Problem/Motivation

The security update backport to the jQuery UI position function is causing JS errors downstream in contrib modules that call the position function without any options. See #3259436: JS error after core 7.86 update for background.

Steps to reproduce

  • Install a Drupal 7.86 site with the jQuery Update and contrib Linkit modules enabled.
  • Set jQuery Update to use version 1.10.
  • Enable Linkit on a link field.
  • Activate the Linkit button when editing the field.
  • Note the Search for content field doesn't do anything.

Console stack trace:

jquery.ui.position-1.13.0-backport.js?v=1.10.2:21 Uncaught TypeError: Cannot read properties of undefined (reading 'of')
    at $.fn.init.position (jquery.ui.position-1.13.0-backport.js?v=1.10.2:21:35)
    at Object.insertSuggestionList (linkit.dashboard.js?v=7.3:207:28)
    at new BetterAutocomplete (jquery.better-autocomplete.js?v=1.0:187:15)
    at HTMLInputElement.init (jquery.better-autocomplete.js?v=1.0:109:19)
    at HTMLInputElement.<anonymous> (jquery.better-autocomplete.js?v=1.0:128:27)
    at Function.each (jquery.min.js?v=1.10.2:4:5347)
    at $.fn.init.each (jquery.min.js?v=1.10.2:4:1999)
    at $.fn.init.$.fn.betterAutocomplete (jquery.better-autocomplete.js?v=1.0:125:10)
    at HTMLInputElement.<anonymous> (linkit.dashboard.js?v=7.3:240:21)
    at Function.each (jquery.min.js?v=1.10.2:4:5347)

Linkit calls the position function without any options:

var top = $input.position().top + $input.outerHeight() - 5;

Which seems to be allowed, see https://api.jquery.com/position/ and https://api.jqueryui.com/position/. But the core backport expects that there will be options:

var target = typeof options.of === "string" ?
        $(document).find(options.of) :
        $(options.of);

which causes "Cannot read properties of undefined" because there is no options object to act on.

Proposed resolution

Patch the backport so that it can handle being called without options.

Remaining tasks

Patch and test.

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

TBD

Comments

cboyden created an issue. See original summary.

dsnopek’s picture

Status: Active » Needs review
StatusFileSize
new583 bytes

Here's a proposed patch to fix! It works in my testing with the Linkit module.

effulgentsia’s picture

Status: Needs review » Reviewed & tested by the community

Ugh, sorry about that. Yes, this looks like a good fix.

jesss’s picture

Can confirm that this broke all autocomplete widgets on my site (e.g., term reference fields). The patch fixes it. Thanks!

cboyden’s picture

Tests are passing again on our setup (Panopoly child distribution using Linkit).

  • mcdruid committed 7d9904f on 7.x
    Issue #3259465 by dsnopek, cboyden, effulgentsia: Fix regression caused...
mcdruid’s picture

Status: Reviewed & tested by the community » Fixed

Thanks for the quick report, patch and review!

https://www.drupal.org/project/drupal/releases/7.87 is the hotfix release.

rbruch’s picture

For what it's worth (maybe this will help somebody searching for an answer), the Drupal core 7.86 update also broke the CKEditor Link's internal link search/autocomplete on a site using jQuery update set to use jQuery 1.8.

Also broke functionality on Entity Reference fields using the Autocomplete widget.

Upgrading the site to Drupal core 7.87 restored the functionality (after a full cache clear).

Rob_Feature’s picture

@rbruch - Thanks for posting this...saved me a bunch of headaches tracking it down!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.