A new bug report for version 1.21.0. > We've gotten reports that the jQuery-validate plugin is flagging in > vulnerability scans (https://nvd.nist.gov/vuln/detail/CVE-2022-31147 for > details on the associated CVE). > > I've put this in security to be on the safe side but if it should be moved, > please do.
Created attachment 188644 [details] [review] Bug 41142: Update jQuery-validate plugin to 1.21.0 This patch updates the jQuery validation plugin in both the staff interface and the OPAC to the latest version, 1.21.0. To test, apply the patch and clear your browser cache if necessary. Test various pages in the staff client to confirm that form validation works as expected: - Patron password change form: - Password must conform to minPasswordLength - Password must not contain leading/trailing spaces - Passwords must match - Administration -> Add or edit budget: - Description, start date, and end date are required - Start date must be before end date - Administration -> Add or edit Z39.50/SRU server: - Server name, hostname, port, and database are required - Port, rank, and timeout must be a number Perform the same check of the "Change password" form in the OPAC. Sponsored-by: Athens County Public Libraries
*** Bug 34623 has been marked as a duplicate of this bug. ***
Created attachment 190316 [details] [review] Bug 41142: Update jQuery-validate plugin to 1.21.0 This patch updates the jQuery validation plugin in both the staff interface and the OPAC to the latest version, 1.21.0. To test, apply the patch and clear your browser cache if necessary. Test various pages in the staff client to confirm that form validation works as expected: - Patron password change form: - Password must conform to minPasswordLength - Password must not contain leading/trailing spaces - Passwords must match - Administration -> Add or edit budget: - Description, start date, and end date are required - Start date must be before end date - Administration -> Add or edit Z39.50/SRU server: - Server name, hostname, port, and database are required - Port, rank, and timeout must be a number Perform the same check of the "Change password" form in the OPAC. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <you@example.com>
I have signed off, but did note this behavour for the new budget form - which is the same before and after the patch: 1. New budget form: - if I enter in start date but nowhere else, I can't save and it stays on the form - if I enter in the end date but nowhere else, I can't save and it stays on the form - if I enter in the start date and end date but nothing in description, I can't save and it stays on the form - for each of the above, only the description field comes up with "This field is required" - if I just enter something in the description (which is required), but not in start date and end date, and click Save, I can, but it is not saved and you go back to the budget listing page
Created attachment 190319 [details] [review] Bug 41142: Update jQuery-validate plugin to 1.21.0 This patch updates the jQuery validation plugin in both the staff interface and the OPAC to the latest version, 1.21.0. To test, apply the patch and clear your browser cache if necessary. Test various pages in the staff client to confirm that form validation works as expected: - Patron password change form: - Password must conform to minPasswordLength - Password must not contain leading/trailing spaces - Passwords must match - Administration -> Add or edit budget: - Description, start date, and end date are required - Start date must be before end date - Administration -> Add or edit Z39.50/SRU server: - Server name, hostname, port, and database are required - Port, rank, and timeout must be a number Perform the same check of the "Change password" form in the OPAC. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com>
My sign-off line was incorrect, so have updated.
Created attachment 190695 [details] [review] Bug 41142: Update jQuery-validate plugin to 1.21.0 This patch updates the jQuery validation plugin in both the staff interface and the OPAC to the latest version, 1.21.0. To test, apply the patch and clear your browser cache if necessary. Test various pages in the staff client to confirm that form validation works as expected: - Patron password change form: - Password must conform to minPasswordLength - Password must not contain leading/trailing spaces - Passwords must match - Administration -> Add or edit budget: - Description, start date, and end date are required - Start date must be before end date - Administration -> Add or edit Z39.50/SRU server: - Server name, hostname, port, and database are required - Port, rank, and timeout must be a number Perform the same check of the "Change password" form in the OPAC. Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
[FAIL] koha-tmpl/intranet-tmpl/lib/jquery/plugins/jquery.validate.min.js FAIL forbidden_patterns forbidden pattern: console.log (line 5) FAIL new_line_at_the_end_of_file Missing new line at the end of file, make sure your editor correctly reads .editorconfig ('insert_final_newline = true'). See bug 40541.
(In reply to Lucas Gass (lukeg) from comment #8) > [FAIL] koha-tmpl/intranet-tmpl/lib/jquery/plugins/jquery.validate.min.js Correcting these items would be editing the code of a third-party library which we don't usually do. My opinion is that we ignore these failures.
(In reply to Owen Leonard from comment #9) > (In reply to Lucas Gass (lukeg) from comment #8) > > [FAIL] koha-tmpl/intranet-tmpl/lib/jquery/plugins/jquery.validate.min.js > > Correcting these items would be editing the code of a third-party library > which we don't usually do. My opinion is that we ignore these failures. Makes sense, ignoring. :)
Pushed to main for 26.05.00. Nice work all!