/*! jQuery Migrate v3.0.0 | (c) jQuery Foundation and other contributors | jquery.org/license */ "undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(a,b){"use strict";function c(c){var d=b.console;e[c]||(e[c]=!0,a.migrateWarnings.push(c),d&&d.warn&&!a.migrateMute&&(d.warn("JQMIGRATE: "+c),a.migrateTrace&&d.trace&&d.trace()))}function d(a,b,d,e){Object.defineProperty(a,b,{configurable:!0,enumerable:!0,get:function(){return c(e),d}})}a.migrateVersion="3.0.0",function(){var c=b.console&&b.console.log&&function(){b.console.log.apply(b.console,arguments)},d=/^[12]\./;c&&(a&&!d.test(a.fn.jquery)||c("JQMIGRATE: jQuery 3.0.0+ REQUIRED"),a.migrateWarnings&&c("JQMIGRATE: Migrate plugin loaded multiple times"),c("JQMIGRATE: Migrate is installed"+(a.migrateMute?"":" with logging active")+", version "+a.migrateVersion))}();var e={};a.migrateWarnings=[],void 0===a.migrateTrace&&(a.migrateTrace=!0),a.migrateReset=function(){e={},a.migrateWarnings.length=0},"BackCompat"===document.compatMode&&c("jQuery is not compatible with Quirks Mode");var f=a.fn.init,g=a.isNumeric,h=a.find,i=/\[(\s*[-\w]+\s*)([~|^$*]?=)\s*([-\w#]*?#[-\w#]*)\s*\]/,j=/\[(\s*[-\w]+\s*)([~|^$*]?=)\s*([-\w#]*?#[-\w#]*)\s*\]/g;a.fn.init=function(a){var b=Array.prototype.slice.call(arguments);return"string"==typeof a&&"#"===a&&(c("jQuery( '#' ) is not a valid selector"),b[0]=[]),f.apply(this,b)},a.fn.init.prototype=a.fn,a.find=function(a){var b=Array.prototype.slice.call(arguments);if("string"==typeof a&&i.test(a))try{document.querySelector(a)}catch(d){a=a.replace(j,function(a,b,c,d){return"["+b+c+'"'+d+'"]'});try{document.querySelector(a),c("Attribute selector with '#' must be quoted: "+b[0]),b[0]=a}catch(e){c("Attribute selector with '#' was not fixed: "+b[0])}}return h.apply(this,b)};var k;for(k in h)Object.prototype.hasOwnProperty.call(h,k)&&(a.find[k]=h[k]);a.fn.size=function(){return c("jQuery.fn.size() is deprecated; use the .length property"),this.length},a.parseJSON=function(){return c("jQuery.parseJSON is deprecated; use JSON.parse"),JSON.parse.apply(null,arguments)},a.isNumeric=function(b){function d(b){var c=b&&b.toString();return!a.isArray(b)&&c-parseFloat(c)+1>=0}var e=g(b),f=d(b);return e!==f&&c("jQuery.isNumeric() should not be called on constructed objects"),f},d(a,"unique",a.uniqueSort,"jQuery.unique is deprecated, use jQuery.uniqueSort"),d(a.expr,"filters",a.expr.pseudos,"jQuery.expr.filters is now jQuery.expr.pseudos"),d(a.expr,":",a.expr.pseudos,'jQuery.expr[":"] is now jQuery.expr.pseudos');var l=a.ajax;a.ajax=function(){var a=l.apply(this,arguments);return a.promise&&(d(a,"success",a.done,"jQXHR.success is deprecated and removed"),d(a,"error",a.fail,"jQXHR.error is deprecated and removed"),d(a,"complete",a.always,"jQXHR.complete is deprecated and removed")),a};var m=a.fn.removeAttr,n=a.fn.toggleClass,o=/\S+/g;a.fn.removeAttr=function(b){var d=this;return a.each(b.match(o),function(b,e){a.expr.match.bool.test(e)&&(c("jQuery.fn.removeAttr no longer sets boolean properties: "+e),d.prop(e,!1))}),m.apply(this,arguments)},a.fn.toggleClass=function(b){return void 0!==b&&"boolean"!=typeof b?n.apply(this,arguments):(c("jQuery.fn.toggleClass( boolean ) is deprecated"),this.each(function(){var c=this.getAttribute&&this.getAttribute("class")||"";c&&a.data(this,"__className__",c),this.setAttribute&&this.setAttribute("class",c||b===!1?"":a.data(this,"__className__")||"")}))};var p=!1;a.swap&&a.each(["height","width","reliableMarginRight"],function(b,c){var d=a.cssHooks[c]&&a.cssHooks[c].get;d&&(a.cssHooks[c].get=function(){var a;return p=!0,a=d.apply(this,arguments),p=!1,a})}),a.swap=function(a,b,d,e){var f,g,h={};p||c("jQuery.swap() is undocumented and deprecated");for(g in b)h[g]=a.style[g],a.style[g]=b[g];f=d.apply(a,e||[]);for(g in b)a.style[g]=h[g];return f};var q=a.data;a.data=function(b,d,e){var f;return d&&d!