Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated library: jquery-3.6.1 #19945

Closed
wants to merge 1 commit into from
Closed

Conversation

tassoman
Copy link
Contributor

@tassoman tassoman commented Nov 3, 2022

Description:

Actual library jQuery 2.2.4 is suffering of 3 XSS vulnerabilities and a Prototype Pollution.

Review

@tassoman tassoman changed the title Updated library: jquery-2.6.1 Updated library: jquery-3.6.1 Nov 3, 2022
@sgiehl
Copy link
Member

sgiehl commented Nov 7, 2022

Hi @tassoman
We most likely won't change that for Matomo 4 to avoid possible problems with Matomo plugins or Matomo for wordpress. We are currently preparing Matomo 5, where we might consider to also update jQuery (if it doesn't cause regressions with wordpress).
Would you mind to rebase/change your PR to target 5.x-dev or create a new PR for that if that is easier.

@tassoman
Copy link
Contributor Author

tassoman commented Nov 10, 2022

Wordpress already has jQuery 3.6.0 in it since 2 years ago.
They also have jQuery Migration already set. No worries for breaking.

I've already patched my Matomo 4.11.x package but file integrity checker gives back false positive error.
So matomo installation couldn't be checked for integrity because of jquery.min.js substitution.
This also is a security flaw in the system. We don't want to lower our security level in core system.

@sgiehl sgiehl mentioned this pull request Nov 11, 2022
11 tasks
@sgiehl
Copy link
Member

sgiehl commented Nov 11, 2022

@tassoman We are commint all the npm libraries that are required for Matomo to run. I've therefor created a new PR, that contains all required jQuery files.
Closing this on in favor of #19989

@sgiehl sgiehl closed this Nov 11, 2022
@tassoman
Copy link
Contributor Author

Awesome, thanks a lot!

@tassoman tassoman deleted the jq361 branch November 12, 2022 00:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants