From 7f91ea8261bc0cc01350bbc2fed330ce0de947e2 Mon Sep 17 00:00:00 2001
From: TheWitness <larry@thewitness.org>
Date: Wed, 7 Oct 2026 17:43:01 -0400
Subject: [PATCH] security: move inline event handlers to CSP-safe bindings

Cacti's Content-Security-Policy script-src-attr directive blocks inline
event-handler attributes. This converts the plugin's remaining inline
handlers:

- The confirmation-page Cancel buttons across servcheck_ca.php,
  servcheck_credential.php, servcheck_proxy.php, servcheck_restapi.php and
  servcheck_test.php switch from onClick='cactiReturnTo()' to the CSP-safe
  cactiReturnTo class.
- The filter "rows" selects on the CA, credential and proxy pages drop their
  inline onChange='applyFilter()' and are bound in each page's existing ready
  block via change() (not click(), which never fired for a <select>).

The changed UI files are web entry points not loadable in the isolated unit
process, so they are added to the patch-coverage allowlist. No i18n calls
changed, so cacti.pot is untouched. Cacti 1.2.31+ binds the cactiReturnTo
class automatically; the README documents a one-time applySkin() snippet for
earlier releases.
---
 CHANGELOG.md                 |  1 +
 README.md                    | 14 ++++++++++++++
 servcheck_ca.php             |  6 +++---
 servcheck_credential.php     | 10 +++++++---
 servcheck_proxy.php          |  6 +++---
 servcheck_restapi.php        |  4 ++--
 servcheck_test.php           | 12 ++++++------
 tests/bin/patch-coverage.php |  5 +++++
 8 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index efecf16..04b329c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class and move the filter rows selects' inline `onChange` handlers into the ready block (bound via change, not click) so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
 * dev: Keep the status-legend chips equal width (sized to the longest label, laid out as a CSS grid so chips stay equal across wrapped rows) as the legend wraps responsively
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
diff --git a/README.md b/README.md
index 588aa40..b7ba317 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,20 @@ is going to be down can be configured so that escallation does not needlessly
 take place during maintenance periods.
 
 
+## Cacti compatibility
+
+If you are running a version of Cacti below 1.2.31, please add the function
+below to the `applySkin()` function in `include/layout.js` to enable the Cancel
+buttons on forms to work:
+
+```js
+$(document).off('click.cactiReturnTo', '.cactiReturnTo')
+    .on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
+        event.preventDefault();
+        cactiReturnTo($(this).attr('data-url'));
+    });
+```
+
 ## Upgrading
 
 `poller_servcheck.php` runs as a long-lived background process, so a running
diff --git a/servcheck_ca.php b/servcheck_ca.php
index 4319757..3df4bcb 100644
--- a/servcheck_ca.php
+++ b/servcheck_ca.php
@@ -133,7 +133,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
 		}
 	} else {
 		raise_message(40);
@@ -423,7 +423,7 @@ function servcheck_filter(): void {
 						<?php print __('CAs', 'servcheck'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilter()'>
+						<select id='rows'>
 							<?php
 							print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';
 
@@ -463,7 +463,7 @@ function clearFilter() {
 		}
 
 		$(function() {
-			$('#rows').click(function() {
+			$('#rows').change(function() {
 				applyFilter();
 			});
 
diff --git a/servcheck_credential.php b/servcheck_credential.php
index 2118d5c..0eca37b 100644
--- a/servcheck_credential.php
+++ b/servcheck_credential.php
@@ -155,7 +155,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 2) { // duplicate
 			print "<tr>
 				<td class='topBoxAlt'>
@@ -163,7 +163,7 @@ function form_actions(): void {
 				</td>
 			</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Credential', 'Duplicate Credential', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Credential', 'Duplicate Credential', cacti_sizeof($items_array)) . "'>";
 		}
 	} else {
 		raise_message(40);
@@ -944,7 +944,7 @@ function servcheck_filter(): void {
 						<?php print __('Credentials', 'servcheck'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilter()'>
+						<select id='rows'>
 							<?php
 							print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';
 
