SECURITY: resources: Patch jQuery 3.3.1 for CVE-2019-11358

[lhc/web/wiklou.git] / resources / lib / jquery / jquery.migrate.js

diff --git a/resources/lib/jquery/jquery.migrate.js b/resources/lib/jquery/jquery.migrate.js
index c9b37ca..711e424 100644 (file)
--- a/resources/lib/jquery/jquery.migrate.js
+++ b/resources/lib/jquery/jquery.migrate.js
@@ -3,10 +3,12 @@
  * Copyright jQuery Foundation and other contributors
  *
  * Patched for MediaWiki:
- * - Preserve handler of uncaught exceptions in promise chains
- *   https://gerrit.wikimedia.org/r/#/c/360999/
- *   https://github.com/jquery/jquery-migrate/pull/262
+ * - Qualify the global lookup for 'jQuery' as 'window.jQuery',
+ *   because within mw.loader.implement() for 'jquery', the closure
+ *   specifies '$' and 'jQuery', which are undefined.
  * - Add mw.track instrumentation for statistics.
+ * - Disable jQuery.migrateTrace by default. They are slow and
+ *   redundant given console.warn() already provides a trace.
  */
 ;( function( factory ) {
        if ( typeof define === "function" && define.amd ) {
@@ -21,7 +23,8 @@
        } else {
 
                // Browser globals
-               factory( jQuery, window );
+               // PATCH: Qualify jQuery lookup as window.jQuery. --Krinkle
+               factory( window.jQuery, window );
        }
 } )( function( jQuery, window ) {
 "use strict";
@@ -64,7 +67,8 @@ jQuery.migrateWarnings = [];
 
 // Set to false to disable traces that appear with warnings
 if ( jQuery.migrateTrace === undefined ) {
-       jQuery.migrateTrace = true;
+       // PATCH: Disable extra console.trace() call --Krinkle
+       jQuery.migrateTrace = false;
 }
 
 // Forget any warnings we've already given; public