Redmine - Feature #31196
Updates jQuery to 2.2.4 and adds jQuery Migrate library
2019-04-12 12:17 - Federico Vera

ステータス:

Closed

開始日:

優先度:

Normal

期日:担当者:

Go MAEDA

進捗率:0%

カテゴリ:

Third-party libraries

予定工数:

0.00時間対象バージョン:4.1.0

Resolution:

Fixed

説明
The current version of jQuery used in Redmine (1.11.1) is a couple of years old, and plagued with known security vulnerabilities
and some that are not listed in CVE.
jQuery itself releases a plugin called jQuery Migrate to help with the transition.
The question is, is there any plan to upgrade jQuery?
関連するチケット:
関連している Redmine - Patch #31884: Fix JQMIGRATE: jQuery.fn.l...

Closed関連している Redmine - Defect #31870: Remove deprecated .zIndex...

Closed関連している Redmine - Patch #31894: Fix "jQuery.fn.attr('selec...

Closed

関係しているリビジョン
リビジョン 18363 - 2019-08-13 16:18 - Go MAEDA
Updates jQuery to 2.2.4 and adds jQuery Migrate library to find APIs and features that have been or will be removed from jQuery core (#31196).
Patch by Marius BALTEANU.
リビジョン 18364 - 2019-08-13 16:23 - Go MAEDAFix JQMIGRATE: jQuery.fn.load() is deprecated (#31884, #31196).
Patch by Marius BALTEANU.
リビジョン 18365 - 2019-08-14 01:28 - Go MAEDAFix jQuery.fn.attr('selected') might use property instead of attribute (#31894, #31196).
Patch by Marius BALTEANU.

履歴#1 - 2019-04-12 12:18 - Federico Vera
Related issue: #30486#2 - 2019-05-20 14:46 - Philippe Bourjac
Federico Vera wrote:
The current version of jQuery used in Redmine (1.11.1) is a couple of years old, and plagued with known security vulnerabilities and somethat are not listed in CVE.
jQuery itself releases a plugin called jQuery Migrate to help with the transition.
The question is, is there any plan to upgrade jQuery?

Hello there,
I am interested in this subject too, as we are using redmine 4.0.3 and security services are putting some pressure on us because of this vulnerability(they are asking me to shut the redmine system down).
Any plan to migrate to latest jQuery version?

2024-10-03

1/2

Regards,
Philippe#3 - 2019-05-20 15:39 - Marius B

LTEANU- トラッカー を Defect から Feature に変更- 担当者 を Marius B

LTEANU にセット

I've some work in progress on this topic.
#4 - 2019-08-13 00:37 - Marius B- 担当者 を削除 (Marius BLTEANULTEANU)

Here is a patch (I cannot attached it here because of the size - please use the download option or access the patch directly using this link) that
updates jQuery to version 2.2.4. Because we didn't check the entire JS code, I propose to use the jQuery Migrate library which will help us
identifying all the issues that we need to fix before moving to next major version. I think it's safe to commit this as soon as possible and report theissues found by the library.
Hopefully, we can migrate to jQuery 3 or 4 (which is under development) in Redmine 4.2.0 or 5.0.0.
#5 - 2019-08-13 02:00 - Marius B

LTEANU- 関連している Patch #31884: Fix JQMIGRATE: jQuery.fn.load() is deprecated を追加#6 - 2019-08-13 03:02 - Go MAEDA- 関連している Defect #31870: Remove deprecated .zIndex() method を追加#7 - 2019-08-13 03:04 - Go MAEDA- 対象バージョン を 4.1.0 にセット
Marius BALTEANU wrote:
I think it's safe to commit this as soon as possible and report the issues found by the library.

Setting the target version to 4.1.0. Thank you for working hard on this.
#8 - 2019-08-13 16:20 - Go MAEDA- 題名 を jQuery version in use is old and insecure から Updates jQuery to 2.2.4 and adds jQuery Migrate library に変更- ステータス を New から Closed に変更- 担当者 を Go MAEDA にセット
- Resolution を Fixed にセット
Committed the patch. Thank you.
#9 - 2019-08-13 22:09 - Marius BLTEANU- 関連している Patch #31894: Fix "jQuery.fn.attr('selected') might use property instead of attribute" を追加#10 - 2019-08-30 01:44 - Go MAEDA- カテゴリ を Security から Third-party libraries に変更

2024-10-03

2/2