MDL-68430 filter_mathjaxloader: update default CDN to 2.7.8

filter/mathjaxloader/db/upgrade.php

@@ -163,5 +163,17 @@ MathJax.Hub.Config({
     // Automatically generated Moodle v3.7.0 release upgrade line.
     // Put any upgrade step following this.
 
+    if ($oldversion < 2019052001) {
+        // Update CDN url.
+        $originalurl = 'https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.2/MathJax.js';
+        $newurl = 'https://cdn.jsdelivr.net/npm/[email protected]/MathJax.js';
+        $currenturl = get_config('filter_mathjaxloader', 'httpsurl');
+        if ($currenturl == $originalurl) {
+            set_config('httpsurl', $newurl, 'filter_mathjaxloader');
+        }
+
+        upgrade_plugin_savepoint(true, 2019052001, 'filter', 'mathjaxloader');
+    }
+
     return true;
 }

filter/mathjaxloader/readme_moodle.txt

@@ -1,7 +1,7 @@
 Description of MathJAX library integration in Moodle
 ====================================================
 
-* Default MathJax version: 2.7.2
+* Default MathJax version: 2.7.8
 * License: Apache 2.0
 * Source: https://www.mathjax.org/
 
@@ -18,3 +18,8 @@ Upgrading the default MathJax version
 3. Check and eventually update the list of language mappings in filter.php.
    Also see the unit test for the language mappings.
 
+Changes
+-------
+
+* The MathJax 2.7.2 seems to have a possible security issue, the CDN default value have been
+updated to point to the recommended 2.7.8 version. See MDL-68430 for details.

filter/mathjaxloader/settings.php

@@ -33,7 +33,7 @@ if ($ADMIN->fulltree) {
     $item = new admin_setting_configtext('filter_mathjaxloader/httpsurl',
                                          new lang_string('httpsurl', 'filter_mathjaxloader'),
                                          new lang_string('httpsurl_help', 'filter_mathjaxloader'),
-                                         'https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.2/MathJax.js',
+                                         'https://cdn.jsdelivr.net/npm/mathjax@2.7.8/MathJax.js',
                                          PARAM_RAW);
     $settings->add($item);
 

filter/mathjaxloader/version.php

@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version  = 2019052000;
+$plugin->version  = 2019052001;
 $plugin->requires = 2019051100;  // Requires this Moodle version.
 $plugin->component= 'filter_mathjaxloader';