==a.camelCase(d)&&(f=a.hasData(b)&&q.call(this,b),f&&d in f)?(c("jQuery.data() always sets/gets camelCased names: "+d),arguments.length>2&&(f[d]=e),f[d]):q.apply(this,arguments)};var r=a.Tween.prototype.run;a.Tween.prototype.run=function(b){a.easing[this.easing].length>1&&(c('easing function "jQuery.easing.'+this.easing.toString()+'" should use only first argument'),a.easing[this.easing]=a.easing[this.easing].bind(a.easing,b,this.options.duration*b,0,1,this.options.duration)),r.apply(this,arguments)};var s=a.fn.load,t=a.event.fix;a.event.props=[],a.event.fixHooks={},a.event.fix=function(b){var d,e=b.type,f=this.fixHooks[e],g=a.event.props;if(g.length)for(c("jQuery.event.props are deprecated and removed: "+g.join());g.length;)a.event.addProp(g.pop());if(f&&!f._migrated_&&(f._migrated_=!0,c("jQuery.event.fixHooks are deprecated and removed: "+e),(g=f.props)&&g.length))for(;g.length;)a.event.addProp(g.pop());return d=t.call(this,b),f&&f.filter?f.filter(d,b):d},a.each(["load","unload","error"],function(b,d){a.fn[d]=function(){var a=Array.prototype.slice.call(arguments,0);return"load"===d&&"string"==typeof a[0]?s.apply(this,a):(c("jQuery.fn."+d+"() is deprecated"),a.splice(0,0,d),arguments.length?this.on.apply(this,a):(this.triggerHandler.apply(this,a),this))}}),a(function(){a(document).triggerHandler("ready")}),a.event.special.ready={setup:function(){this===document&&c("'ready' event is deprecated")}},a.fn.extend({bind:function(a,b,d){return c("jQuery.fn.bind() is deprecated"),this.on(a,null,b,d)},unbind:function(a,b){return c("jQuery.fn.unbind() is deprecated"),this.off(a,null,b)},delegate:function(a,b,d,e){return c("jQuery.fn.delegate() is deprecated"),this.on(b,a,d,e)},undelegate:function(a,b,d){return c("jQuery.fn.undelegate() is deprecated"),1===arguments.length?this.off(a,"**"):this.off(b,a||"**",d)}});var u=a.fn.offset;a.fn.offset=function(){var b,d=this[0],e={top:0,left:0};return d&&d.nodeType?(b=(d.ownerDocument||document).documentElement,a.contains(b,d)?u.apply(this,arguments):(c("jQuery.fn.offset() requires an element connected to a document"),e)):(c("jQuery.fn.offset() requires a valid DOM element"),e)};var v=a.param;a.param=function(b,d){var e=a.ajaxSettings&&a.ajaxSettings.traditional;return void 0===d&&e&&(c("jQuery.param() no longer uses jQuery.ajaxSettings.traditional"),d=e),v.call(this,b,d)};var w=a.fn.andSelf||a.fn.addBack;a.fn.andSelf=function(){return c("jQuery.fn.andSelf() replaced by jQuery.fn.addBack()"),w.apply(this,arguments)};var x=a.Deferred,y=[["resolve","done",a.Callbacks("once memory"),a.Callbacks("once memory"),"resolved"],["reject","fail",a.Callbacks("once memory"),a.Callbacks("once memory"),"rejected"],["notify","progress",a.Callbacks("memory"),a.Callbacks("memory")]];a.Deferred=function(b){var d=x(),e=d.promise();return d.pipe=e.pipe=function(){var b=arguments;return c("deferred.pipe() is deprecated"),a.Deferred(function(c){a.each(y,function(f,g){var h=a.isFunction(b[f])&&b[f];d[g[1]](function(){var b=h&&h.apply(this,arguments);b&&a.isFunction(b.promise)?b.promise().done(c.resolve).fail(c.reject).progress(c.notify):c[g[0]+"With"](this===e?c.promise():this,h?[b]:arguments)})}),b=null}).promise()},b&&b.call(d,d),d}}(jQuery,window); ; /** * For jQuery versions less than 3.4.0, this replaces the jQuery.extend * function with the one from jQuery 3.4.0, slightly modified (documented * below) to be compatible with older jQuery versions and browsers. * * This provides the Object.prototype pollution vulnerability fix to Drupal * installations running older jQuery versions, including the versions shipped * with Drupal core and https://www.drupal.org/project/jquery_update. * * @see https://github.com/jquery/jquery/pull/4333 */ (function (jQuery) { // Do not override jQuery.extend() if the jQuery version is already >=3.4.0. var versionParts = jQuery.fn.jquery.split('.'); var majorVersion = parseInt(versionParts[0]); var