Problem/Motivation
The security update backport to the jQuery UI position function is causing JS errors downstream in contrib modules that call the position function without any options. See #3259436: JS error after core 7.86 update for background.
Steps to reproduce
- Install a Drupal 7.86 site with the jQuery Update and contrib Linkit modules enabled.
- Set jQuery Update to use version 1.10.
- Enable Linkit on a link field.
- Activate the Linkit button when editing the field.
- Note the Search for content field doesn't do anything.
Console stack trace:
jquery.ui.position-1.13.0-backport.js?v=1.10.2:21 Uncaught TypeError: Cannot read properties of undefined (reading 'of')
at $.fn.init.position (jquery.ui.position-1.13.0-backport.js?v=1.10.2:21:35)
at Object.insertSuggestionList (linkit.dashboard.js?v=7.3:207:28)
at new BetterAutocomplete (jquery.better-autocomplete.js?v=1.0:187:15)
at HTMLInputElement.init (jquery.better-autocomplete.js?v=1.0:109:19)
at HTMLInputElement.<anonymous> (jquery.better-autocomplete.js?v=1.0:128:27)
at Function.each (jquery.min.js?v=1.10.2:4:5347)
at $.fn.init.each (jquery.min.js?v=1.10.2:4:1999)
at $.fn.init.$.fn.betterAutocomplete (jquery.better-autocomplete.js?v=1.0:125:10)
at HTMLInputElement.<anonymous> (linkit.dashboard.js?v=7.3:240:21)
at Function.each (jquery.min.js?v=1.10.2:4:5347)Linkit calls the position function without any options:
var top = $input.position().top + $input.outerHeight() - 5;
Which seems to be allowed, see https://api.jquery.com/position/ and https://api.jqueryui.com/position/. But the core backport expects that there will be options:
var target = typeof options.of === "string" ?
$(document).find(options.of) :
$(options.of);which causes "Cannot read properties of undefined" because there is no options object to act on.
Proposed resolution
Patch the backport so that it can handle being called without options.
Remaining tasks
Patch and test.
User interface changes
None.
API changes
None.
Data model changes
None.
Release notes snippet
TBD
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | drupal7-fix-position-backport-3259465-2.patch | 583 bytes | dsnopek |
Comments
Comment #2
dsnopekHere's a proposed patch to fix! It works in my testing with the Linkit module.
Comment #3
effulgentsia commentedUgh, sorry about that. Yes, this looks like a good fix.
Comment #4
jesss commentedCan confirm that this broke all autocomplete widgets on my site (e.g., term reference fields). The patch fixes it. Thanks!
Comment #5
cboyden commentedTests are passing again on our setup (Panopoly child distribution using Linkit).
Comment #7
mcdruid commentedThanks for the quick report, patch and review!
https://www.drupal.org/project/drupal/releases/7.87 is the hotfix release.
Comment #8
rbruch commentedFor what it's worth (maybe this will help somebody searching for an answer), the Drupal core 7.86 update also broke the CKEditor Link's internal link search/autocomplete on a site using jQuery update set to use jQuery 1.8.
Also broke functionality on Entity Reference fields using the Autocomplete widget.
Upgrading the site to Drupal core 7.87 restored the functionality (after a full cache clear).
Comment #9
Rob_Feature commented@rbruch - Thanks for posting this...saved me a bunch of headaches tracking it down!