133379 [details] [review] Bug 29155: Update links to jQuery and jQuery Migrate files With these patches, jQuery versions in the OPAC and staff interface are both updated to 3.6.0. The latest version of jQuery Migrate is installed to allow us to take a slower approach to updating out-of-date syntax. To test, apply the patch and try as many pages as you can, paying attention to the browser console to watch for errors. Signed-off-by: David Cook <dcook@prosentient.com.au>
Created attachment 133380 [details] [review] Bug 29155: (follow-up) Work around change to jQueryUI tab API For some reason, with the combination of jQuery 3.6.0 and jQueryUI 1.13.1, the way to access the current active tab's link has changed. Previously the tab activate event would provide information about the link as "ui.newTab.context." It appears that "context" is no longer available. This patch updates the two instances in Koha where this process is broken. To test, apply the patch and check out to a patron with holds on their account. - When the checkout page loads, confirm that each tab loads its contents correctly when clicked. - Check that the correct tab is activated when you append the tab link to the page url, e.g. /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments ...which should select the "Restrictions" tab for you. You may need to try this in a new tab or shift-reload to get the browser to look for the hash. - Perform the same tests on the patron details page. Signed-off-by: David Cook <dcook@prosentient.com.au>
How hard would it be to switch to v5?
(In reply to Jonathan Druart from comment #20) > How hard would it be to switch to v5? Scratch that, I had bootstrap in mind.
Created attachment 133671 [details] [review] Bug 29155: Upgrade jQuery and jQuery Migrate to latest versions jQuery is upgraded from 2.2.3 to 3.6.0. jQuery Migrate is upgraded from 1.3.0 to 3.3.2. The next patch will update links to point to the new assets. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 133672 [details] [review] Bug 29155: Update links to jQuery and jQuery Migrate files With these patches, jQuery versions in the OPAC and staff interface are both updated to 3.6.0. The latest version of jQuery Migrate is installed to allow us to take a slower approach to updating out-of-date syntax. To test, apply the patch and try as many pages as you can, paying attention to the browser console to watch for errors. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Created attachment 133673 [details] [review] Bug 29155: (follow-up) Work around change to jQueryUI tab API For some reason, with the combination of jQuery 3.6.0 and jQueryUI 1.13.1, the way to access the current active tab's link has changed. Previously the tab activate event would provide information about the link as "ui.newTab.context." It appears that "context" is no longer available. This patch updates the two instances in Koha where this process is broken. To test, apply the patch and check out to a patron with holds on their account. - When the checkout page loads, confirm that each tab loads its contents correctly when clicked. - Check that the correct tab is activated when you append the tab link to the page url, e.g. /cgi-bin/koha/circ/circulation.pl?borrowernumber=XXX#reldebarments ...which should select the "Restrictions" tab for you. You may need to try this in a new tab or shift-reload to get the browser to look for the hash. - Perform the same tests on the patron details page. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
I haven't caught anything obvious, we should push this ASAP to let us a bit of time to find possible regressions before the release.
Pushed to master for 22.05, thanks to everybody involved [U+1F984]
Bisecting shows offline circulation was broken after this. Check-ins and checkouts. See Bug 31358