Skip to content

security: move inline event handlers to CSP-safe bindings #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 2 commits into from
Oct 8, 2026
Merged

security: move inline event handlers to CSP-safe bindings #131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f91ea8
security: move inline event handlers to CSP-safe bindings
Oct 7, 2026
a7f65ba
Merge remote-tracking branch 'origin/main' into fix/csp-inline-handlers
TheWitness Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

--- develop ---

* security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class and move the filter rows selects' inline `onChange` handlers into the ready block (bound via change, not click) so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
* dev: Keep the status-legend chips equal width (sized to the longest label, laid out as a CSS grid so chips stay equal across wrapped rows) as the legend wraps responsively
* dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
* dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
Expand Down
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,20 @@ is going to be down can be configured so that escallation does not needlessly
take place during maintenance periods.


## Cacti compatibility

If you are running a version of Cacti below 1.2.31, please add the function
below to the `applySkin()` function in `include/layout.js` to enable the Cancel
buttons on forms to work:
Comment thread
TheWitness marked this conversation as resolved.

```js
$(document).off('click.cactiReturnTo', '.cactiReturnTo')
.on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
event.preventDefault();
cactiReturnTo($(this).attr('data-url'));
});
```

## Upgrading

`poller_servcheck.php` runs as a long-lived background process, so a running
Expand Down
6 changes: 3 additions & 3 deletions servcheck_ca.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
}
} else {
raise_message(40);
Expand Down Expand Up @@ -423,7 +423,7 @@ function servcheck_filter(): void {
<?php print __('CAs', 'servcheck'); ?>
</td>
<td>
<select id='rows' onChange='applyFilter()'>
<select id='rows'>
<?php
print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';

Expand Down Expand Up @@ -463,7 +463,7 @@ function clearFilter() {
}

$(function() {
$('#rows').click(function() {
$('#rows').change(function() {
applyFilter();
});

Expand Down
10 changes: 7 additions & 3 deletions servcheck_credential.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,15 +155,15 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 2) { // duplicate
print "<tr>
<td class='topBoxAlt'>
<p>" . __n('Click \'Continue\' to Duplicate the following Credential.', 'Click \'Continue\' to Duplicate following Credential.', cacti_sizeof($items_array)) . "</p><div class='itemlist'><ul>$item_list</ul></div>
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Credential', 'Duplicate Credential', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Credential', 'Duplicate Credential', cacti_sizeof($items_array)) . "'>";
}
} else {
raise_message(40);
Expand Down Expand Up @@ -944,7 +944,7 @@ function servcheck_filter(): void {
<?php print __('Credentials', 'servcheck'); ?>
</td>
<td>
<select id='rows' onChange='applyFilter()'>
<select id='rows'>
<?php
print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';

Expand Down Expand Up @@ -984,6 +984,10 @@ function clearFilter() {
}

$(function() {
$('#rows').change(function() {
applyFilter();
});

$('#refresh').click(function() {
applyFilter();
});
Expand Down
6 changes: 3 additions & 3 deletions servcheck_proxy.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
}
} else {
raise_message(40);
Expand Down Expand Up @@ -436,7 +436,7 @@ function servcheck_filter(): void {
<?php print __('Proxies', 'servcheck'); ?>
</td>
<td>
<select id='rows' onChange='applyFilter()'>
<select id='rows'>
<?php
print "<option value='-1'" . (get_request_var('rows') == -1 ? ' selected' : '') . '>' . __('Default', 'servcheck') . '</option>';

Expand Down Expand Up @@ -476,7 +476,7 @@ function clearFilter() {
}

$(function() {
$('#rows').click(function() {
$('#rows').change(function() {
applyFilter();
});

Expand Down
4 changes: 2 additions & 2 deletions servcheck_restapi.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete Rest API', 'Delete Rest API', cacti_sizeof($restapi_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete Rest API', 'Delete Rest API', cacti_sizeof($restapi_array)) . "'>";
} elseif ($action == 'duplicate') {
print "<tr>
<td class='topBoxAlt'>
Expand All @@ -177,7 +177,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Rest API', 'Duplicate Rest API', cacti_sizeof($restapi_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate Rest API', 'Duplicate Rest API', cacti_sizeof($restapi_array)) . "'>";
}
} else {
raise_message(40);
Expand Down
12 changes: 6 additions & 6 deletions servcheck_test.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Delete item', 'Delete items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 2) { // disable
print " <tr>
<td class='topBoxAlt'>
Expand All @@ -239,7 +239,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Disable item', 'Disable items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Disable item', 'Disable items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 3) { // enable
print " <tr>
<td class='topBoxAlt'>
Expand All @@ -248,7 +248,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Enable item', 'Enable items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Enable item', 'Enable items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 4) { // duplicate
print " <tr>
<td class='topBoxAlt'>
Expand All @@ -257,7 +257,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 5) { // clear statistics
print " <tr>
<td class='topBoxAlt'>
Expand All @@ -266,7 +266,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
} elseif (get_filter_request_var('drp_action') == 6) { // clear log
print " <tr>
<td class='topBoxAlt'>
Expand All @@ -275,7 +275,7 @@ function form_actions(): void {
</td>
</tr>";

$save_html = "<input type='button' value='" . __esc('Cancel') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel') . "'>&nbsp;<input type='submit' value='" . __esc('Continue') . "' title='" . __esc_n('Duplicate item', 'Duplicate items', cacti_sizeof($items_array)) . "'>";
}
} else {
raise_message(40);
Expand Down
8 changes: 5 additions & 3 deletions tests/bin/patch-coverage.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,9 +160,11 @@ function changed_lines($base_ref) {
* Empty by default; add entries per repository as the need arises.
*/
$unmeasured_allowlist = [
// Web page controller: chdir()s and includes auth.php at the top level, so it
// cannot be loaded into the isolated unit process and is absent from Clover.
'servcheck_test.php',
'servcheck_ca.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
'servcheck_credential.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
'servcheck_proxy.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
'servcheck_restapi.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
'servcheck_test.php', // web UI entry point (require auth.php); not loadable in the isolated unit process
];
$unmeasured = array_values(array_diff(array_keys($changed), array_keys($measured)));
$unexpected_unmeasured = array_values(array_diff($unmeasured, $unmeasured_allowlist));
Expand Down
Loading