From bdc62dfcc3c65a66e0eaa0238ad1c3b90dac29ff Mon Sep 17 00:00:00 2001 From: Matthias Date: Mon, 4 Apr 2022 23:53:35 +0200 Subject: [PATCH 01/35] mark active sample code as a sample --- InvenTree/plugin/integration.py | 8 ++++++++ InvenTree/templates/InvenTree/settings/plugin.html | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/InvenTree/plugin/integration.py b/InvenTree/plugin/integration.py index de95adb8f8..7797134b14 100644 --- a/InvenTree/plugin/integration.py +++ b/InvenTree/plugin/integration.py @@ -94,6 +94,14 @@ class IntegrationPluginBase(MixinBase, plugin_base.InvenTreePluginBase): """ return getattr(self, 'is_package', False) + @property + def is_sample(self): + """ + Is this plugin part of the samples? + """ + path = str(self.package_path) + return path.startswith('plugin/samples/') + # region properties @property def slug(self): diff --git a/InvenTree/templates/InvenTree/settings/plugin.html b/InvenTree/templates/InvenTree/settings/plugin.html index 139ce0d41a..3ea8d9734c 100644 --- a/InvenTree/templates/InvenTree/settings/plugin.html +++ b/InvenTree/templates/InvenTree/settings/plugin.html @@ -76,6 +76,12 @@ {% endfor %} {% endif %} + {% if plugin.is_sample %} + + {% trans "code sample" %} + + {% endif %} + {% if plugin.website %} {% endif %} From d93cc78bf6e7aa9b2274520c920ef570472d64ce Mon Sep 17 00:00:00 2001 From: Awf Wiswasi <55606355+awiswasi@users.noreply.github.com> Date: Tue, 19 Apr 2022 05:50:17 -0700 Subject: [PATCH 02/35] Fixed vulnerability to Cross-site Scripting (XSS) when accepting the value of altField option of the Datepicker widget from untrusted sources, which may lead to execution of untrusted code. Vulnerability fixed in jquery-ui@1.13.0 --- InvenTree/InvenTree/static/script/jquery-ui/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/InvenTree/InvenTree/static/script/jquery-ui/package.json b/InvenTree/InvenTree/static/script/jquery-ui/package.json index e3c846e3a8..dc32b2db84 100644 --- a/InvenTree/InvenTree/static/script/jquery-ui/package.json +++ b/InvenTree/InvenTree/static/script/jquery-ui/package.json @@ -2,7 +2,7 @@ "name": "jquery-ui", "title": "jQuery UI", "description": "A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.", - "version": "1.12.1", + "version": "1.13.0", "homepage": "http://jqueryui.com", "author": { "name": "jQuery Foundation and other contributors", From 761e822a4e890e796e7517d0a84bb24254163f42 Mon Sep 17 00:00:00 2001 From: Awf Wiswasi <55606355+awiswasi@users.noreply.github.com> Date: Tue, 19 Apr 2022 17:36:34 -0700 Subject: [PATCH 03/35] Updated jquery v1.12.1 to v1.13.0 to fix a possible XSS vulnerability. --- .../static/script/jquery-ui/jquery-ui.js | 30 +++++++++---------- .../static/script/jquery-ui/jquery-ui.min.js | 4 +-- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js b/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js index aa871b2a59..bfed42f715 100644 --- a/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js +++ b/InvenTree/InvenTree/static/script/jquery-ui/jquery-ui.js @@ -1,4 +1,4 @@ -/*! jQuery UI - v1.12.1 - 2021-07-18 +/*! jQuery UI - v1.13.0 - 2021-10-07 * http://jqueryui.com * Includes: widget.js, position.js, disable-selection.js, keycode.js, unique-id.js, widgets/resizable.js, widgets/autocomplete.js, widgets/menu.js, widgets/mouse.js * Copyright jQuery Foundation and other contributors; Licensed MIT */ @@ -17,11 +17,11 @@ $.ui = $.ui || {}; -var version = $.ui.version = "1.12.1"; +var version = $.ui.version = "1.13.1"; /*! - * jQuery UI Widget 1.12.1 + * jQuery UI Widget 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -744,7 +744,7 @@ var widget = $.widget; /*! - * jQuery UI Position 1.12.1 + * jQuery UI Position 1.13.1 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1232,7 +1232,7 @@ var position = $.ui.position; /*! - * jQuery UI Disable Selection 1.12.1 + * jQuery UI Disable Selection 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1268,7 +1268,7 @@ var disableSelection = $.fn.extend( { /*! - * jQuery UI Keycode 1.12.1 + * jQuery UI Keycode 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1303,7 +1303,7 @@ var keycode = $.ui.keyCode = { /*! - * jQuery UI Unique ID 1.12.1 + * jQuery UI Unique ID 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1347,7 +1347,7 @@ var uniqueId = $.fn.extend( { var ie = $.ui.ie = !!/msie [\w.]+/.exec( navigator.userAgent.toLowerCase() ); /*! - * jQuery UI Mouse 1.12.1 + * jQuery UI Mouse 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1368,7 +1368,7 @@ $( document ).on( "mouseup", function() { } ); var widgetsMouse = $.widget( "ui.mouse", { - version: "1.12.1", + version: "1.13.0", options: { cancel: "input, textarea, button, select, option", distance: 1, @@ -1592,7 +1592,7 @@ var plugin = $.ui.plugin = { /*! - * jQuery UI Resizable 1.12.1 + * jQuery UI Resizable 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -1612,7 +1612,7 @@ var plugin = $.ui.plugin = { $.widget( "ui.resizable", $.ui.mouse, { - version: "1.12.1", + version: "1.13.0", widgetEventPrefix: "resize", options: { alsoResize: false, @@ -2806,7 +2806,7 @@ var safeActiveElement = $.ui.safeActiveElement = function( document ) { /*! - * jQuery UI Menu 1.12.1 + * jQuery UI Menu 1.13.0 * http://jqueryui.com * * Copyright jQuery Foundation and other contributors @@ -2826,7 +2826,7 @@ var safeActiveElement = $.ui.safeActiveElement = function( document ) { var widgetsMenu = $.widget( "ui.menu", { - version: "1.12.1", + version: "1.13.0", defaultElement: "