From 580c3f4ffe9608d2beb56d418c68b3b112420e76 Mon Sep 17 00:00:00 2001 From: Mario Date: Sun, 10 Nov 2019 12:49:51 +0000 Subject: another bulk of composer updates (cherry picked from commit 6685381fd8db507493c3d7c1793f8c05c681bbce) --- .../blueimp/jquery-file-upload/.github/FUNDING.yml | 1 + .../jquery-file-upload/.github/workflows/test.yml | 84 + vendor/blueimp/jquery-file-upload/.gitignore | 2 +- vendor/blueimp/jquery-file-upload/.jshintrc | 81 - vendor/blueimp/jquery-file-upload/.npmignore | 20 - vendor/blueimp/jquery-file-upload/CONTRIBUTING.md | 15 - vendor/blueimp/jquery-file-upload/LICENSE.txt | 23 +- vendor/blueimp/jquery-file-upload/README.md | 268 +- vendor/blueimp/jquery-file-upload/SECURITY.md | 140 +- .../blueimp/jquery-file-upload/VULNERABILITIES.md | 121 +- vendor/blueimp/jquery-file-upload/angularjs.html | 211 - vendor/blueimp/jquery-file-upload/basic-plus.html | 226 - vendor/blueimp/jquery-file-upload/basic.html | 136 - .../jquery-file-upload/bower-version-update.js | 16 - vendor/blueimp/jquery-file-upload/bower.json | 64 - .../jquery-file-upload/cors/postmessage.html | 126 +- vendor/blueimp/jquery-file-upload/cors/result.html | 22 +- .../jquery-file-upload/css/jquery-ui-demo-ie8.css | 21 - .../jquery-file-upload/css/jquery-ui-demo.css | 67 - .../css/jquery.fileupload-ui.css | 16 +- vendor/blueimp/jquery-file-upload/css/style.css | 15 - .../blueimp/jquery-file-upload/docker-compose.yml | 59 + vendor/blueimp/jquery-file-upload/index.html | 569 +- vendor/blueimp/jquery-file-upload/jquery-ui.html | 256 - vendor/blueimp/jquery-file-upload/js/app.js | 101 - .../js/cors/jquery.postmessage-transport.js | 218 +- .../js/cors/jquery.xdr-transport.js | 154 +- vendor/blueimp/jquery-file-upload/js/demo.js | 75 + .../js/jquery.fileupload-angular.js | 438 - .../js/jquery.fileupload-audio.js | 176 +- .../js/jquery.fileupload-image.js | 613 +- .../js/jquery.fileupload-jquery-ui.js | 161 - .../js/jquery.fileupload-process.js | 289 +- .../jquery-file-upload/js/jquery.fileupload-ui.js | 1431 +- .../js/jquery.fileupload-validate.js | 188 +- .../js/jquery.fileupload-video.js | 176 +- .../jquery-file-upload/js/jquery.fileupload.js | 3032 ++-- .../js/jquery.iframe-transport.js | 407 +- vendor/blueimp/jquery-file-upload/js/main.js | 75 - .../blueimp/jquery-file-upload/package-lock.json | 4232 +++++ vendor/blueimp/jquery-file-upload/package.json | 81 +- .../server/php/UploadHandler.php | 8 +- .../server/php/docker-compose.yml | 9 - vendor/blueimp/jquery-file-upload/test/Dockerfile | 26 + vendor/blueimp/jquery-file-upload/test/index.html | 195 +- vendor/blueimp/jquery-file-upload/test/test.js | 1292 -- vendor/blueimp/jquery-file-upload/test/unit.js | 992 + .../blueimp/jquery-file-upload/test/vendor/chai.js | 10854 +++++++++++ .../jquery-file-upload/test/vendor/mocha.css | 326 + .../jquery-file-upload/test/vendor/mocha.js | 18076 +++++++++++++++++++ .../blueimp/jquery-file-upload/wdio/.eslintrc.js | 10 + .../blueimp/jquery-file-upload/wdio/.prettierrc.js | 7 + vendor/blueimp/jquery-file-upload/wdio/LICENSE.txt | 20 + .../jquery-file-upload/wdio/assets/black-80x60.gif | Bin 0 -> 108 bytes .../jquery-file-upload/wdio/assets/white-1x2.jpg | Bin 0 -> 713 bytes .../jquery-file-upload/wdio/bin/forward-ports.sh | 85 + .../jquery-file-upload/wdio/bin/safaridriver.sh | 31 + vendor/blueimp/jquery-file-upload/wdio/chrome.js | 36 + vendor/blueimp/jquery-file-upload/wdio/firefox.js | 21 + .../blueimp/jquery-file-upload/wdio/hooks/index.js | 21 + vendor/blueimp/jquery-file-upload/wdio/ie.js | 20 + .../jquery-file-upload/wdio/reports/.gitignore | 2 + vendor/blueimp/jquery-file-upload/wdio/safari.js | 20 + .../wdio/test/pages/file-upload.js | 75 + .../wdio/test/specs/01-file-upload.js | 23 + .../blueimp/jquery-file-upload/wdio/wdio.conf.js | 1 + 66 files changed, 39426 insertions(+), 7130 deletions(-) create mode 100644 vendor/blueimp/jquery-file-upload/.github/FUNDING.yml create mode 100644 vendor/blueimp/jquery-file-upload/.github/workflows/test.yml delete mode 100644 vendor/blueimp/jquery-file-upload/.jshintrc delete mode 100644 vendor/blueimp/jquery-file-upload/.npmignore delete mode 100644 vendor/blueimp/jquery-file-upload/CONTRIBUTING.md delete mode 100644 vendor/blueimp/jquery-file-upload/angularjs.html delete mode 100644 vendor/blueimp/jquery-file-upload/basic-plus.html delete mode 100644 vendor/blueimp/jquery-file-upload/basic.html delete mode 100644 vendor/blueimp/jquery-file-upload/bower-version-update.js delete mode 100644 vendor/blueimp/jquery-file-upload/bower.json delete mode 100644 vendor/blueimp/jquery-file-upload/css/jquery-ui-demo-ie8.css delete mode 100644 vendor/blueimp/jquery-file-upload/css/jquery-ui-demo.css delete mode 100644 vendor/blueimp/jquery-file-upload/css/style.css create mode 100644 vendor/blueimp/jquery-file-upload/docker-compose.yml delete mode 100644 vendor/blueimp/jquery-file-upload/jquery-ui.html delete mode 100644 vendor/blueimp/jquery-file-upload/js/app.js create mode 100644 vendor/blueimp/jquery-file-upload/js/demo.js delete mode 100644 vendor/blueimp/jquery-file-upload/js/jquery.fileupload-angular.js delete mode 100644 vendor/blueimp/jquery-file-upload/js/jquery.fileupload-jquery-ui.js delete mode 100644 vendor/blueimp/jquery-file-upload/js/main.js create mode 100644 vendor/blueimp/jquery-file-upload/package-lock.json delete mode 100644 vendor/blueimp/jquery-file-upload/server/php/docker-compose.yml create mode 100644 vendor/blueimp/jquery-file-upload/test/Dockerfile delete mode 100644 vendor/blueimp/jquery-file-upload/test/test.js create mode 100644 vendor/blueimp/jquery-file-upload/test/unit.js create mode 100644 vendor/blueimp/jquery-file-upload/test/vendor/chai.js create mode 100644 vendor/blueimp/jquery-file-upload/test/vendor/mocha.css create mode 100644 vendor/blueimp/jquery-file-upload/test/vendor/mocha.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/.eslintrc.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/.prettierrc.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/LICENSE.txt create mode 100644 vendor/blueimp/jquery-file-upload/wdio/assets/black-80x60.gif create mode 100644 vendor/blueimp/jquery-file-upload/wdio/assets/white-1x2.jpg create mode 100644 vendor/blueimp/jquery-file-upload/wdio/bin/forward-ports.sh create mode 100644 vendor/blueimp/jquery-file-upload/wdio/bin/safaridriver.sh create mode 100644 vendor/blueimp/jquery-file-upload/wdio/chrome.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/firefox.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/hooks/index.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/ie.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/reports/.gitignore create mode 100644 vendor/blueimp/jquery-file-upload/wdio/safari.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/test/pages/file-upload.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/test/specs/01-file-upload.js create mode 100644 vendor/blueimp/jquery-file-upload/wdio/wdio.conf.js (limited to 'vendor/blueimp') diff --git a/vendor/blueimp/jquery-file-upload/.github/FUNDING.yml b/vendor/blueimp/jquery-file-upload/.github/FUNDING.yml new file mode 100644 index 000000000..048b1cf2c --- /dev/null +++ b/vendor/blueimp/jquery-file-upload/.github/FUNDING.yml @@ -0,0 +1 @@ +github: [blueimp] diff --git a/vendor/blueimp/jquery-file-upload/.github/workflows/test.yml b/vendor/blueimp/jquery-file-upload/.github/workflows/test.yml new file mode 100644 index 000000000..f7c4b8bb9 --- /dev/null +++ b/vendor/blueimp/jquery-file-upload/.github/workflows/test.yml @@ -0,0 +1,84 @@ +name: Test + +on: [push, pull_request] + +jobs: + lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: Setup Node.js + uses: actions/setup-node@v1 + with: + node-version: 12.x + - name: npm install + run: npm install + env: + CI: true + - name: lint + run: npm run lint + env: + CI: true + + mocha: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: chmod + run: chmod -R 777 server/php/files + - name: docker-compose build + run: docker-compose build example mocha + - name: mocha + run: docker-compose run --rm mocha + - name: docker-compose logs + if: always() + run: docker-compose logs example + - name: docker-compose down + if: always() + run: docker-compose down -v + + wdio-chrome: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: chmod + run: chmod -R 777 server/php/files wdio/reports + - name: docker-compose build + run: docker-compose build example + - name: wdio chrome + run: docker-compose run --rm wdio + - name: docker-compose logs + if: always() + run: docker-compose logs example + - name: docker-compose down + if: always() + run: docker-compose down -v + - name: Upload reports + if: always() + uses: actions/upload-artifact@master + with: + name: reports + path: wdio/reports + + wdio-firefox: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - name: chmod + run: chmod -R 777 server/php/files wdio/reports + - name: docker-compose build + run: docker-compose build example + - name: wdio firefox + run: docker-compose run --rm wdio firefox + - name: docker-compose logs + if: always() + run: docker-compose logs example + - name: docker-compose down + if: always() + run: docker-compose