EPrints Technical Mailing List Archive

See the EPrints wiki for instructions on how to join this mailing list and related information.

Message: #10431

< Previous (by date) | Next (by date) > | < Previous (in thread) | Next (in thread) > | Messages - Most Recent First | Threads - Most Recent First

[EP-tech] JQuery version questions

CAUTION: This e-mail originated outside the University of Southampton.
Hello all,

Our security team has pointed out that our EPrints 3.4.6 installation includes an outdated JQuery UI (version 1.12.1) which is vulnerable to a number of exploits including running arbitrary code. They say the code needs to be updated to Jquery 1.14.

Our Linux admins suggest installing JQuery via the operating system package managers so that it would be kept up to date automatically and including it in EPrints via a symbolic link.

Having looked into it, the file gets delivered to the browser as part of a large lump of _javascript_ going by the name https://etheses.durham.ac.uk/_javascript_/auto-3.4.6.js so it doesn’t look like a straightforward thing to upgrade. The comments in that file confirm the version:

/* From: /opt/eprints3/ingredients/jquery/static/_javascript_/auto/01_jquery-ui.js */

/*! jQuery UI - v1.12.1 - 2016-09-14

The vulnerability was added as an issue for the 3.4.7 version upgrade  https://github.com/eprints/eprints3.4/issues/502 

Is it better simply to upgrade to 3.4.7 (is that simple?) or can we upgrade the JQuery bits and recompile the auto.js file?

Given the issue mentions that these components are “not used by default” how can we tell whether they are even in use in our installation?


Many thanks in advance of any help or advice anyone can offer!

Tom


 

 

Thomas Hyland

Senior Manager: Library Systems

 

Durham University | University Library and Collections | Bill Bryson Library | Stockton Road | Durham | DH1 3LY 

E: thomas.d.hyland@durham.ac.uk |  www.durham.ac.uk/library 

 

The information in this e-mail and any attachments is confidential. It is intended solely for the addressee or addressees. If you are not the intended recipient please delete the message and any attachments and notify the sender of misdelivery. Any use or disclosure of the contents of either is unauthorised and may be unlawful. This e-mail has been created in the knowledge that Internet e-mail is not a 100% secure communications medium. We advise that you understand and observe this lack of security when e-mailing us. Although steps have been taken to ensure that this e-mail and any attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. All liability for viruses is excluded to the fullest extent permitted by law.