[Security] Bump bootstrap from 3.4.1 to 4.3.1

core/css/tooltip.scss

@@ -36,6 +36,7 @@
     padding: 10px 0;
     filter: drop-shadow(0 1px 10px var(--color-box-shadow));
     &.in,
+    &.show,
     &.tooltip[aria-hidden='false'] {
         visibility: visible;
         opacity: 1;
@@ -80,7 +81,7 @@
     &.top-left,
     &[x-placement^='top'],
     &.top-right {
-        .tooltip-arrow {
+        .tooltip-arrow, .arrow {
             bottom: 0;
             border-width: 10px 10px 0;
             border-top-color: var(--color-main-background);
@@ -99,7 +100,7 @@
     &[x-placement^='bottom'],
     &.bottom-left,
     &.bottom-right {
-        .tooltip-arrow {
+        .tooltip-arrow, .arrow {
             top: 0;
             border-width: 0 10px 10px;
             border-bottom-color: var(--color-main-background);
@@ -129,7 +130,7 @@
     border-radius: var(--border-radius);
 }
 
-.tooltip-arrow {
+.tooltip-arrow, .tooltip .arrow {
     position: absolute;
     width: 0;
     height: 0;

core/js/tests/html-domparser.js

@@ -0,0 +1,46 @@
+/*
+ * DOMParser HTML extension
+ * 2012-09-04
+ * 
+ * By Eli Grey, http://eligrey.com
+ * Public domain.
+ * NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK.
+ */
+
+/*! @source https://gist.github.com/1129031 */
+/*global document, DOMParser*/
+
+(function(DOMParser) {
+	"use strict";
+
+	var
+	  DOMParser_proto = DOMParser.prototype
+	, real_parseFromString = DOMParser_proto.parseFromString
+	;
+
+	// Firefox/Opera/IE throw errors on unsupported types
+	try {
+		// WebKit returns null on unsupported types
+		if ((new DOMParser).parseFromString("", "text/html")) {
+			// text/html parsing is natively supported
+			return;
+		}
+	} catch (ex) {}
+
+	DOMParser_proto.parseFromString = function(markup, type) {
+		if (/^\s*text\/html\s*(?:;|$)/i.test(type)) {
+			var
+			  doc = document.implementation.createHTMLDocument("")
+			;
+	      		if (markup.toLowerCase().indexOf('<!doctype') > -1) {
+        			doc.documentElement.innerHTML = markup;
+      			}
+      			else {
+        			doc.body.innerHTML = markup;
+      			}
+			return doc;
+		} else {
+			return real_parseFromString.apply(this, arguments);
+		}
+	};
+}(DOMParser));

core/src/Polyfill/tooltip.js

@@ -0,0 +1,37 @@
+/*
+ * @copyright 2019 Julius Härtl <[email protected]>
+ *
+ * @author 2019 Julius Härtl <[email protected]>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+$.prototype.tooltip = (function(tooltip) {
+	return function(config) {
+		try {
+			return tooltip.call(this, config);
+		} catch (ex) {
+			if (ex instanceof TypeError && config === 'destroy') {
+				console.error('Deprecated call $.tooltip(\'destroy\') has been deprecated and should be removed');
+				return tooltip.call(this, 'dispose');
+			}
+			if (ex instanceof TypeError && config === 'fixTitle') {
+				console.error('Deprecated call $.tooltip(\'fixTitle\') has been deprecated and should be removed');
+				return tooltip.call(this, '_fixTitle');
+			}
+		}
+	};
+})($.prototype.tooltip);

core/src/globals.js

@@ -30,7 +30,8 @@ import 'jquery-ui-dist/jquery-ui.theme.css'
 // END TODO
 import autosize from 'autosize'
 import Backbone from 'backbone'
-import 'bootstrap/js/tooltip'
+import 'bootstrap/js/dist/tooltip'
+import './Polyfill/tooltip'
 import ClipboardJS from 'clipboard'
 import cssVars from 'css-vars-ponyfill'
 import dav from 'davclient.js'

package.json

@@ -27,7 +27,7 @@
     "autosize": "^4.0.2",
     "backbone": "^1.3.3",
     "blueimp-md5": "^2.10.0",
-    "bootstrap": "^3.4.1",
+    "bootstrap": "^4.3.1",
     "clipboard": "^2.0.4",
     "css-vars-ponyfill": "^1.17.0",
     "davclient.js": "git+https://github.com/owncloud/davclient.js.git#0.1.3",

tests/karma.config.js

@@ -127,6 +127,7 @@ module.exports = function(config) {
 		testCore = true;
 	}
 
+	files.push(corePath + 'tests/html-domparser.js');
 	files.push('core/js/dist/main.js');
 	// core mocks
 	files.push(corePath + 'tests/specHelper.js');