down -v + - name: Upload reports + if: always() + uses: actions/upload-artifact@master + with: + name: reports + path: wdio/reports diff --git a/vendor/blueimp/jquery-file-upload/.gitignore b/vendor/blueimp/jquery-file-upload/.gitignore index 29a41a8c4..84901da00 100644 --- a/vendor/blueimp/jquery-file-upload/.gitignore +++ b/vendor/blueimp/jquery-file-upload/.gitignore @@ -1,3 +1,3 @@ -.DS_Store *.pyc +.env node_modules diff --git a/vendor/blueimp/jquery-file-upload/.jshintrc b/vendor/blueimp/jquery-file-upload/.jshintrc deleted file mode 100644 index 4ad82e664..000000000 --- a/vendor/blueimp/jquery-file-upload/.jshintrc +++ /dev/null @@ -1,81 +0,0 @@ -{ - "bitwise" : true, // true: Prohibit bitwise operators (&, |, ^, etc.) - "camelcase" : true, // true: Identifiers must be in camelCase - "curly" : true, // true: Require {} for every new block or scope - "eqeqeq" : true, // true: Require triple equals (===) for comparison - "forin" : true, // true: Require filtering for..in loops with obj.hasOwnProperty() - "immed" : true, // true: Require immediate invocations to be wrapped in parens - // e.g. `(function () { } ());` - "indent" : 4, // {int} Number of spaces to use for indentation - "latedef" : true, // true: Require variables/functions to be defined before being used - "newcap" : true, // true: Require capitalization of all constructor functions e.g. `new F()` - "noarg" : true, // true: Prohibit use of `arguments.caller` and `arguments.callee` - "noempty" : true, // true: Prohibit use of empty blocks - "nonew" : true, // true: Prohibit use of constructors for side-effects (without assignment) - "plusplus" : false, // true: Prohibit use of `++` & `--` - "quotmark" : "single", // Quotation mark consistency: - // false : do nothing (default) - // true : ensure whatever is used is consistent - // "single" : require single quotes - // "double" : require double quotes - "undef" : true, // true: Require all non-global variables to be declared (prevents global leaks) - "unused" : true, // true: Require all defined variables be used - "strict" : true, // true: Requires all functions run in ES5 Strict Mode - "trailing" : true, // true: Prohibit trailing whitespaces - "maxparams" : false, // {int} Max number of formal params allowed per function - "maxdepth" : false, // {int} Max depth of nested blocks (within functions) - "maxstatements" : false, // {int} Max number statements per function - "maxcomplexity" : false, // {int} Max cyclomatic complexity per function - "maxlen" : false, // {int} Max number of characters per line - - // Relaxing - "asi" : false, // true: Tolerate Automatic Semicolon Insertion (no semicolons) - "boss" : false, // true: Tolerate assignments where comparisons would be expected - "debug" : false, // true: Allow debugger statements e.g. browser breakpoints. - "eqnull" : false, // true: Tolerate use of `== null` - "es5" : false, // true: Allow ES5 syntax (ex: getters and setters) - "esnext" : false, // true: Allow ES.next (ES6) syntax (ex: `const`) - "moz" : false, // true: Allow Mozilla specific syntax (extends and overrides esnext features) - // (ex: `for each`, multiple try/catch, function expression…) - "evil" : false, // true: Tolerate use of `eval` and `new Function()` - "expr" : false, // true: Tolerate `ExpressionStatement` as Programs - "funcscope" : false, // true: Tolerate defining variables inside control statements" - "globalstrict" : false, // true: Allow global "use strict" (also enables 'strict') - "iterator" : false, // true: Tolerate using the `__iterator__` property - "lastsemic" : false, // true: Tolerate omitting a semicolon for the last statement of a 1-line block - "laxbreak" : false, // true: Tolerate possibly unsafe line breakings - "laxcomma" : false, // true: Tolerate comma-first style coding - "loopfunc" : false, // true: Tolerate functions being defined in loops - "multistr" : false, // true: Tolerate multi-line strings - "proto" : false, // true: Tolerate using the `__proto__` property - "scripturl" : false, // true: Tolerate script-targeted URLs - "smarttabs" : false, // true: Tolerate mixed tabs/spaces when used for alignment - "shadow" : false, // true: Allows re-define variables later in code e.g. `var x=1; x=2;` - "sub" : false, // true: Tolerate using `[]` notation when it can still be expressed in dot notation - "supernew" : false, // true: Tolerate `new function () { ... };` and `new Object;` - "validthis" : false, // true: Tolerate using this in a non-constructor function - - // Environments - "browser" : false, // Web Browser (window, document, etc) - "couch" : false, // CouchDB - "devel" : false, // Development/debugging (alert, confirm, etc) - "dojo" : false, // Dojo Toolkit - "jquery" : false, // jQuery - "mootools" : false, // MooTools - "node" : false, // Node.js - "nonstandard" : false, // Widely adopted globals (escape, unescape, etc) - "prototypejs" : false, // Prototype and Scriptaculous - "rhino" : false, // Rhino - "worker" : false, // Web Workers - "wsh" : false, // Windows Scripting Host - "yui" : false, // Yahoo User Interface - - // Legacy - "nomen" : true, // true: Prohibit dangling `_` in variables - "onevar" : true, // true: Allow only one `var` statement per function - "passfail" : false, // true: Stop on first error - "white" : true, // true: Check against strict whitespace and indentation rules - - // Custom Globals - "globals" : {} // additional predefined global variables -} diff --git a/vendor/blueimp/jquery-file-upload/.npmignore b/vendor/blueimp/jquery-file-upload/.npmignore deleted file mode 100644 index 0530f5dbd..000000000 --- a/vendor/blueimp/jquery-file-upload/.npmignore +++ /dev/null @@ -1,20 +0,0 @@ -* -!css/jquery.fileupload-noscript.css -!css/jquery.fileupload-ui-noscript.css -!css/jquery.fileupload-ui.css -!css/jquery.fileupload.css -!img/loading.gif -!img/progressbar.gif -!js/cors/jquery.postmessage-transport.js -!js/cors/jquery.xdr-transport.js -!js/vendor/jquery.ui.widget.js -!js/jquery.fileupload-angular.js -!js/jquery.fileupload-audio.js -!js/jquery.fileupload-image.js -!js/jquery.fileupload-jquery-ui.js -!js/jquery.fileupload-process.js -!js/jquery.fileupload-ui.js -!js/jquery.fileupload-validate.js -!js/jquery.fileupload-video.js -!js/jquery.fileupload.js -!js/jquery.iframe-transport.js diff --git a/vendor/blueimp/jquery-file-upload/CONTRIBUTING.md b/vendor/blueimp/jquery-file-upload/CONTRIBUTING.md deleted file mode 100644 index e182f9b37..000000000 --- a/vendor/blueimp/jquery-file-upload/CONTRIBUTING.md +++ /dev/null @@ -1,15 +0,0 @@ -Please follow these pull request guidelines: - -1. Update your fork to the latest upstream version. - -2. Follow the coding conventions of the original source files (indentation, spaces, brackets layout). - -3. Code changes must pass JSHint validation with the `.jshintrc` settings of this project. - -4. Code changes must pass the QUnit tests defined in the `test` folder. - -5. New features should be covered by accompanying QUnit tests. - -6. Keep your commits as atomic as possible, i.e. create a new commit for every single bug fix or feature added. - -7. Always add meaningful commit messages. diff --git a/vendor/blueimp/jquery-file-upload/LICENSE.txt b/vendor/blueimp/jquery-file-upload/LICENSE.txt index 87a644638..ca9e708c6 100644 --- a/vendor/blueimp/jquery-file-upload/LICENSE.txt +++ b/vendor/blueimp/jquery-file-upload/LICENSE.txt @@ -2,20 +2,19 @@ MIT License Copyright © 2010 Sebastian Tschan, https://blueimp.net -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/vendor/blueimp/jquery-file-upload/README.md b/vendor/blueimp/jquery-file-upload/README.md index ef839d6c7..f3ca43f3c 100644 --- a/vendor/blueimp/jquery-file-upload/README.md +++ b/vendor/blueimp/jquery-file-upload/README.md @@ -1,121 +1,225 @@ -# jQuery File Upload Plugin +# jQuery File Upload + +## Contents + +- [Description](#description) +- [Demo](#demo) +- [Features](#features) +- [Security](#security) +- [Setup](#setup) +- [Requirements](#requirements) + - [Mandatory requirements](#mandatory-requirements) + - [Optional requirements](#optional-requirements) + - [Cross-domain requirements](#cross-domain-requirements) +- [Browsers](#browsers) + - [Desktop browsers](#desktop-browsers) + - [Mobile browsers](#mobile-browsers) + - [Extended browser support information](#extended-browser-support-information) +- [Testing](#testing) +- [Support](#support) +- [License](#license) ## Description -File Upload widget with multiple file selection, drag&drop support, progress bars, validation and preview images, audio and video for jQuery. -Supports cross-domain, chunked and resumable file uploads and client-side image resizing. Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads. -## Demo -[Demo File Upload](https://blueimp.github.io/jQuery-File-Upload/) - -## ⚠️ Security Notice -Security related releases: - -* [v9.25.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.25.1) Mitigates some [Potential vulnerabilities with PHP+ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php-imagemagick). -* [v9.24.