Bug 34623 - Update jQuery-validate plugin to 1.20.0
Summary: Update jQuery-validate plugin to 1.20.0
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Owen Leonard
QA Contact: Nick Clemens (kidclamp)
URL:
Keywords:
: 34914 (view as bug list)
Depends on: 35584 30859
Blocks:
  Show dependency treegraph
 
Reported: 2023-08-25 17:26 UTC by Evelyn Hartline
Modified: 2024-03-04 10:37 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.09,22.11.15


Attachments
Bug 34623: Update jQuery-validate plugin to 1.20.0 (99.51 KB, patch)
2023-12-20 17:08 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 34623: Update jQuery-validate plugin to 1.20.0 (99.58 KB, patch)
2024-01-26 10:11 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 34623: Update jQuery-validate plugin to 1.20.0 (99.63 KB, patch)
2024-02-13 07:53 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Evelyn Hartline 2023-08-25 17:26:22 UTC
We've gotten reports that the jQuery-validate plugin is flagging in vulnerability scans (https://nvd.nist.gov/vuln/detail/CVE-2022-31147 for details on the associated CVE). 

I've put this in security to be on the safe side but if it should be moved, please do.
Comment 1 David Cook 2023-09-26 23:49:20 UTC
*** Bug 34914 has been marked as a duplicate of this bug. ***
Comment 2 Martin Renvoize 2023-09-27 13:51:06 UTC
CVE: https://nvd.nist.gov/vuln/detail/CVE-2021-43306 is also an issue here.
Comment 3 Owen Leonard 2023-12-20 17:08:04 UTC
Created attachment 160133 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.
Comment 4 Martin Renvoize 2024-01-26 10:11:15 UTC
Created attachment 161498 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize 2024-01-26 10:11:57 UTC
Thanks Owen, my apologies that it took me a while to get back to this.
Comment 6 Victor Grousset/tuxayo 2024-02-13 07:52:56 UTC
>    - Description, start date, and end date are required

Dates are not required with or without the patch. It's possible to submit the form without a date and it will silently fail server side. Not due to this patch so no problem for this ticket.

>    - Start date must be before end date

Something else (flatpickr likely) is already enforcing this first so can't really test it.

---

Additional testing:

acquisition => new contact
- Name
- end date after start date: Something else (flatpickr likely) is already enforcing this first.

installer, onboarding
- patron category
  - Enrollment period: months
  - Category code (when submitting the form)
  - Description (when submitting the form)
- Create Koha administrator patron
  - many fields
  - password

OPAC:
- personal details: change Primary email, Secondary email, Alternate address: email

additional content
- new news

tools
- patron image upload

---

note: to find (hopefully all) usage of the validator search the code with something equivalent to
rg "\.validate\(" -A 20
Displaying the 20 line following a match allow to see the rules that are validate and search some unusual ones.
Comment 7 Victor Grousset/tuxayo 2024-02-13 07:53:41 UTC
Created attachment 162086 [details] [review]
Bug 34623: Update jQuery-validate plugin to 1.20.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.20.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 8 Victor Grousset/tuxayo 2024-02-13 07:54:19 UTC
Works, makes sense, QA script happy, code looks good, passing QA :)
Comment 9 Martin Renvoize 2024-02-15 09:46:53 UTC
Pushed to master 24.05.00