minorVersion = parseInt(versionParts[1]); var patchVersion = parseInt(versionParts[2]); var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]); if ( (majorVersion > 3) || (majorVersion === 3 && minorVersion > 4) || (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) || (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion) ) { return; } /** * This is almost verbatim copied from jQuery 3.4.0. * * Only two minor changes have been made: * - The call to isFunction() is changed to jQuery.isFunction(). * - The two calls to Array.isArray() is changed to jQuery.isArray(). * * The above two changes ensure compatibility with all older jQuery versions * (1.4.4 - 3.3.1) and older browser versions (e.g., IE8). */ jQuery.extend = jQuery.fn.extend = function() { var options, name, src, copy, copyIsArray, clone, target = arguments[ 0 ] || {}, i = 1, length = arguments.length, deep = false; // Handle a deep copy situation if ( typeof target === "boolean" ) { deep = target; // Skip the boolean and the target target = arguments[ i ] || {}; i++; } // Handle case when target is a string or something (possible in deep copy) if ( typeof target !== "object" && !jQuery.isFunction( target ) ) { target = {}; } // Extend jQuery itself if only one argument is passed if ( i === length ) { target = this; i--; } for ( ; i < length; i++ ) { // Only deal with non-null/undefined values if ( ( options = arguments[ i ] ) != null ) { // Extend the base object for ( name in options ) { copy = options[ name ]; // Prevent Object.prototype pollution // Prevent never-ending loop if ( name === "__proto__" || target === copy ) { continue; } // Recurse if we're merging plain objects or arrays if ( deep && copy && ( jQuery.isPlainObject( copy ) || ( copyIsArray = jQuery.isArray( copy ) ) ) ) { src = target[ name ]; // Ensure proper type for the source value if ( copyIsArray && !jQuery.isArray( src ) ) { clone = []; } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { clone = {}; } else { clone = src; } copyIsArray = false; // Never move original objects, clone them target[ name ] = jQuery.extend( deep, clone, copy ); // Don't bring in undefined values } else if ( copy !== undefined ) { target[ name ] = copy; } } } } // Return the modified object return target; }; })(jQuery); ; /** * For jQuery versions less than 3.5.0, this replaces the jQuery.htmlPrefilter() * function with one that fixes these security vulnerabilities while also * retaining the pre-3.5.0 behavior where it's safe to do so. * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 * - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023 * * Additionally, for jQuery versions that do not have a jQuery.htmlPrefilter() * function (1.x prior to 1.12 and 2.x prior to 2.2), this adds it, and * extends the functions that need to call it to do so. * * Drupal core's jQuery version is 1.4.4, but jQuery Update can provide a * different version, so this covers all versions between 1.4.4 and 3.4.1. * The GitHub links in the code comments below link to jQuery 1.5 code, because * 1.4.4 isn't on GitHub, but the referenced code didn't change from 1.4.4 to * 1.5. */ (function (jQuery) { // Parts of this backport differ by jQuery version. var versionParts = jQuery.fn.jquery.split('.'); var majorVersion = parseInt(versionParts[0]); var minorVersion = parseInt(versionParts[1]); // No backport is needed if we're already on jQuery 3.5 or higher. if ( (majorVersion > 3) || (majorVersion === 3 && minorVersion >= 5) ) { return; } // Prior to jQuery 3.5, jQuery converted XHTML-style self-closing tags to // their XML equivalent: e.g., "
" to "