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.24.1) Fixes a [Remote code execution vulnerability in the PHP component](VULNERABILITIES.md#remote-code-execution-vulnerability-in-the-php-component). -* v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) Fixes an [Open redirect vulnerability in the GAE components](VULNERABILITIES.md#open-redirect-vulnerability-in-the-gae-components). -* Commit [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) (*fixed in all tagged releases*) Fixes a [Cross-site scripting vulnerability in the Iframe Transport](VULNERABILITIES.md#cross-site-scripting-vulnerability-in-the-iframe-transport). +> File Upload widget with multiple file selection, drag&drop support, +> progress bars, validation and preview images, audio and video for jQuery. +> Supports cross-domain, chunked and resumable file uploads and client-side +> image resizing. +> Works with any server-side platform (PHP, Python, Ruby on Rails, Java, +> Node.js, Go etc.) that supports standard HTML form file uploads. -Please read the [SECURITY](SECURITY.md) document for instructions on how to securely configure your Webserver for file uploads. +## Demo -## Setup -* [How to setup the plugin on your website](https://github.com/blueimp/jQuery-File-Upload/wiki/Setup) -* [How to use only the basic plugin (minimal setup guide).](https://github.com/blueimp/jQuery-File-Upload/wiki/Basic-plugin) +[Demo File Upload](https://blueimp.github.io/jQuery-File-Upload/) ## Features -* **Multiple file upload:** + +- **Multiple file upload:** Allows to select multiple files at once and upload them simultaneously. -* **Drag & Drop support:** - Allows to upload files by dragging them from your desktop or file manager and dropping them on your browser window. -* **Upload progress bar:** - Shows a progress bar indicating the upload progress for individual files and for all uploads combined. -* **Cancelable uploads:** +- **Drag & Drop support:** + Allows to upload files by dragging them from your desktop or file manager and + dropping them on your browser window. +- **Upload progress bar:** + Shows a progress bar indicating the upload progress for individual files and + for all uploads combined. +- **Cancelable uploads:** Individual file uploads can be canceled to stop the upload progress. -* **Resumable uploads:** +- **Resumable uploads:** Aborted uploads can be resumed with browsers supporting the Blob API. -* **Chunked uploads:** - Large files can be uploaded in smaller chunks with browsers supporting the Blob API. -* **Client-side image resizing:** - Images can be automatically resized on client-side with browsers supporting the required JS APIs. -* **Preview images, audio and video:** - A preview of image, audio and video files can be displayed before uploading with browsers supporting the required APIs. -* **No browser plugins (e.g. Adobe Flash) required:** - The implementation is based on open standards like HTML5 and JavaScript and requires no additional browser plugins. -* **Graceful fallback for legacy browsers:** - Uploads files via XMLHttpRequests if supported and uses iframes as fallback for legacy browsers. -* **HTML file upload form fallback:** - Allows progressive enhancement by using a standard HTML file upload form as widget element. -* **Cross-site file uploads:** - Supports uploading files to a different domain with cross-site XMLHttpRequests or iframe redirects. -* **Multiple plugin instances:** +- **Chunked uploads:** + Large files can be uploaded in smaller chunks with browsers supporting the + Blob API. +- **Client-side image resizing:** + Images can be automatically resized on client-side with browsers supporting + the required JS APIs. +- **Preview images, audio and video:** + A preview of image, audio and video files can be displayed before uploading + with browsers supporting the required APIs. +- **No browser plugins (e.g. Adobe Flash) required:** + The implementation is based on open standards like HTML5 and JavaScript and + requires no additional browser plugins. +- **Graceful fallback for legacy browsers:** + Uploads files via XMLHttpRequests if supported and uses iframes as fallback + for legacy browsers. +- **HTML file upload form fallback:** + Allows progressive enhancement by using a standard HTML file upload form as + widget element. +- **Cross-site file uploads:** + Supports uploading files to a different domain with cross-site XMLHttpRequests + or iframe redirects. +- **Multiple plugin instances:** Allows to use multiple plugin instances on the same webpage. -* **Customizable and extensible:** - Provides an API to set individual options and define callback methods for various upload events. -* **Multipart and file contents stream uploads:** - Files can be uploaded as standard "multipart/form-data" or file contents stream (HTTP PUT file upload). -* **Compatible with any server-side application platform:** - Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads. +- **Customizable and extensible:** + Provides an API to set individual options and define callback methods for + various upload events. +- **Multipart and file contents stream uploads:** + Files can be uploaded as standard "multipart/form-data" or file contents + stream (HTTP PUT file upload). +- **Compatible with any server-side application platform:** + Works with any server-side platform (PHP, Python, Ruby on Rails, Java, + Node.js, Go etc.) that supports standard HTML form file uploads. + +## Security + +⚠️ Please read the [VULNERABILITIES](VULNERABILITIES.md) document for a list of +fixed vulnerabilities + +Please also read the [SECURITY](SECURITY.md) document for instructions on how to +securely configure your Webserver for file uploads. + +## Setup + +jQuery File Upload can be installed via [NPM](https://www.npmjs.com/): + +```sh +npm install blueimp-file-upload +``` + +This allows you to include [jquery.fileupload.js](js/jquery.fileupload.js) and +its extensions via `node_modules`, e.g: + +```html + +``` + +The widget can then be initialized on a file upload form the following way: + +```js +$('#fileupload').fileupload(); +``` + +For further information, please refer to the following guides: + +- [Main documentation page](https://github.com/blueimp/jQuery-File-Upload/wiki) +- [List of all available Options](https://github.com/blueimp/jQuery-File-Upload/wiki/Options) +- [The plugin API](https://github.com/blueimp/jQuery-File-Upload/wiki/API) +- [How to setup the plugin on your website](https://github.com/blueimp/jQuery-File-Upload/wiki/Setup) +- [How to use only the basic plugin.](https://github.com/blueimp/jQuery-File-Upload/wiki/Basic-plugin) ## Requirements ### Mandatory requirements -* [jQuery](https://jquery.com/) v. 1.6+ -* [jQuery UI widget factory](https://api.jqueryui.com/jQuery.widget/) v. 1.9+ (included): Required for the basic File Upload plugin, but very lightweight without any other dependencies from the jQuery UI suite. -* [jQuery Iframe Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/jquery.iframe-transport.js) (included): Required for [browsers without XHR file upload support](https://github.com/blueimp/jQuery-File-Upload/wiki/Browser-support). + +- [jQuery](https://jquery.com/) v1.6+ +- [jQuery UI widget factory](https://api.jqueryui.com/jQuery.widget/) v1.9+ + (included): Required for the basic File Upload plugin, but very lightweight + without any other dependencies from the jQuery UI suite. +- [jQuery Iframe Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/jquery.iframe-transport.js) + (included): Required for + [browsers without XHR file upload support](https://github.com/blueimp/jQuery-File-Upload/wiki/Browser-support). ### Optional requirements -* [JavaScript Templates engine](https://github.com/blueimp/JavaScript-Templates) v. 2.5.4+: Used to render the selected and uploaded files for the Basic Plus UI and jQuery UI versions. -* [JavaScript Load Image library](https://github.com/blueimp/JavaScript-Load-Image) v. 1.13.0+: Required for the image previews and resizing functionality. -* [JavaScript Canvas to Blob polyfill](https://github.com/blueimp/JavaScript-Canvas-to-Blob) v. 2.1.1+:Required for the image previews and resizing functionality. -* [blueimp Gallery](https://github.com/blueimp/Gallery) v. 2.15.1+: Used to display the uploaded images in a lightbox. -* [Bootstrap](http://getbootstrap.com/) v. 3.2.0+ -* [Glyphicons](http://glyphicons.com/) -The user interface of all versions, except the jQuery UI version, is built with [Bootstrap](http://getbootstrap.com/) and icons from [Glyphicons](http://glyphicons.com/). +- [JavaScript Templates engine](https://github.com/blueimp/JavaScript-Templates) + v3+: Used to render the selected and uploaded files for the Basic Plus UI and + jQuery UI versions. +- [JavaScript Load Image library](https://github.com/blueimp/JavaScript-Load-Image) + v2+: Required for the image previews and resizing functionality. +- [JavaScript Canvas to Blob polyfill](https://github.com/blueimp/JavaScript-Canvas-to-Blob) + v3+:Required for the image previews and resizing functionality. +- [blueimp Gallery](https://github.com/blueimp/Gallery) v2+: Used to display the + uploaded images in a lightbox. +- [Bootstrap](https://getbootstrap.com/) v3+: Used for the demo