search

joeferner / redis-commander

Redis management tool written in node.js
http://joeferner.github.io/redis-commander/
MIT License
3.56k stars 460 forks source link

boostrap update to v3.3.7 too address security vulnerability with JQuery #533

Open carellevbt opened 1 year ago

carellevbt commented 1 year ago

This is to fix issue 528

carellevbt commented 1 year ago

Hello, could I please have a timeframe on when this could be completed?

sseide commented 1 year ago

Hello,

just adding the 4.6 files without using them in the existing code will not help you at all in fixing the security issue. With your patch the existing code will uses the older 2.3 files as current version does and does not change anything at all...

Therefore this will not be merged. But if you find time to rewrite the entire UI to use Bootstrap 4 i am happy to help/test/merge when it is done.

carellevbt commented 12 months ago

Good morning, thank you for the notice. Unfortunately I'm not a UI developer. I tried making some changes and it just made the UI worst. We do still need to address the security vulnerability so any help you could provide will be greatly appreciated.

sseide commented 12 months ago

Thanks, but switching to 3.3.7 is also a lot of work, way to much changed in bootstrap. I started doing it a longer time ago but did not found the time to finish it. Lots of open points there sseide/redis-commander - bootstrap3. So other fixes on top of yours can be found there probably too.

But AFAIK there is no one having time for it at the moment. And looking at the time it needs to go from Bootstrap 2 to 3 and than going to 4 is needed sooner or later too - I am not sure if it is good time spend and not better to go directly to 4... But i will definitely approve an update to 3 as soon as it is ready to replace 2 if someone else find the time...

carellevbt commented 9 months ago

Hi @sseide , I am checking for an update on this issue.

carellevbt commented 3 months ago

Good morning @sseide , is there any available update on this request? We have some security vulnerabilities pending for the JQuery version and are looking for a timeline for the bootstrap update.

Also I see on dockerhub the latest tag was published 3 yrs ago (https://hub.docker.com/r/rediscommander/redis-commander/tags). Is this accurate?

sseide commented 3 months ago

you are right about dockerhub - and it is mentioned right on top of the Readme:

Or run Redis Commander as Docker image ghcr.io/joeferner/redis-commander (instructions see below).

Multi-Arch images built are available at ghcr.io/joeferner/redis-commander:latest.

Remark: new version are not published to Dockerhub right now.

As there is no access to docker hub for automatic releases they are not published anymore.

And for Bootstrap update - no time for a complete UI rewrite yet and no timeline. But - as mentioned - help welcome