jQuery Upgrade

[danpoltawski]

According to https://www.cvedetails.com/vulnerability-list/vendor_id-6538/product_id-11031/version_id-286384/Jquery-Jquery-2.1.1.html jQuery 2.1.1 has two CVE's against it and the the bundled jquery comes up in automated vulnerability scanning.

It would be good if this could be upgraded

[danpoltawski]

I started hacking together a patch for this

master...TNP-Ltd:wip-jquery-upgrade

[T185]

Hi Everyone,

i just found this Issue and the solution for this.

@danpoltawski can you push this solution to the main branch and try to merge it against the main repo?

We are also see this CVE in our environment and i think a 10 years old library can be updated ;)

Thank you so much in advance and have a great day!

[danpoltawski]

@T185 I can't - I'm not a maintainer of this repo, but if a maintainer suggests interest in merging the I will rebase/update it

[robertcheramy]

I'll be happy to merge a Pull Request which resolves this issue.

[robertcheramy]

I'd like a better way to do this - I'm trying to solve this with gems, so don't loose time rebasing your modification.

[danpoltawski]

I'd like a better way to do this - I'm trying to solve this with gems, so don't loose time rebasing your modification.

Thanks - I'm going to be away for the next two weeks, so I'll come back to this the and hope you've managed to solve it that way in the meantime

[T185]

Wow, thank you very much for your help and effort ! I would like to hear from you and if i can help, pls ping me :)

[robertcheramy]

I've found a way to do this (install the libs with npm, copy them with rake in our public folder), but I first have to repair other broken things first (dependency update but also older changes in the repository) - if I change to much at a time, it will be difficult to repair things.

[robertcheramy]

Update:

• haml ist fixed (and merged into master)
• I've already migrated Bootstrap and jQuery to the latest versions (and moved to the standard bootstrap design)
• I'm still working on (understanding) datatables
• I'm unsure the RANCID Migration-tool is still needed by someone out there. It will be difficult for me to test if it stills works.

I'll make a PR as soon as I've got something that is presentable.

[robertcheramy]

If you want to try out, this is the working branch: https://github.com/robertcheramy/oxidized-web/tree/update-weblibs

This is still work in progress:

• add a Documentation how to run from git
• diffs have to be polished
• the migration tool has not been migrated yet

[robertcheramy]

This issue will be fixed with PR #263. Have a look at it, I will let the PR open a few day before merging into master.