From 21060d790d99ac749ca45632b8e2005308d683a6 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Wed, 7 Oct 2026 17:17:33 -0400 Subject: [PATCH 1/2] security: convert cactiReturnTo cancel buttons to the CSP-safe class The confirmation pages' Cancel buttons used an inline onClick='cactiReturnTo()' handler, which trips Cacti's Content-Security-Policy script-src-attr directive. Switch them to the CSP-safe cactiReturnTo CSS class (class='cactiReturnTo', plus an optional data-url when a target is passed). Cacti 1.2.31 and later bind this class automatically. The README documents a one-time include/layout.js applySkin() snippet for operators still on an earlier release - no shim is baked into the core or the plugin. --- CHANGELOG.md | 1 + README.md | 14 ++++++++++++++ maint.php | 24 ++++++++++++------------ 3 files changed, 27 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cce5507..e789d7f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ --- develop --- +* security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive; see the README for the one-time `applySkin()` snippet needed when running Cacti below 1.2.31 (1.2.31+ binds the class automatically) * issue: Fix an uncaught `TypeError` from `html_nav_bar()` (the schedules, devices, webseer and servcheck lists passed the `page`/`rows`/`total_rows` request values as strings, which the typed core signature rejects under `declare(strict_types=1)`); the paging arguments are now cast to `int` * refactor: Move schema management into includes/database.php (the thold model) and relocate functions.php into includes/; setup.php delegates via require_once, and plugin_maint_check_upgrade() now refreshes the schema via db_update_table(), re-registers the is_device_in_maintenance hook against includes/functions.php, and updates the full plugin_config row on a version change. Switches every file inclusion from include/include_once to require/require_once * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step diff --git a/README.md b/README.md index 48c4acf..e4a3070 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,20 @@ The Cacti maint plugin is for the scheduling of maintenance so that Thold / Webseer / Other plugins will not alert during that time period. +## Cacti compatibility + +If you are running a version of Cacti below 1.2.31, please add the function +below to the `applySkin()` function in `include/layout.js` to enable the Cancel +buttons on forms to work: + +```js +$(document).off('click.cactiReturnTo', '.cactiReturnTo') + .on('click.cactiReturnTo', '.cactiReturnTo', function(event) { + event.preventDefault(); + cactiReturnTo($(this).attr('data-url')); + }); +``` + ## Installation To install the plugin, please refer to the Plugin Installation Documentation diff --git a/maint.php b/maint.php index d5a8bf9..1773d2b 100644 --- a/maint.php +++ b/maint.php @@ -430,7 +430,7 @@ function form_actions(): void { "; - $save_html = " + $save_html = " '; } elseif (get_request_var('drp_action') == '2') { // delete print " @@ -440,11 +440,11 @@ function form_actions(): void { "; - $save_html = " "; + $save_html = " "; } } else { print "" . __('You must select at least one Maintenance Schedule.', 'maint') . ''; - $save_html = " + $save_html = " '; } elseif (get_request_var('drp_action') == '2') { // disassociate print " @@ -509,12 +509,12 @@ function form_actions(): void { "; - $save_html = " + $save_html = " '; } } else { print "" . __('You must select at least one Device.', 'maint') . ''; - $save_html = "'; + $save_html = "'; } print " @@ -569,7 +569,7 @@ function form_actions(): void { "; - $save_html = " + $save_html = " '; } elseif (get_request_var('drp_action') == '2') { // disassociate print " @@ -579,12 +579,12 @@ function form_actions(): void { "; - $save_html = " + $save_html = " '; } } else { print "" . __('You must select at least one Webseer.', 'maint') . ''; - $save_html = "'; + $save_html = "'; } print " @@ -639,7 +639,7 @@ function form_actions(): void { "; - $save_html = " + $save_html = " '; } elseif (get_request_var('drp_action') == '2') { // disassociate print " @@ -649,12 +649,12 @@ function form_actions(): void { "; - $save_html = " + $save_html = " " . __esc('Continue', 'maint') . ''; } } else { print "" . __('You must select at least one Servcheck test.', 'maint') . ''; - $save_html = "'; + $save_html = "'; } print " From 63e608f02b60e78553d5df0edca3be9482407b7c Mon Sep 17 00:00:00 2001 From: TheWitness <1439914+TheWitness@users.noreply.github.com> Date: Wed, 7 Oct 2026 18:47:02 -0400 Subject: [PATCH 2/2] fix: close the no-selection Return button tags The schedules Return control (line 447) ended '', and the webseer Return control (line 587) carried a stray double '>>' in its opening tag. Both left malformed markup on the no-selection path; normalize them to a well-formed . --- maint.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/maint.php b/maint.php index 1773d2b..be5d723 100644 --- a/maint.php +++ b/maint.php @@ -444,7 +444,7 @@ function form_actions(): void { } } else { print "" . __('You must select at least one Maintenance Schedule.', 'maint') . ''; - $save_html = "'; + $save_html = "'; } print "