From afbbaac6f3c33c7fce83722dc0c6444674e3681f Mon Sep 17 00:00:00 2001 From: TheWitness Date: Wed, 7 Oct 2026 18:09:11 -0400 Subject: [PATCH 1/4] security: move inline event handlers to CSP-safe bindings Cacti's Content-Security-Policy script-src-attr directive blocks inline event-handler attributes. This converts the plugin's remaining inline handlers: - Confirmation-page Cancel/Return buttons (reportit.php, templates.php) switch from onClick='cactiReturnTo(...)' to the CSP-safe cactiReturnTo class, with a data-url carrying the return target where one was passed. - The filter "rows" selects (reportit, templates, view) drop their inline onChange='applyFilter()' and are bound via change() in each page's ready block (view.php already bound #rows; reportit/templates now do too). - The template calc-syntax links (html_calc_syntax in lib/funct_html.php) drop their inline onClick=add_to_calc(...) for a reportitAddCalc class + data- calc-name attribute, bound by a delegated handler in templates.php. lib/funct_html.php is measured; a new ReportitCalcSyntaxTest exercises html_calc_syntax() so the changed line stays covered. The three web-UI entry points are added to the patch-coverage allowlist. No i18n calls changed, so cacti.pot is untouched. Cacti 1.2.31+ binds the cactiReturnTo class automatically; the README documents a one-time applySkin() snippet for earlier releases. --- CHANGELOG.md | 1 + README.md | 14 +++++++++++ lib/funct_html.php | 2 +- reportit.php | 22 ++++++++++------ templates.php | 28 +++++++++++++-------- tests/Unit/ReportitCalcSyntaxTest.php | 36 +++++++++++++++++++++++++++ tests/bin/patch-coverage.php | 3 +++ view.php | 2 +- 8 files changed, 89 insertions(+), 19 deletions(-) create mode 100644 tests/Unit/ReportitCalcSyntaxTest.php diff --git a/CHANGELOG.md b/CHANGELOG.md index de14930..9d00871 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ --- develop --- +* security: Move the plugin's remaining inline event handlers to CSP-safe bindings so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive: the confirmation-page Cancel buttons use the `cactiReturnTo` class, the filter rows selects are bound via change() in their ready blocks, and the template calc-syntax links use a delegated `reportitAddCalc` handler * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure) * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step * security: Add a version-safe CSP nonce (`plugin_reportit_csp_nonce()`) to every inline `