". This is // problematic for several reasons, including that it's vulnerable to XSS // attacks. However, since this was jQuery's behavior for many years, many // Drupal modules and jQuery plugins may be relying on it. Therefore, we // preserve that behavior, but for a limited set of tags only, that we believe // to not be vulnerable. This is the set of HTML tags that satisfy all of the // following conditions: // - In DOMPurify's list of HTML tags. If an HTML tag isn't safe enough to // appear in that list, then we don't want to mess with it here either. // @see https://github.com/cure53/DOMPurify/blob/2.0.11/dist/purify.js#L128 // - A normal element (not a void, template, text, or foreign element). // @see https://html.spec.whatwg.org/multipage/syntax.html#elements-2 // - An element that is still defined by the current HTML specification // (not a deprecated element), because we do not want to rely on how // browsers parse deprecated elements. // @see https://developer.mozilla.org/en-US/docs/Web/HTML/Element // - Not 'html', 'head', or 'body', because this pseudo-XHTML expansion is // designed for fragments, not entire documents. // - Not 'colgroup', because due to an idiosyncrasy of jQuery's original // regular expression, it didn't match on colgroup, and we don't want to // introduce a behavior change for that. var selfClosingTagsToReplace = [ 'a', 'abbr', 'address', 'article', 'aside', 'audio', 'b', 'bdi', 'bdo', 'blockquote', 'button', 'canvas', 'caption', 'cite', 'code', 'data', 'datalist', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'fieldset', 'figcaption', 'figure', 'footer', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup', 'i', 'ins', 'kbd', 'label', 'legend', 'li', 'main', 'map', 'mark', 'menu', 'meter', 'nav', 'ol', 'optgroup', 'option', 'output', 'p', 'picture', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'select', 'small', 'source', 'span', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'u', 'ul', 'var', 'video' ]; // Define regular expressions for and . Doing this as // two expressions makes it easier to target without also targeting // every tag that starts with "a". var xhtmlRegExpGroup = '(' + selfClosingTagsToReplace.join('|') + ')'; var whitespace = '[\\x20\\t\\r\\n\\f]'; var rxhtmlTagWithoutSpaceOrAttributes = new RegExp('<' + xhtmlRegExpGroup + '\\/>', 'gi'); var rxhtmlTagWithSpaceAndMaybeAttributes = new RegExp('<' + xhtmlRegExpGroup + '(' + whitespace + '[^>]*)\\/>', 'gi'); // jQuery 3.5 also fixed a vulnerability for when appears within // an , but it did that in local code that we can't // backport directly. Instead, we filter such cases out. To do so, we need to // determine when jQuery would otherwise invoke the vulnerable code, which it // uses this regular expression to determine. The regular expression changed // for version 3.0.0 and changed again for 3.4.0. // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L4958 // @see https://github.com/jquery/jquery/blob/3.0.0/dist/jquery.js#L4584 // @see https://github.com/jquery/jquery/blob/3.4.0/dist/jquery.js#L4712 var rtagName; if (majorVersion < 3) { rtagName = /<([\w:]+)/; } else if (minorVersion < 4) { rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]+)/i; } else { rtagName = /<([a-z][^\/\0>\x20\t\r\n\f]*)/i; } // The regular expression that jQuery uses to determine which self-closing // tags to expand to open and close tags. This is vulnerable, because it // matches all tag names except the few excluded ones. We only use this // expression for determining vulnerability. The expression changed for // version 3, but we only need to check for vulnerability in versions 1 and 2, // so we use the expression from those versions. // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L4957 var rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/gi; jQuery.extend({ htmlPrefilter: function (html) { // This is how jQuery determines the first tag in the HTML. // @see https://github.com/jquery/jquery/blob/1.5/jquery.js#L5521 var tag = ( rtagName.exec( html ) || [ "", "" ] )[ 1 ].toLowerCase(); // It is not valid HTML for to have