design. +- [Glyphicons](https://glyphicons.com/) Icon set used by Bootstrap. ### Cross-domain requirements -[Cross-domain File Uploads](https://github.com/blueimp/jQuery-File-Upload/wiki/Cross-domain-uploads) using the [Iframe Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/jquery.iframe-transport.js) require a redirect back to the origin server to retrieve the upload results. The [example implementation](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/main.js) makes use of [result.html](https://github.com/blueimp/jQuery-File-Upload/blob/master/cors/result.html) as a static redirect page for the origin server. - -The repository also includes the [jQuery XDomainRequest Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/cors/jquery.xdr-transport.js), which enables limited cross-domain AJAX requests in Microsoft Internet Explorer 8 and 9 (IE 10 supports cross-domain XHR requests). -The XDomainRequest object allows GET and POST requests only and doesn't support file uploads. It is used on the [Demo](https://blueimp.github.io/jQuery-File-Upload/) to delete uploaded files from the cross-domain demo file upload service. - -### Custom Backends -You can add support for various backends by adhering to the specification [outlined here](https://github.com/blueimp/jQuery-File-Upload/wiki/JSON-Response). +[Cross-domain File Uploads](https://github.com/blueimp/jQuery-File-Upload/wiki/Cross-domain-uploads) +using the +[Iframe Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/jquery.iframe-transport.js) +require a redirect back to the origin server to retrieve the upload results. The +[example implementation](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/main.js) +makes use of +[result.html](https://github.com/blueimp/jQuery-File-Upload/blob/master/cors/result.html) +as a static redirect page for the origin server. + +The repository also includes the +[jQuery XDomainRequest Transport plugin](https://github.com/blueimp/jQuery-File-Upload/blob/master/js/cors/jquery.xdr-transport.js), +which enables limited cross-domain AJAX requests in Microsoft Internet Explorer +8 and 9 (IE 10 supports cross-domain XHR requests). +The XDomainRequest object allows GET and POST requests only and doesn't support +file uploads. It is used on the +[Demo](https://blueimp.github.io/jQuery-File-Upload/) to delete uploaded files +from the cross-domain demo file upload service. ## Browsers ### Desktop browsers -The File Upload plugin is regularly tested with the latest browser versions and supports the following minimal versions: -* Google Chrome -* Apple Safari 4.0+ -* Mozilla Firefox 3.0+ -* Opera 11.0+ -* Microsoft Internet Explorer 6.0+ +The File Upload plugin is regularly tested with the latest browser versions and +supports the following minimal versions: + +- Google Chrome +- Apple Safari 4.0+ +- Mozilla Firefox 3.0+ +- Opera 11.0+ +- Microsoft Internet Explorer 6.0+ ### Mobile browsers -The File Upload plugin has been tested with and supports the following mobile browsers: -* Apple Safari on iOS 6.0+ (see Caveats below) -* Google Chrome on iOS 6.0+ (see Caveats below) -* Google Chrome on Android 4.0+ -* Default Browser on Android 2.3+ -* Opera Mobile 12.0+ +The File Upload plugin has been tested with and supports the following mobile +browsers: + +- Apple Safari on iOS 6.0+ +- Google Chrome on iOS 6.0+ +- Google Chrome on Android 4.0+ +- Default Browser on Android 2.3+ +- Opera Mobile 12.0+ + +### Extended browser support information + +For a detailed overview of the features supported by each browser version and +known operating system / browser bugs, please have a look at the +[Extended browser support information](https://github.com/blueimp/jQuery-File-Upload/wiki/Browser-support). -### Caveats +## Testing -- iOS 9 has a [known bug](https://apple.stackexchange.com/questions/118154) where photos chosen from the Photo Library are all given the name `image.jpeg`, which is problematic when uploading multiple files at a time. Ideally your server should be responsible for deduplicating file uploads ([example](https://github.com/blueimp/jQuery-File-Upload/blob/master/server/php/UploadHandler.php#L490)). If you don't have control, as in the case of direct uploads to S3, you can pass an option `uniqueFilenames: {}` as part of the options object, which tells the uploader to deduplicate filenames. More details [here](https://github.com/blueimp/jQuery-File-Upload/commit/d419f43478aeafe95a794815f80a3016f58eb3b7). +The project comes with three sets of tests: -### Supported features -For a detailed overview of the features supported by each browser version, please have a look at the [Extended browser support information](https://github.com/blueimp/jQuery-File-Upload/wiki/Browser-support). +1. Code linting using [ESLint](https://eslint.org/). +2. Unit tests using [Mocha](https://mochajs.org/). +3. End-to-end tests using [blueimp/wdio](https://github.com/blueimp/wdio). -## Contributing -**Bug fixes** and **new features** can be proposed using [pull requests](https://github.com/blueimp/jQuery-File-Upload/pulls). -Please read the [contribution guidelines](https://github.com/blueimp/jQuery-File-Upload/blob/master/CONTRIBUTING.md) before submitting a pull request. +To run the tests, follow these steps: + +1. Start [Docker](https://docs.docker.com/). +2. Install development dependencies: + ```sh + npm install + ``` +3. Run the tests: + ```sh + npm test + ``` ## Support + This project is actively maintained, but there is no official support channel. -If you have a question that another developer might help you with, please post to [Stack Overflow](http://stackoverflow.com/questions/tagged/blueimp+jquery+file-upload) and tag your question with `blueimp jquery file upload`. +If you have a question that another developer might help you with, please post +to +[Stack Overflow](https://stackoverflow.com/questions/tagged/blueimp+jquery+file-upload) +and tag your question with `blueimp jquery file upload`. ## License + Released under the [MIT license](https://opensource.org/licenses/MIT). diff --git a/vendor/blueimp/jquery-file-upload/SECURITY.md b/vendor/blueimp/jquery-file-upload/SECURITY.md index 3e3d3a610..768f2b95e 100644 --- a/vendor/blueimp/jquery-file-upload/SECURITY.md +++ b/vendor/blueimp/jquery-file-upload/SECURITY.md @@ -1,68 +1,133 @@ # File Upload Security -For an in-depth understanding of the potential security risks of providing file uploads and possible mitigations, please refer to the [OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) documentation. -To securely setup the project to serve uploaded files, please refer to the sample [Secure file upload serving configurations](#secure-file-upload-serving-configurations). +## Contents -To mitigate potential vulnerabilities in image processing libraries, please refer to the [Secure image processing configurations](#secure-image-processing-configurations). +- [Introduction](#introduction) +- [Purpose of this project](#purpose-of-this-project) +- [Mitigations against file upload risks](#mitigations-against-file-upload-risks) + - [Prevent code execution on the server](#prevent-code-execution-on-the-server) + - [Prevent code execution in the browser](#prevent-code-execution-in-the-browser) + - [Prevent distribution of malware](#prevent-distribution-of-malware) +- [Secure file upload serving configurations](#secure-file-upload-serving-configurations) + - [Apache config](#apache-config) + - [NGINX config](#nginx-config) +- [Secure image processing configurations](#secure-image-processing-configurations) +- [ImageMagick config](#imagemagick-config) -By default, all sample upload handlers allow only upload of image files, which mitigates some attack vectors, but should not be relied on as the only protection. +## Introduction -Please also have a look at the [list of fixed vulnerabilities](VULNERABILITIES.md) in jQuery File Upload, which relates mostly to the sample server-side upload handlers and how they have been configured. +For an in-depth understanding of the potential security risks of providing file +uploads and possible mitigations, please refer to the +[OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) +documentation. + +To securely setup the project to serve uploaded files, please refer to the +sample +[Secure file upload serving configurations](#secure-file-upload-serving-configurations). + +To mitigate potential vulnerabilities in image processing libraries, please +refer to the +[Secure image processing configurations](#secure-image-processing-configurations). + +By default, all sample upload handlers allow only upload of image files, which +mitigates some attack vectors, but should not be relied on as the only +protection. + +Please also have a look at the +[list of fixed vulnerabilities](VULNERABILITIES.md) in jQuery File Upload, which +relates mostly to the sample server-side upload handlers and how they have been +configured. ## Purpose of this project -Please note that this project is not a complete file management product, but foremost a client-side file upload library for [jQuery](https://jquery.com/). -The server-side sample upload handlers are just examples to demonstrate