Zen Cart Logo
Forums / Code Collaboration / JQuery Version update in html_header.php file

JQuery Version update in html_header.php file

Views: 3,991

Results 1 to 2 of 2
4 Nov 2018, 7:26 PM
#1
portraitartist avatar

portraitartist

New Zenner

Join Date:
Mar 2006
Posts:
86
Plugin Contributions:
0

JQuery Version update in html_header.php file

ZenCart Version 1.5.5a
Vulnerability scan FAIL with the current jQuery version 1.12.0 in the html_header.php file.

The FAILED Trustwave run vulnerability test states:
"All Cross-Site Scripting vulnerabilities are considered non-compliant by
PCI."

"Evidence:
Match: '1.12.0' is less than '3.0.0'
Remediation:
Upgrade jQuery to version 3.0.0 or higher. This includes versions of
jQuery used on the root domain, subdomain, or imported/sourced
libraries."

Here is the relevant part of the html_header.php file:

?>

<script type="text/javascript">window.jQuery || document.write(unescape('%3Cscript type="text/javascript" src="//code.jquery.com/jquery-1.12.0.min.js"%3E%3C/script%3E'));</script> <script type="text/javascript">window.jQuery || document.write(unescape('%3Cscript type="text/javascript" src="<?php echo $template->get_template_dir('.js',DIR_WS_TEMPLATE, $current_page_base,'jscript'); ?>/jquery.min.js"%3E%3C/script%3E'));</script> <?php I would like to ask someone to correct the file the way it will conform to the PCI vulnerability test. I think this would be useful for a lot of ZenCart user.
4 Nov 2018, 9:30 PM
#2
davewest avatar

davewest

Totally Zenned

Join Date:
Dec 2007
Location:
Payson, AZ
Posts:
1,075
Plugin Contributions:
7

Re: JQuery Version update in html_header.php file

First I would make sure your site works as expected with version 3.. upgrade any scripts that fail to work.
go to jQuery and download the compressed version and save to your template jscript folder.. https://jquery.com/download/

then replace the above lines in your template/common/html_header.php with the following...

<script type="text/javascript">window.jQuery || document.write(unescape('%3Cscript type="text/javascript" src="//code.jquery.com/jquery-3.3.1.min.js"%3E%3C/script%3E'));</script> 
<script type="text/javascript">window.jQuery || document.write(unescape('%3Cscript type="text/javascript" src="<?php echo $template->get_template_dir('.js',DIR_WS_TEMPLATE, $current_page_base,'jscript'); ?>/jquery-3.3.1.min.js"%3E%3C/script%3E'));</script>

The CDN link is also on the jQuery download page... I'm running this version on a ZC155f with updated versions of other jquery scripts without issues...