Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • YunJai, Tsai 3 posts 83 karma points
    May 30, 2019 @ 07:41
    YunJai, Tsai
    0

    acunetix say angular, jquery, jquery-ui need upgrade to the latest version.

    hi everyone

    a few weeks ago, I use acunetix to scan my four project.

    three project for umbraco 7.4.3, and one of umbraco 7.3.8.

    there are three javascript lib need to upgrade in the report

    1. angular.js 1.1.5 to 1.3.0+
    2. juqery 2.0.3(2.2.4) to 3.0+
    3. jquery-ui 1.10.x to 1.12.x

    when I download latest version jquery (3.4.1) and jquery-ui (1.12.1) and replace file in project.

    in chrome f12 console has many error log.

    because jquery 2.x to 3.x has breaking change.

    and bootstrap 2.0.x maybe not support jquery 3.x ?

    I saw angular and jquery version has upgrade in umbraco v8 (angular 1.7.5, juqery 3.0)

    but umbraco v7 (7.10~7.1X) is angular 1.1.5

    is it mean if I want to fix problum in acunetix,

    I need to upgrade my all project to umbraco v8?

    someone have any solution for umbraco v7 to fix those javascript version upgrade?

    picOne

    pic two

    angular

    jquery and jquery-ui

  • Matthew Wise 271 posts 1373 karma points MVP 4x c-trib
    May 30, 2019 @ 08:45
    Matthew Wise
    100

    Upgrading the javacript frames was a large task that was done in V8.

    If updating is not an option, I would instead look to lock down the backoffice url by IP address or some other form to secure it.

    Matt

  • YunJai, Tsai 3 posts 83 karma points
    May 30, 2019 @ 09:44
    YunJai, Tsai
    0

    thanks Matt.

    I agree upgrading javascript frames is a large task.

    unfortunately, upgrade is the only option,

    because my customer told me he don't want to saw any high or medium level issue in report.

    in my case, umbraco backoffice is in company Intranet,

    if someone want to attack backoffice ,

    they need to through firewall and many secure defense(?).

    actually I already use iis url rewrite module and set WhitelistIPs for backoffice url,

    but scan report still have those issue,

    my customer didn't accept issue is false positives.

    they thougth acunetix won't wrong,

    I have to fix all issue and pass acunetix scan until report didn't has high or medium level issue.


    I apologize for my english ability is not very good,

    so I need a little help from google translate to write this reply.

    YunJai

Please Sign in or register to post replies

Write your reply to:

Draft