search

ClassicPress / ClassicPress-v1

A copy of ClassicPress v1.x.
1 stars 1 forks source link

Update jQuery version after security patch #125

Closed nylen closed 5 years ago

nylen commented 5 years ago

From https://forums.classicpress.net/t/classicpress-1-0-2-release-notes/1553/3:

although Github says the jQuery 3.4.0 security patch has been applied to jQuery 1.12.4 as used in ClassicPress, when you load a CP 1.0.2 site and view source, the jQuery script tag still shows version 1.12.4. This means two things:

  1. It will not be reloaded for a while on sites that have a cache operating, so the vulnerability will still be present
  2. Penetration testing tools may not realise the file is patched and would therefore still report a vulnerability.

We should change this to e.g. 1.12.4-wp1 which will address this issue.

nylen commented 5 years ago

We can use 1.12.4-wp which is what appears on the latest version of WP (https://core.trac.wordpress.org/changeset/45342). This part of the change was not backported to WP 4.9.11 (https://core.trac.wordpress.org/changeset/46020).

nylen commented 5 years ago

Specifically this part:

2019-09-16T21 02 02Z

pattonwebz commented 5 years ago

I can grab this one

nylen commented 5 years ago

@pattonwebz note that @mattyrob has just submitted a PR for this.

pattonwebz commented 5 years ago

Nice, thank you @mattyrob. I'll test the PR in a minute :)

mattyrob commented 5 years ago

@pattonwebz @nylen Pretty basic one if I read the thread correctly - happy to get some feedback and save you some time if I did it right :)

I did consider adding a -cp suffix but stuck with what WP did.