f3a9ee8ed6
## Summary
- Replace vendored `jquery-2.2.2.js` with `jquery-3.7.1.js` in
`gui/default/vendor/jquery/`
- Update script reference in `gui/default/index.html` to point to the
new file
- Update CDN reference in `cmd/infra/strelaypoolsrv/gui/index.html` from
`jquery-2.1.4.min.js` to `jquery-3.7.1.min.js`
## Why
The previously used jQuery versions (2.2.2 and 2.1.4) are vulnerable to
three known CVEs:
| CVE | Description | Fixed in |
|-----|-------------|----------|
| CVE-2015-9251 | XSS via cross-domain Ajax requests with non-text
content types | jQuery 3.0.0 |
| CVE-2020-11022 | XSS when passing HTML containing `<option>` elements
to manipulation methods | jQuery 3.5.0 |
| CVE-2020-11023 | XSS via passing HTML from untrusted sources to
manipulation methods | jQuery 3.5.0 |
jQuery 3.7.1 is the latest stable release and resolves all three.
## Compatibility notes
The GUI code was audited for jQuery 2→3 breaking changes. No removed
APIs are used:
- `.success()` / `.error()` calls throughout the codebase are
**AngularJS `$http`** promise methods, not jQuery — unaffected
- `.bind('beforeunload', ...)` is deprecated in jQuery 3 but not removed
— still works
- No usage of `.size()`, `.load()` event shorthand, `jQuery.isFunction`,
or `$.type()`
---------
Signed-off-by: Umer Azaz <umer_azaz@yahoo.com>
Co-authored-by: Jakob Borg <jakob@kastelo.net>
relaypoolsrv
This is the relay pool server for the syncthing project, which allows
community hosted relaysrv's to join
the public pool.
Servers that join the pool are then advertised to users of syncthing as
potential connection points for those who are unable to connect directly due
to NAT or firewall issues.
There is very little reason why you'd want to run this yourself, as
relaypoolsrv is just used for announcement and lookup of public relay
servers. If you are looking to set up a private or a public relay, please
check the documentation for
relaysrv, which also explains how
to join the default public pool.
See relaypoolsrv -help for configuration options.
Third-party attributions
oschwald/geoip2-golang, oschwald/maxminddb-golang, Copyright (C) 2015 Gregory J. Oschwald.