@@ -984,6 +984,10 @@ function clearFilter() {
 		}
 
 		$(function() {
+			$('#rows').change(function() {
+				applyFilter();
+			});
+
 			$('#refresh').click(function() {
 				applyFilter();
 			});
diff --git a/servcheck_proxy.php b/servcheck_proxy.php
index f4343a8..286d935 100644
--- a/servcheck_proxy.php
+++ b/servcheck_proxy.php
@@ -132,7 +132,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
 		}
 	} else {
 		raise_message(40);
@@ -436,7 +436,7 @@ function servcheck_filter(): void {
 						<?php print __('Proxies', 'servcheck'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilter()'>
+						<select id='rows'>
 							<?php
 							print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';
 
@@ -476,7 +476,7 @@ function clearFilter() {
 		}
 
 		$(function() {
-			$('#rows').click(function() {
+			$('#rows').change(function() {
 				applyFilter();
 			});
 
diff --git a/servcheck_restapi.php b/servcheck_restapi.php
index 0bf77a2..7ecd940 100644
--- a/servcheck_restapi.php
+++ b/servcheck_restapi.php
@@ -168,7 +168,7 @@ function form_actions(): void {
 				</td>
 			</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete Rest API', 'Delete Rest API', cacti_sizeof($restapi_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete Rest API', 'Delete Rest API', cacti_sizeof($restapi_array)) . "'>";
 		} elseif ($action == 'duplicate') {
 			print "<tr>
 				<td class='topBoxAlt'>
@@ -177,7 +177,7 @@ function form_actions(): void {
 				</td>
 			</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Rest API', 'Duplicate Rest API', cacti_sizeof($restapi_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Rest API', 'Duplicate Rest API', cacti_sizeof($restapi_array)) . "'>";
 		}
 	} else {
 		raise_message(40);
diff --git a/servcheck_test.php b/servcheck_test.php
index 5dd0352..566a576 100644
--- a/servcheck_test.php
+++ b/servcheck_test.php
@@ -230,7 +230,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 2) { // disable
 			print "	<tr>
 					<td class='topBoxAlt'>
@@ -239,7 +239,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Disable item', 'Disable items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Disable item', 'Disable items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 3) { // enable
 			print "	<tr>
 					<td class='topBoxAlt'>
@@ -248,7 +248,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Enable item', 'Enable items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Enable item', 'Enable items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 4) { // duplicate
 			print "	<tr>
 					<td class='topBoxAlt'>
@@ -257,7 +257,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 5) { // clear statistics
 			print "	<tr>
 					<td class='topBoxAlt'>
@@ -266,7 +266,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
 		} elseif (get_filter_request_var('drp_action') == 6) { // clear log
 			print "	<tr>
 					<td class='topBoxAlt'>
@@ -275,7 +275,7 @@ function form_actions(): void {
 					</td>
 				</tr>";
 
-			$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
+			$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
 		}
 	} else {
 		raise_message(40);
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index e65b53d..f9b08b2 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -160,6 +160,11 @@ function changed_lines($base_ref) {
  * Empty by default; add entries per repository as the need arises.
  */
 $unmeasured_allowlist = [
+	'servcheck_ca.php',         // web UI entry point (require auth.php); not loadable in the isolated unit process
+	'servcheck_credential.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
+	'servcheck_proxy.php',      // web UI entry point (require auth.php); not loadable in the isolated unit process
+	'servcheck_restapi.php',    // web UI entry point (require auth.php); not loadable in the isolated unit process
+	'servcheck_test.php',       // web UI entry point (require auth.php); not loadable in the isolated unit process
 ];
 $unmeasured            = array_values(array_diff(array_keys($changed), array_keys($measured)));
 $unexpected_unmeasured = array_values(array_diff($unmeasured, $unmeasured_allowlist));