the client-side file upload functionality. + +Please note that this project is not a complete file management product, but +foremost a client-side file upload library for [jQuery](https://jquery.com/). +The server-side sample upload handlers are just examples to demonstrate the +client-side file upload functionality. To make this very clear, there is **no user authentication** by default: -* **everyone can upload files** -* **everyone can delete uploaded files** -In some cases this can be acceptable, but for most projects you will want to extend the sample upload handlers to integrate user authentication, or implement your own. +- **everyone can upload files** +- **everyone can delete uploaded files** + +In some cases this can be acceptable, but for most projects you will want to +extend the sample upload handlers to integrate user authentication, or implement +your own. -It is also up to you to configure your Webserver to securely serve the uploaded files, e.g. using the [sample server configurations](#secure-file-upload-serving-configurations). +It is also up to you to configure your Webserver to securely serve the uploaded +files, e.g. using the +[sample server configurations](#secure-file-upload-serving-configurations). ## Mitigations against file upload risks ### Prevent code execution on the server -To prevent execution of scripts or binaries on server-side, the upload directory must be configured to not execute files in the upload directory (e.g. `server/php/files` as the default for the PHP upload handler) and only treat uploaded files as static content. -The recommended way to do this is to configure the upload directory path to point outside of the web application root. -Then the Webserver can be configured to serve files from the upload directory with their default static files handler only. +To prevent execution of scripts or binaries on server-side, the upload directory +must be configured to not execute files in the upload directory (e.g. +`server/php/files` as the default for the PHP upload handler) and only treat +uploaded files as static content. + +The recommended way to do this is to configure the upload directory path to +point outside of the web application root. +Then the Webserver can be configured to serve files from the upload directory +with their default static files handler only. -Limiting file uploads to a whitelist of safe file types (e.g. image files) also mitigates this issue, but should not be the only protection. +Limiting file uploads to a whitelist of safe file types (e.g. image files) also +mitigates this issue, but should not be the only protection. ### Prevent code execution in the browser -To prevent execution of scripts on client-side, the following headers must -be sent when delivering generic uploaded files to the client: + +To prevent execution of scripts on client-side, the following headers must be +sent when delivering generic uploaded files to the client: ``` Content-Type: application/octet-stream X-Content-Type-Options: nosniff ``` -The `Content-Type: application/octet-stream` header instructs browsers to display a download dialog instead of parsing it and possibly executing script content e.g. in HTML files. +The `Content-Type: application/octet-stream` header instructs browsers to +display a download dialog instead of parsing it and possibly executing script +content e.g. in HTML files. -The `X-Content-Type-Options: nosniff` header prevents browsers to try to detect the file mime type despite the given content-type header. +The `X-Content-Type-Options: nosniff` header prevents browsers to try to detect +the file mime type despite the given content-type header. -For known safe files, the content-type header can be adjusted using a **whitelist**, e.g. sending `Content-Type: image/png` for PNG files. +For known safe files, the content-type header can be adjusted using a +**whitelist**, e.g. sending `Content-Type: image/png` for PNG files. ### Prevent distribution of malware -To prevent attackers from uploading and distributing malware (e.g. computer viruses), it is recommended to limit file uploads only to a whitelist of safe file types. -Please note that the detection of file types in the sample file upload handlers is based on the file extension and not the actual file content. This makes it still possible for attackers to upload malware by giving their files an image file extension, but should prevent automatic execution on client computers when opening those files. +To prevent attackers from uploading and distributing malware (e.g. computer +viruses), it is recommended to limit file uploads only to a whitelist of safe +file types. + +Please note that the detection of file types in the sample file upload handlers +is based on the file extension and not the actual file content. This makes it +still possible for attackers to upload malware by giving their files an image +file extension, but should prevent automatic execution on client computers when +opening those files. -It does not protect at all from exploiting vulnerabilities in image display programs, nor from users renaming file extensions to inadvertently execute the contained malicious code. +It does not protect at all from exploiting vulnerabilities in image display +programs, nor from users renaming file extensions to inadvertently execute the +contained malicious code. ## Secure file upload serving configurations -The following configurations serve uploaded files as static files with the proper headers as [mitigation against file upload risks](#mitigations-against-file-upload-risks). -Please do not simply copy&paste these configurations, but make sure you understand what they are doing and that you have implemented them correctly. + +The following configurations serve uploaded files as static files with the +proper headers as +[mitigation against file upload risks](#mitigations-against-file-upload-risks). +Please do not simply copy&paste these configurations, but make sure you +understand what they are doing and that you have implemented them correctly. > Always test your own setup and make sure that it is secure! -e.g. try uploading PHP scripts (as "example.php", "example.php.png" and "example.png") to see if they get executed by your Webserver. +e.g. try uploading PHP scripts (as "example.php", "example.php.png" and +"example.png") to see if they get executed by your Webserver. ### Apache config -Add the following directive to the Apache config, replacing the directory path with the absolute path to the upload directory: + +Add the following directive to the Apache config, replacing the directory path +with the absolute path to the upload directory: ```ApacheConf @@ -91,7 +156,9 @@ Add the following directive to the Apache config, replacing the directory path w ``` ### NGINX config -Add the following directive to the NGINX config, replacing the directory path with the absolute path to the upload directory: + +Add the following directive to the NGINX config, replacing the directory path +with the absolute path to the upload directory: ```Nginx location ^~ /path/to/project/server/php/files { @@ -113,13 +180,22 @@ location ^~ /path/to/project/server/php/files { ``` ## Secure image processing configurations -The following configuration mitigates [potential image processing vulnerabilities with ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php-imagemagick) by limiting the attack vectors to a small subset of image types (`GIF/JPEG/PNG`). -Please also consider using alternative, safer image processing libraries like [libvips](https://github.com/libvips/libvips) or [imageflow](https://github.com/imazen/imageflow). +The following configuration mitigates +[potential image processing vulnerabilities with ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php-imagemagick) +by limiting the attack vectors to a small subset of image types +(`GIF/JPEG/PNG`). + +Please also consider using alternative, safer image processing libraries like +[libvips](https://github.com/libvips/libvips) or +[imageflow](https://github.com/imazen/imageflow). ## ImageMagick config -It is recommended to disable all non-required ImageMagick coders via [policy.xml](https://wiki.debian.org/imagemagick/security). -To do so, locate the ImageMagick `policy.xml` configuration file and add the following policies: + +It is recommended to disable all non-required ImageMagick coders via +[policy.xml](https://wiki.debian.org/imagemagick/security). +To do so, locate the ImageMagick `policy.xml` configuration file and add the +following policies: ```xml diff --git a/vendor/blueimp/jquery-file-upload/VULNERABILITIES.md b/vendor/blueimp/jquery-file-upload/VULNERABILITIES.md index 1561a1401..5dfd5f315 100644 --- a/vendor/blueimp/jquery-file-upload/VULNERABILITIES.md +++ b/vendor/blueimp/jquery-file-upload/VULNERABILITIES.md @@ -1,65 +1,118 @@ -# ⚠️ List of fixed vulnerabilities +# List of fixed vulnerabilities + +## Contents + +- [Potential vulnerabilities with PHP+ImageMagick](#potential-vulnerabilities-with-phpimagemagick) +- [Remote code execution vulnerability in the PHP component](#remote-code-execution-vulnerability-in-the-php-component) +- [Open redirect vulnerability in the GAE components](#open-redirect-vulnerability-in-the-gae-components) +- [Cross-site scripting vulnerability in the Iframe Transport](#cross-site-scripting-vulnerability-in-the-iframe-transport) ## Potential vulnerabilities with PHP+ImageMagick + > Mitigated: 2018-10-25 (GMT) -The sample [PHP upload handler](server/php/UploadHandler.php) before [v9.25.