BBQ JS fix prototype pollution #4571
Conversation
|
I will await cowboy/jquery-bbq#65 before reviewing this. |
You will probably be waiting forever which is why we bypassed them in the first place.
|
|
Perhaps, but even without merge at least there might be reviewers or commenters. I don't want to release too soon since this fix does not seem highly critical. I'll set a reminder to revisit this PR in case it takes too long. |
There was a problem hiding this comment.
@kevin-foster-uk No activity upstream yet, so I reviewed the PR.
This PR currently reverts too much behavior, for example jQuery 1.9+ compatibility. See notes in #4563 (comment)
I propose a new PR that bases on yii's current master and only fixes the issue at hand with the two object creation calls.
|
@marcovtwout I have created a new PR with minimal changes based on the current Yii master code: |
This PR reverts the previous fix for BBQ JS prototype pollution (#4570) with a new fix based on the upstream master branch (https://github.com/cowboy/jquery-bbq). This fix addresses only this one issue with a backward compatible fix (return value is always an object).
You will notice that there are bunch of URLs changed from https and http and IE support has been re-added. This brings it back in line with the current state of the upstream master.
A PR has been created on the upstream master to apply the same fix: cowboy/jquery-bbq#65