Patch jQuery for CVE-2020-11022 and CVE-2020-11023

cividesk · Aug 20, 2020 · 6978078 · 6978078
1 parent d5bbf90
commit 6978078
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/js/Common.js b/js/Common.js
@@ -1624,4 +1624,9 @@ if (!CRM.vars) CRM.vars = {};
     }
   });
 
+  // CVE-2020-11022 and CVE-2020-11023  Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
+  $.htmlPrefilter = function(html) {
+    return html;
+  };
+
 })(jQuery, _);