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.25.1) did not validate file signatures before invoking [ImageMagick](https://www.imagemagick.org/) (via [Imagick](http://php.net/manual/en/book.imagick.php)). -Verifying those [magic bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) mitigates potential vulnerabilities when handling input files other than `GIF/JPEG/PNG`. +The sample [PHP upload handler](server/php/UploadHandler.php) before +[v9.25.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.25.1) +did not validate file signatures before invoking +[ImageMagick](https://www.imagemagick.org/) (via +[Imagick](https://php.net/manual/en/book.imagick.php)). +Verifying those +[magic bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) mitigates +potential vulnerabilities when handling input files other than `GIF/JPEG/PNG`. -Please also configure ImageMagick to only enable the coders required for `GIF/JPEG/PNG` processing, e.g. with the sample [ImageMagick config](SECURITY.md#imagemagick-config). +Please also configure ImageMagick to only enable the coders required for +`GIF/JPEG/PNG` processing, e.g. with the sample +[ImageMagick config](SECURITY.md#imagemagick-config). **Further information:** -* Commit containing the mitigation: [fe44d34](https://github.com/blueimp/jQuery-File-Upload/commit/fe44d34be43be32c6b8d507932f318dababb25dd) -* [ImageTragick](https://imagetragick.com/) -* [CERT Vulnerability Note VU#332928](https://www.kb.cert.org/vuls/id/332928) -* [ImageMagick CVE entries](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=imagemagick) + +- Commit containing the mitigation: + [fe44d34](https://github.com/blueimp/jQuery-File-Upload/commit/fe44d34be43be32c6b8d507932f318dababb25dd) +- [ImageTragick](https://imagetragick.com/) +- [CERT Vulnerability Note VU#332928](https://www.kb.cert.org/vuls/id/332928) +- [ImageMagick CVE entries](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=imagemagick) ## Remote code execution vulnerability in the PHP component + > Fixed: 2018-10-23 (GMT) -The sample [PHP upload handler](server/php/UploadHandler.php) before [v9.24.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.24.1) allowed to upload all file types by default. -This opens up a remote code execution vulnerability, unless the server is configured to not execute (PHP) files in the upload directory (`server/php/files`). +The sample [PHP upload handler](server/php/UploadHandler.php) before +[v9.24.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.24.1) +allowed to upload all file types by default. +This opens up a remote code execution vulnerability, unless the server is +configured to not execute (PHP) files in the upload directory +(`server/php/files`). -The provided [.htaccess](server/php/files/.htaccess) file includes instructions for Apache to disable script execution, however [.htaccess support](https://httpd.apache.org/docs/current/howto/htaccess.html) is disabled by default since Apache `v2.3.9` via [AllowOverride Directive](https://httpd.apache.org/docs/current/mod/core.html#allowoverride). +The provided [.htaccess](server/php/files/.htaccess) file includes instructions +for Apache to disable script execution, however +[.htaccess support](https://httpd.apache.org/docs/current/howto/htaccess.html) +is disabled by default since Apache `v2.3.9` via +[AllowOverride Directive](https://httpd.apache.org/docs/current/mod/core.html#allowoverride). **You are affected if you:** -1. A) Uploaded jQuery File Upload < `v9.24.1` on a Webserver that executes files with `.php` as part of the file extension (e.g. "example.php.png"), e.g. Apache with `mod_php` enabled and the following directive (*not a recommended configuration*): - ```ApacheConf - AddHandler php5-script .php - ``` - B) Uploaded jQuery File Upload < `v9.22.1` on a Webserver that executes files with the file extension `.php`, e.g. Apache with `mod_php` enabled and the following directive: - ```ApacheConf - - SetHandler application/x-httpd-php - - ``` -2. Did not actively configure your Webserver to not execute files in the upload directory (`server/php/files`). -3. Are running Apache `v2.3.9+` with the default `AllowOverride` Directive set to `None` or another Webserver with no `.htaccess` support. + +1. A) Uploaded jQuery File Upload < `v9.24.1` on a Webserver that executes files + with `.php` as part of the file extension (e.g. "example.php.png"), e.g. + Apache with `mod_php` enabled and the following directive (_not a recommended + configuration_): + ```ApacheConf + AddHandler php5-script .php + ``` + B) Uploaded jQuery File Upload < `v9.22.1` on a Webserver that executes files + with the file extension `.php`, e.g. Apache with `mod_php` enabled and the + following directive: + ```ApacheConf + + SetHandler application/x-httpd-php + + ``` +2. Did not actively configure your Webserver to not execute files in the upload + directory (`server/php/files`). +3. Are running Apache `v2.3.9+` with the default `AllowOverride` Directive set + to `None` or another Webserver with no `.htaccess` support. **How to fix it:** + 1. Upgrade to the latest version of jQuery File Upload. -2. Configure your Webserver to not execute files in the upload directory, e.g. with the [sample Apache configuration](SECURITY.md#apache-config) +2. Configure your Webserver to not execute files in the upload directory, e.g. + with the [sample Apache configuration](SECURITY.md#apache-config) **Further information:** -* Commits containing the security fix: [aeb47e5](https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f), [ad4aefd](https://github.com/blueimp/jQuery-File-Upload/commit/ad4aefd96e4056deab6fea2690f0d8cf56bb2d7d) -* [Full disclosure post on Hacker News](https://news.ycombinator.com/item?id=18267309). -* [CVE-2018-9206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9206) -* [OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) + +- Commits containing the security fix: + [aeb47e5](https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f), + [ad4aefd](https://github.com/blueimp/jQuery-File-Upload/commit/ad4aefd96e4056deab6fea2690f0d8cf56bb2d7d) +- [Full disclosure post on Hacker News](https://news.ycombinator.com/item?id=18267309). +- [CVE-2018-9206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9206) +- [OWASP - Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) ## Open redirect vulnerability in the GAE components + > Fixed: 2015-06-12 (GMT) -The sample Google App Engine upload handlers before v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) accepted any URL as redirect target, making it possible to use the Webserver's domain for phishing attacks. +The sample Google App Engine upload handlers before +v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) +accepted any URL as redirect target, making it possible to use the Webserver's +domain for phishing attacks. **Further information:** -* Commit containing the security fix: [f74d2a8](https://github.com/blueimp/jQuery-File-Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f) -* [OWASP - Unvalidated Redirects and Forwards Cheat Sheet](https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet) + +- Commit containing the security fix: + [f74d2a8](https://github.com/blueimp/jQuery-File-Upload/commit/f74d2a8c3e3b1e8e336678d2899facd5bcdb589f) +- [OWASP - Unvalidated Redirects and Forwards Cheat Sheet](https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet) ## Cross-site scripting vulnerability in the Iframe Transport + > Fixed: 2012-08-09 (GMT) -The [redirect page](cors/result.html) for the [Iframe Transport](js/jquery.iframe-transport.js) before commit [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) (*fixed in all tagged releases*) allowed executing arbitrary JavaScript in the context of the Webserver. +The [redirect page](cors/result.html) for the +[Iframe Transport](js/jquery.iframe-transport.js) before commit +[4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) +(_fixed in all tagged releases_) allowed executing arbitrary JavaScript in the +context of the Webserver. **Further information:** -* Commit containing the security fix: [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) -* [OWASP - Cross-site Scripting (XSS)](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)) + +- Commit containing the security fix: + [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) +- [OWASP - Cross-site Scripting (XSS)]() diff --git a/vendor/blueimp/jquery-file-upload/angularjs.html b/vendor/blueimp/jquery-file-upload/angularjs.html deleted file mode 100644 index e8b05e77f..000000000 --- a/vendor/blueimp/jquery-file-upload/angularjs.html +++ /dev/null @@ -1,211 +0,0 @@ - - - - - - - -jQuery File Upload Demo - AngularJS version - - - - - - - - - - - - - - - - - - -
-

