Skip to content

security: convert cactiReturnTo cancel buttons to the CSP-safe class #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 2 commits into from
Oct 8, 2026
Merged

security: convert cactiReturnTo cancel buttons to the CSP-safe class #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
21060d7
security: convert cactiReturnTo cancel buttons to the CSP-safe class
Oct 7, 2026
63e608f
fix: close the no-selection Return button tags
TheWitness Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

--- develop ---

* security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive; see the README for the one-time `applySkin()` snippet needed when running Cacti below 1.2.31 (1.2.31+ binds the class automatically)
* issue: Fix an uncaught `TypeError` from `html_nav_bar()` (the schedules, devices, webseer and servcheck lists passed the `page`/`rows`/`total_rows` request values as strings, which the typed core signature rejects under `declare(strict_types=1)`); the paging arguments are now cast to `int`
* refactor: Move schema management into includes/database.php (the thold model) and relocate functions.php into includes/; setup.php delegates via require_once, and plugin_maint_check_upgrade() now refreshes the schema via db_update_table(), re-registers the is_device_in_maintenance hook against includes/functions.php, and updates the full plugin_config row on a version change. Switches every file inclusion from include/include_once to require/require_once
* dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
Expand Down
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,20 @@
The Cacti maint plugin is for the scheduling of maintenance so that Thold /
Webseer / Other plugins will not alert during that time period.

## Cacti compatibility

If you are running a version of Cacti below 1.2.31, please add the function
below to the `applySkin()` function in `include/layout.js` to enable the Cancel
buttons on forms to work:

```js
$(document).off('click.cactiReturnTo', '.cactiReturnTo')
.on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
event.preventDefault();
cactiReturnTo($(this).attr('data-url'));
});
```

## Installation

To install the plugin, please refer to the Plugin Installation Documentation
Expand Down
24 changes: 12 additions & 12 deletions maint.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,7 +430,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Update Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
} elseif (get_request_var('drp_action') == '2') { // delete
print "<tr>
Expand All @@ -440,11 +440,11 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel', 'maint') . "' onClick='cactiReturnTo(\"maint.php\")'>&nbsp;<input type='submit' value='" . __esc('Continue', 'maint') . "' title='" . __esc('Delete Maintenance Schedule(s)', 'maint') . "'>";
$save_html = "<input class='cactiReturnTo' data-url='maint.php' type='button' value='" . __esc('Cancel', 'maint') . "'>&nbsp;<input type='submit' value='" . __esc('Continue', 'maint') . "' title='" . __esc('Delete Maintenance Schedule(s)', 'maint') . "'>";
}
} else {
print "<tr><td><span class='textError'>" . __('You must select at least one Maintenance Schedule.', 'maint') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Return', 'maint') . '</button';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Return', 'maint') . '</button>';
}

print "<tr class='saveRow'>
Expand Down Expand Up @@ -499,7 +499,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Associate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
} elseif (get_request_var('drp_action') == '2') { // disassociate
print "<tr>
Expand All @@ -509,12 +509,12 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Disassociate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
}
} else {
print "<tr><td><span class='textError'>" . __('You must select at least one Device.', 'maint') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Return', 'maint') . '</button>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Return', 'maint') . '</button>';
}

print "<tr class='saveRow'>
Expand Down Expand Up @@ -569,7 +569,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Associate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
} elseif (get_request_var('drp_action') == '2') { // disassociate
print "<tr>
Expand All @@ -579,12 +579,12 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Disassociate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
}
} else {
print "<tr><td><span class='textError'>" . __('You must select at least one Webseer.', 'maint') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget'> onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Return', 'maint') . '</button>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Return', 'maint') . '</button>';
}

print "<tr class='saveRow'>
Expand Down Expand Up @@ -639,7 +639,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Associate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
} elseif (get_request_var('drp_action') == '2') { // disassociate
print "<tr>
Expand All @@ -649,12 +649,12 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Cancel', 'maint') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Cancel', 'maint') . "</button>
<input type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Disassociate Maintenance Schedule(s)', 'maint') . "'>" . __esc('Continue', 'maint') . '</button>';
}
} else {
print "<tr><td><span class='textError'>" . __('You must select at least one Servcheck test.', 'maint') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"maint.php\")'>" . __esc('Return', 'maint') . '</button>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' data-url='maint.php'>" . __esc('Return', 'maint') . '</button>';
}

print "<tr class='saveRow'>
Expand Down
Loading