From d93cc78bf6e7aa9b2274520c920ef570472d64ce Mon Sep 17 00:00:00 2001 From: Awf Wiswasi <55606355+awiswasi@users.noreply.github.com> Date: Tue, 19 Apr 2022 05:50:17 -0700 Subject: [PATCH 1/2] Fixed vulnerability to Cross-site Scripting (XSS) when accepting the value of altField option of the Datepicker widget from untrusted sources, which may lead to execution of untrusted code. Vulnerability fixed in jquery-ui@1.13.0 --- InvenTree/InvenTree/static/script/jquery-ui/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/InvenTree/InvenTree/static/script/jquery-ui/package.json b/InvenTree/InvenTree/static/script/jquery-ui/package.json index e3c846e3a8..dc32b2db84 100644 --- a/InvenTree/InvenTree/static/script/jquery-ui/package.json +++ b/InvenTree/InvenTree/static/script/jquery-ui/package.json @@ -2,7 +2,7 @@ "name": "jquery-ui", "title": "jQuery UI", "description": "A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.", - "version": "1.12.1", + "version": "1.13.0", "homepage": "http://jqueryui.com", "author": { "name": "jQuery Foundation and other contributors", From 761e822a4e890e796e7517d0a84bb24254163f42 Mon Sep 17 00:00:00 2001 From: Awf Wiswasi <55606355+awiswasi@users.noreply.github.com> Date: Tue, 19 Apr 2022 17:36:34 -0700 Subject: [PATCH 2/2] Updated jquery v1.12.1 to v1.13.0 to fix a possible XSS vulnerability. --- .../static/script/jquery-ui/jquery-ui.js | 30 +++++++++---------- .../static/script/jquery-ui/jquery-ui.min.js | 4 +-- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js b/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js index aa871b2a59..bfed42f715 100644 --- a/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js +++ b/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js @@ -1,4 +1,4 @@ -/*! jQuery UI - v1.12.1 - 2021-07-18 +/*! jQuery UI - v1.13.0 - 2021-10-07 * http://jqueryui.com * Includes: widget.js, position.js, disable-selection.js, keycode.js, unique-id.js, widgets/resizable.js, widgets/autocomplete.js, widgets/menu.js, widgets/mouse.js * Copyright jQuery Foundation and other contributors; Licensed MIT */ @@ -17,11 +17,11 @@ $.ui = $.ui || {}; -var version = $.ui.version = "1.12.1"; +var version = $.ui.version = "1.13.1"; /*! - * jQuery UI Widget 1.12.1 + * jQuery UI Widget 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -744,7 +744,7 @@ var widget = $.widget; /*! - * jQuery UI Position 1.12.1 + * jQuery UI Position 1.13.1 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1232,7 +1232,7 @@ var position = $.ui.position; /*! - * jQuery UI Disable Selection 1.12.1 + * jQuery UI Disable Selection 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1268,7 +1268,7 @@ var disableSelection = $.fn.extend( { /*! - * jQuery UI Keycode 1.12.1 + * jQuery UI Keycode 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1303,7 +1303,7 @@ var keycode = $.ui.keyCode = { /*! - * jQuery UI Unique ID 1.12.1 + * jQuery UI Unique ID 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1347,7 +1347,7 @@ var uniqueId = $.fn.extend( { var ie = $.ui.ie = !!/msie [\w.]+/.exec( navigator.userAgent.toLowerCase() ); /*! - * jQuery UI Mouse 1.12.1 + * jQuery UI Mouse 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1368,7 +1368,7 @@ $( document ).on( "mouseup", function() { } ); var widgetsMouse = $.widget( "ui.mouse", { - version: "1.12.1", + version: "1.13.0", options: { cancel: "input, textarea, button, select, option", distance: 1, @@ -1592,7 +1592,7 @@ var plugin = $.ui.plugin = { /*! - * jQuery UI Resizable 1.12.1 + * jQuery UI Resizable 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1612,7 +1612,7 @@ var plugin = $.ui.plugin = { $.widget( "ui.resizable", $.ui.mouse, { - version: "1.12.1", + version: "1.13.0", widgetEventPrefix: "resize", options: { alsoResize: false, @@ -2806,7 +2806,7 @@ var safeActiveElement = $.ui.safeActiveElement = function( document ) { /*! - * jQuery UI Menu 1.12.1 + * jQuery UI Menu 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -2826,7 +2826,7 @@ var safeActiveElement = $.ui.safeActiveElement = function( document ) { var widgetsMenu = $.widget( "ui.menu", { - version: "1.12.1", + version: "1.13.0", defaultElement: "