jQuery File Upload Demo

-

AngularJS version

- -
-
-

File Upload widget with multiple file selection, drag&drop support, progress bars, validation and preview images, audio and video for AngularJS.
- Supports cross-domain, chunked and resumable file uploads and client-side image resizing.
- Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads.

-
-
- -
- - - -
-
- - - - Add files... - - - - - - -
- -
- -
- -
 
-
-
- - - - - - - - -
-
- -
-
-
-

- - {{file.name}} - {{file.name}} - - {{file.name}} -

- {{file.error}} -
-

{{file.size | formatFileSize}}

-
-
- - - -
-
-
-
-
-

Demo Notes

-
-
-
    -
  • The maximum file size for uploads in this demo is 999 KB (default file size is unlimited).
  • -
  • Only image files (JPG, GIF, PNG) are allowed in this demo (by default there is no file type restriction).
  • -
  • Uploaded files will be deleted automatically after 5 minutes or less (demo files are stored in memory).
  • -
  • You can drag & drop files from your desktop on this webpage (see Browser support).
  • -
  • Please refer to the project website and documentation for more information.
  • -
  • Built with the Bootstrap CSS framework and Icons from Glyphicons.
  • -
-
-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/vendor/blueimp/jquery-file-upload/basic-plus.html b/vendor/blueimp/jquery-file-upload/basic-plus.html deleted file mode 100644 index 59019a3eb..000000000 --- a/vendor/blueimp/jquery-file-upload/basic-plus.html +++ /dev/null @@ -1,226 +0,0 @@ - - - - - - - -jQuery File Upload Demo - Basic Plus version - - - - - - - - - - - -
-

jQuery File Upload Demo

-

Basic Plus version

- -
-
-

File Upload widget with multiple file selection, drag&drop support, progress bar, validation and preview images, audio and video for jQuery.
- Supports cross-domain, chunked and resumable file uploads and client-side image resizing.
- Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads.

-
-
- - - - Add files... - - - -
-
- -
-
-
- -
-
-
-
-

Demo Notes

-
-
-
    -
  • The maximum file size for uploads in this demo is 999 KB (default file size is unlimited).
  • -
  • Only image files (JPG, GIF, PNG) are allowed in this demo (by default there is no file type restriction).
  • -
  • Uploaded files will be deleted automatically after 5 minutes or less (demo files are stored in memory).
  • -
  • You can drag & drop files from your desktop on this webpage (see Browser support).
  • -
  • Please refer to the project website and documentation for more information.
  • -
  • Built with the Bootstrap CSS framework and Icons from Glyphicons.
  • -
-
-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/vendor/blueimp/jquery-file-upload/basic.html b/vendor/blueimp/jquery-file-upload/basic.html deleted file mode 100644 index a9ef6273e..000000000 --- a/vendor/blueimp/jquery-file-upload/basic.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - - - -jQuery File Upload Demo - Basic version - - - - - - - - - - - -
-

jQuery File Upload Demo

-

Basic version

- -
-
-

File Upload widget with multiple file selection, drag&drop support and progress bar for jQuery.
- Supports cross-domain, chunked and resumable file uploads.
- Works with any server-side platform (PHP, Python, Ruby on Rails, Java, Node.js, Go etc.) that supports standard HTML form file uploads.

