Comments (7)
any comment on what manually patched
means?
Doing a diff against the upstream from https://code.jquery.com/jquery/, it appears the one in the h5p git repo only has 1 difference, the following is appended:
// Snap this specific version of jQuery into H5P. jQuery.noConflict will
// revert the globals to what they were before this file was loaded.
var H5P = window.H5P = window.H5P || {};
/**
* jQuery v1.9.1
*
* @member
*/
H5P.jQuery = jQuery.noConflict(true);
H5P.jQuery.ajaxPrefilter(function (s) {
if (s.crossDomain) {
s.contents.script = false;
}
});
the concern is since there are known sec vulnerabilities against that version (and probably many unknown since people stopped reporting them about 5 years ago).
from h5p-php-library.
Hi,
from MoodleHQ we are working on fix this issue (https://tracker.moodle.org/browse/MDL-68704) and once this issue will be fixed we would like to do a pull-request in order to H5P could integrate the solution.
It is important to notice that there are two vulnerabilities:
- SNYK-JS-JQUERY-174006 - Manual patch fix this. Easy to fix.
- SNYK-npm:jquery:20150627 - I would require to upgrade to 1.12.2 with the previous patch applied.
Cheers.
from h5p-php-library.
v1.9.1 (~2013 release) was the last to support IE6/7/8.
It is not supported on Cordova (https://blog.jquery.com/2013/04/18/jquery-2-0-released/).
v2.0 was released in 2013.
v3.0 was released in 2016
there are some breaking changes between each of these major. Definitely for the moodleapp 1.9 is no good.
Does anyone know of a reason not to upgrade to latest jquery?
It would seem the steps are to first frun the v1 migration tool (to get from v1.9 to v1.12)
then the v2 migration tool https://github.com/jquery/jquery-migrate/#README
from h5p-php-library.
H5P was originally created with support for IE8 which has since been dropped. However, some of the content types are still dependant on jQuery 1.9. I believe an upgrade would require a fair amount of time with refactoring and testing. So, until now the 1.9 in H5P has been manually patched for any known issues.
from h5p-php-library.
I see this old jquery library is updated in the master branch but not in the most current release from Dec 2022. Do you know when this will be added to a release?
from h5p-php-library.
This is also becoming an issue, as we have 3rd party scans that are revealing this vulnerability. Any guess as to the effort of bringing jQuery up to date here?
from h5p-php-library.
The code is already updated, but hasn't yet been released.
from h5p-php-library.
Related Issues (20)
- Is $CFG->mod_hvp_crossorigin documented somewhere? HOT 4
- Separate PHP and JavaScript code HOT 5
- Add triggers for saveContentState/setUserData
- H5P.getUserData not used asynchronously where required HOT 1
- GDPR infringement HOT 1
- Error while playing content in v1.24.3
- When is next release scheduled? HOT 3
- "We will make available documentation and tutorials for creating platform integrations in the future." HOT 2
- H5PExport::createExportFile() performance issues
- Error Uncaught TypeError: Cannot read properties of undefined (reading 'field') HOT 1
- H5PCore in Tag 1.24.4 has a missing function libraryToFolderName HOT 1
- Support for MPEG-DASH format
- [BUG] Invalid argument supplied for foreach()
- Allow using HTML tags MARK and ABBR in H5P content types HOT 5
- [BUG] iframe embeds are not populated in the parent context.
- Class file structure and simplifying integration into a framework HOT 1
- Resizing problems of the container when calling mozRequestFullScreen() HOT 5
- add Moodle comp for 1.26 HOT 3
- Moodle-Plugin mod_hvp produced embed code not detected by h5p-resizer.js
- The `unload` event is deprecated
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from h5p-php-library.