System scan detected vulnerability in pdf.js plugin. Don’t want to update whole OJS and want to update only plugin. I’ve downloaded newest pdf.js plugin from Mozilla site, replaced mjs instances to js so paths outside of plugin wouldn’t be broken (according to search it should not broke plugin itself) but cannot upload repackaged file to OJS.
I am constanly getting ‘archive doesn’t contain folder with correct plugin name’.
How exactly should look tree of said .tar.gz archive to correctly upload to OJS?
Steps I took leading up to the issue
download newest version of pdf.js plugin from Mozilla site in .zip
unpack, change core name to pdf.js and pack with tar cfz pdf.js.tar.gz pdf.js
This method of updating is preferred over updating manually, because it ensures that the version you’ll be upgrading to is compatible with your given OJS version. If you don’t see an upgrade option, that’s likely because you’re using the most recent compatible version of the plugin.
You could try applying this patch to your 3.4.0-x installation – however, please take a backup first, and note that this hasn’t been tested. I do suspect it’ll work. Make sure to flush your browser cache.