-
-
- - - - Select files... - - - -
-
- -
-
-
- -
-
-
-
-

Demo Notes

-
-
-
    -
  • The maximum file size for uploads in this demo is 999 KB (default file size is unlimited).
  • -
  • Only image files (JPG, GIF, PNG) are allowed in this demo (by default there is no file type restriction).
  • -
  • Uploaded files will be deleted automatically after 5 minutes or less (demo files are stored in memory).
  • -
  • You can drag & drop files from your desktop on this webpage (see Browser support).
  • -
  • Please refer to the project website and documentation for more information.
  • -
  • Built with the Bootstrap CSS framework and Icons from Glyphicons.
  • -
-
-
-
- - - - - - - - - - - - diff --git a/vendor/blueimp/jquery-file-upload/bower-version-update.js b/vendor/blueimp/jquery-file-upload/bower-version-update.js deleted file mode 100644 index 09ce3927e..000000000 --- a/vendor/blueimp/jquery-file-upload/bower-version-update.js +++ /dev/null @@ -1,16 +0,0 @@ -#!/usr/bin/env node - -'use strict'; - -var path = require('path'); -var packageJSON = require(path.join(__dirname, 'package.json')); -var bowerFile = path.join(__dirname, 'bower.json'); -var bowerJSON = require('bower-json').parse( - require(bowerFile), - {normalize: true} -); -bowerJSON.version = packageJSON.version; -require('fs').writeFileSync( - bowerFile, - JSON.stringify(bowerJSON, null, 2) + '\n' -); diff --git a/vendor/blueimp/jquery-file-upload/bower.json b/vendor/blueimp/jquery-file-upload/bower.json deleted file mode 100644 index b57c0aa22..000000000 --- a/vendor/blueimp/jquery-file-upload/bower.json +++ /dev/null @@ -1,64 +0,0 @@ -{ - "name": "blueimp-file-upload", - "version": "9.34.0", - "title": "jQuery File Upload", - "description": "File Upload widget with multiple file selection, drag&drop support, progress bar, validation and preview images.", - "keywords": [ - "jquery", - "file", - "upload", - "widget", - "multiple", - "selection", - "drag", - "drop", - "progress", - "preview", - "cross-domain", - "cross-site", - "chunk", - "resume", - "gae", - "go", - "python", - "php", - "bootstrap" - ], - "homepage": "https://github.com/blueimp/jQuery-File-Upload", - "author": { - "name": "Sebastian Tschan", - "url": "https://blueimp.net" - }, - "maintainers": [ - { - "name": "Sebastian Tschan", - "url": "https://blueimp.net" - } - ], - "repository": { - "type": "git", - "url": "git://github.com/blueimp/jQuery-File-Upload.git" - }, - "bugs": "https://github.com/blueimp/jQuery-File-Upload/issues", - "license": "MIT", - "dependencies": { - "jquery": ">=1.6", - "blueimp-tmpl": ">=2.5.4", - "blueimp-load-image": ">=1.13.0", - "blueimp-canvas-to-blob": ">=2.1.1" - }, - "main": [ - "js/jquery.fileupload.js" - ], - "ignore": [ - "/*.*", - "/cors", - "css/jquery-ui-demo-ie8.css", - "css/jquery-ui-demo.css", - "css/style.css", - "js/app.js", - "js/main.js", - "server", - "test" - ] -} diff --git a/vendor/blueimp/jquery-file-upload/cors/postmessage.html b/vendor/blueimp/jquery-file-upload/cors/postmessage.html index 381a8e0cd..5c90743af 100644 --- a/vendor/blueimp/jquery-file-upload/cors/postmessage.html +++ b/vendor/blueimp/jquery-file-upload/cors/postmessage.html @@ -1,4 +1,4 @@ - + - - -jQuery File Upload Plugin postMessage API - - - - + + + - + } + e.source.postMessage( + { + id: s.id, + status: jqXHR.status, + statusText: statusText, + result: result, + headers: jqXHR.getAllResponseHeaders() + }, + e.origin + ); + }); + }); + + diff --git a/vendor/blueimp/jquery-file-upload/cors/result.html b/vendor/blueimp/jquery-file-upload/cors/result.html index e3d629814..f2a1b4b6a 100644 --- a/vendor/blueimp/jquery-file-upload/cors/result.html +++ b/vendor/blueimp/jquery-file-upload/cors/result.html @@ -1,4 +1,4 @@ - + - - -jQuery Iframe Transport Plugin Redirect Page - - - - + + + jQuery Iframe Transport Plugin Redirect Page + + + + diff --git a/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo-ie8.css b/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo-ie8.css deleted file mode 100644 index e0e8ea9b0..000000000 --- a/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo-ie8.css +++ /dev/null @@ -1,21 +0,0 @@ -@charset "UTF-8"; -/* - * jQuery File Upload Demo CSS Fixes for IE<9 - * https://github.com/blueimp/jQuery-File-Upload - * - * Copyright 2013, Sebastian Tschan - * https://blueimp.net - * - * Licensed under the MIT license: - * https://opensource.org/licenses/MIT - */ - -.navigation { - list-style: none; - padding: 0; - margin: 1em 0; -} -.navigation li { - display: inline; - margin-right: 10px; -} diff --git a/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo.css b/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo.css deleted file mode 100644 index d7d524df5..000000000 --- a/vendor/blueimp/jquery-file-upload/css/jquery-ui-demo.css +++ /dev/null @@ -1,67 +0,0 @@ -@charset "UTF-8"; -/* - * jQuery File Upload Demo CSS - * https://github.com/blueimp/jQuery-File-Upload - * - * Copyright 2013, Sebastian Tschan - * https://blueimp.net - * - * Licensed under the MIT license: - * https://opensource.org/licenses/MIT - */ - -body { - max-width: 750px; - margin: 0 auto; - padding: 1em; - font-family: "Lucida Grande", "Lucida Sans Unicode", Arial, sans-serif; - font-size: 1em; - line-height: 1.4em; - background: #222; - color: #fff; - -webkit-text-size-adjust: 100%; - -ms-text-size-adjust: 100%; -} -a { - color: orange; - text-decoration: none; -} -img { - border: 0; - vertical-align: middle; -} -h1 { - line-height: 1em; -} -blockquote { - padding: 0 0 0 15px; - margin: 0 0 20px; - border-left: 5px solid #eee; -} -table { - width: 100%; - margin: 10px 0; -} - -.fileupload-progress { - margin: 10px 0; -} -.fileupload-progress .progress-extended { - margin-top: 5px; -} -.error { - color: red; -} - -@media (min-width: 481px) { - .navigation { - list-style: none; - padding: 0; - } - .navigation li { - display: inline-block; - } - .navigation li:not(:first-child):before { - content: "| "; - } -} diff --git a/vendor/blueimp/jquery-file-upload/css/jquery.fileupload-ui.css b/vendor/blueimp/jquery-file-upload/css/jquery.fileupload-ui.css index 9e36c42c5..7ae774631 100644 --- a/vendor/blueimp/jquery-file-upload/css/jquery.fileupload-ui.css +++ b/vendor/blueimp/jquery-file-upload/css/jquery.fileupload-ui.css @@ -10,13 +10,9 @@ * https://opensource.org/licenses/MIT */ -.fileupload-buttonbar .btn, -.fileupload-buttonbar .toggle { - margin-bottom: 5px; -} .progress-animated .progress-bar, .progress-animated .bar { - background: url("../img/progressbar.gif") !important; + background: url('../img/progressbar.gif') !important; filter: none; } .fileupload-process { @@ -28,15 +24,23 @@ display: block; width: 32px; height: 32px; - background: url("../img/loading.gif") center no-repeat; + background: url('../img/loading.gif') center no-repeat; background-size: contain; } .files audio, .files video { max-width: 300px; } +.toggle[type='checkbox'] { + transform: scale(2); + margin-left: 10px; +} @media (max-width: 767px) { + .fileupload-buttonbar .btn { + margin-bottom: 5px; + } + .fileupload-buttonbar .delete, .fileupload-buttonbar .toggle, .files .toggle, .files .btn span { diff --git a/vendor/blueimp/jquery-file-upload/css/style.css b/vendor/blueimp/jquery-file-upload/css/style.css deleted file mode 100644 index 3aee25689..000000000 --- a/vendor/blueimp/jquery-file-upload/css/style.css +++ /dev/null @@ -1,15 +0,0 @@ -@charset "UTF-8"; -/* - * jQuery File Upload Plugin CSS Example - * https://github.com/blueimp/jQuery-File-Upload - * - * Copyright 2013, Sebastian Tschan - * https://blueimp.net - * - * Licensed under the MIT license: - * https://opensource.org/licenses/MIT - */ - -body { - padding-top: 60px; -} diff --git a/vendor/blueimp/jquery-file-upload/docker-compose.yml b/vendor/blueimp/jquery-file-upload/docker-compose.yml new file mode 100644 index 000000000..d84a43e27 --- /dev/null +++ b/vendor/blueimp/jquery-file-upload/docker-compose.yml @@ -0,0 +1,59 @@ +version: '3.7' +services: + example: + build: server/php + ports: + - 127.0.0.1:80:80 + - ${SERVER_HOST:-127.0.0.1}:${SERVER_PORT-}:80 + volumes: + - .:/var/www/html + mocha: + build: test + command: http://example/test + volumes: + - .:/var/www/html + depends_on: + - example + chromedriver: + image: blueimp/chromedriver + init: true + tmpfs: /tmp + environment: + - DISABLE_X11=false + - ENABLE_VNC=true + - EXPOSE_X11=true + volumes: + - ./wdio/assets:/home/webdriver/assets:ro + ports: + - 127.0.0.1:5900:5900 + geckodriver: + image: blueimp/geckodriver + init: true + tmpfs: /tmp + shm_size: 2g + environment: + - DISABLE_X11=false + - ENABLE_VNC=true + - EXPOSE_X11=true + volumes: + - ./wdio/assets:/home/webdriver/assets:ro + ports: + - 127.0.0.1:5901:5900 + wdio: + image: blueimp/wdio + init: true + read_only: true + tmpfs: + - /tmp + environment: + - WAIT_FOR_HOSTS= chromedriver:4444 geckodriver:4444 example:80 + - WINDOWS_HOST + - MACOS_ASSETS_DIR=$PWD/wdio/assets/ + - WINDOWS_ASSETS_DIR + volumes: + - ./wdio:/opt:ro + - ./wdio/reports:/opt/reports + depends_on: + - chromedriver + - geckodriver + - example diff --git a/vendor/blueimp/jquery-file-upload/index.html b/vendor/blueimp/jquery-file-upload/index.html index 68ed83717..aa908e745 100644 --- a/vendor/blueimp/jquery-file-upload/index.html +++ b/vendor/blueimp/jquery-file-upload/index.html @@ -1,7 +1,7 @@ - + - - - - -jQuery File Upload Demo - - - - - - - - - - - - - - - - -