From 68aa196701fb83e45ded9c037f3d8fce714a0f24 Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Fri, 9 Oct 2026 17:47:06 -0400
Subject: [PATCH 1/2] Replace inline onClick/onChange handlers with jQuery
 bindings and cactiReturnTo class

Remove inline event-handler attributes in favor of unobtrusive jQuery handlers, matching the existing initSyslog* ready-block pattern:

- Filter selects (#rows/#refresh/#removal/#grouping/#enabled) drop onChange='applyFilter*()' and are bound via .change() in their init functions.

- The search filter toggle drops onclick='toggleSyslogSearch()' and binds #syslog_search_toggle via .click().

- The classic syslog_form_callback dropdown drops the inline onChange and binds through the existing whitelisted syslogInvokeCallback helper.

- Cancel/Return buttons drop onClick='cactiReturnTo()' and use the cactiReturnTo class the page JS already looks for (saveRow.find('.cactiReturnTo')).
---
 js/functions.js           | 28 ++++++++++++++++++++++++++++
 syslog.php                | 19 ++++++++++++-------
 syslog_alerts.php         |  6 +++---
 syslog_dashboards.php     |  4 ++--
 syslog_device_rules.php   |  2 +-
 syslog_removal.php        |  6 +++---
 syslog_reports.php        |  8 ++++----
 syslog_saved_searches.php |  4 ++--
 8 files changed, 55 insertions(+), 22 deletions(-)

diff --git a/js/functions.js b/js/functions.js
index 0a5786e3..096c1640 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -370,6 +370,10 @@ function initSyslogSavedSearches() {
 			importSavedSearch();
 		});
 
+		$('#rows').change(function() {
+			applyFilterSavedSearches();
+		});
+
 		$('#saved_searches').submit(function(event) {
 			event.preventDefault();
 			applyFilterSavedSearches();
@@ -406,6 +410,10 @@ function initSyslogDashboards() {
 			importDashboard();
 		});
 
+		$('#rows').change(function() {
+			applyFilterDashboards();
+		});
+
 		$('#dashboards').submit(function(event) {
 			event.preventDefault();
 			applyFilterDashboards();
@@ -1267,6 +1275,14 @@ function initSyslogMain(config) {
 		$('#export').click(function() {
 			exportRecords();
 		});
+
+		$('#syslog_search_toggle').click(function() {
+			toggleSyslogSearch();
+		});
+
+		$('#rows, #refresh, #removal, #grouping').change(function() {
+			applyFilter();
+		});
 	});
 }
 
@@ -1385,6 +1401,10 @@ function initSyslogRemoval(allowEdits) {
 			importRemoval();
 		});
 
+		$('#enabled, #rows').change(function() {
+			applyFilterRemoval();
+		});
+
 		$('#removal').submit(function(event) {
 			event.preventDefault();
 			applyFilterRemoval();
@@ -1440,6 +1460,10 @@ function initSyslogAlerts() {
 			importAlert();
 		});
 
+		$('#enabled, #rows').change(function() {
+			applyFilterAlerts();
+		});
+
 		$('#alert').submit(function(event) {
 			event.preventDefault();
 			applyFilterAlerts();
@@ -1495,6 +1519,10 @@ function initSyslogReports() {
 			importReport();
 		});
 
+		$('#enabled, #rows').change(function() {
+			applyFilterReports();
+		});
+
 		$('#reports').submit(function(event) {
 			event.preventDefault();
 			applyFilterReports();
diff --git a/syslog.php b/syslog.php
index 67010734..9ee433f1 100644
--- a/syslog.php
+++ b/syslog.php
@@ -2051,8 +2051,7 @@ function syslog_filter(string $sql_where, string $tab): void {
 							aria-label='<?php print __esc('Collapse filters', 'syslog'); ?>'
 							title='<?php print __esc('Collapse filters', 'syslog'); ?>'
 							data-hide='<?php print __esc('Collapse filters', 'syslog'); ?>'
-							data-show='<?php print __esc('Edit filters', 'syslog'); ?>'
-							onclick='toggleSyslogSearch()'><span><?php print __esc('Collapse filters', 'syslog'); ?></span><i class='fa fa-chevron-up' aria-hidden='true'></i></button>
+							data-show='<?php print __esc('Edit filters', 'syslog'); ?>'><span><?php print __esc('Collapse filters', 'syslog'); ?></span><i class='fa fa-chevron-up' aria-hidden='true'></i></button>
 						<input type='hidden' id='search_mode' value='logical'>
 					</div>
 					<div class='syslogSearchSavedBar'>
@@ -2121,7 +2120,7 @@ function syslog_filter(string $sql_where, string $tab): void {
 					</div>
 					<div class='syslogSearchOption syslogResultsLimit'>
 						<label for='rows'><?php print __('Results limit', 'syslog'); ?></label>
-						<select id='rows' onChange='applyFilter()' title='<?php print __esc('Display Rows', 'syslog'); ?>'>
+						<select id='rows' title='<?php print __esc('Display Rows', 'syslog'); ?>'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') { ?> selected<?php } ?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 							foreach ($item_rows as $rows => $display_text) {
@@ -2140,7 +2139,7 @@ function syslog_filter(string $sql_where, string $tab): void {
 					<details id='syslog_view_options' class='syslogMenu'><summary><?php print __esc('View options', 'syslog'); ?></summary><div class='syslogMenuBody syslogSearchOptions'>
 						<div class='syslogSearchOption'>
 							<label for='refresh'><?php print __('Refresh', 'syslog'); ?></label>
-							<select id='refresh' onChange='applyFilter()'>
+							<select id='refresh'>
 								<?php
 								foreach ($page_refresh_interval as $seconds => $display_text) {
 									print "<option value='" . $seconds . "'";
@@ -2157,7 +2156,7 @@ function syslog_filter(string $sql_where, string $tab): void {
 						<?php if (get_nfilter_request_var('tab') == 'syslog') { ?>
 						<div class='syslogSearchOption'>
 							<label for='removal'><?php print __('Record Type', 'syslog'); ?></label>
-							<select id='removal' onChange='applyFilter()' title='<?php print __esc('Removal Handling', 'syslog'); ?>'>
+							<select id='removal' title='<?php print __esc('Removal Handling', 'syslog'); ?>'>
 								<option value='1'<?php if (get_request_var('removal') == '1') { ?> selected<?php } ?>><?php print __('All Records', 'syslog'); ?></option>
 								<option value='-1'<?php if (get_request_var('removal') == '-1') { ?> selected<?php } ?>><?php print __('Main Records', 'syslog'); ?></option>
 								<option value='2'<?php if (get_request_var('removal') == '2') { ?> selected<?php } ?>><?php print __('Removed Records', 'syslog'); ?></option>
@@ -2169,7 +2168,7 @@ function syslog_filter(string $sql_where, string $tab): void {
 						<?php if (get_nfilter_request_var('tab') == 'syslog') { ?>
 						<div class='syslogSearchOption'>
 							<label for='grouping'><?php print __('Display', 'syslog'); ?></label>
-							<select id='grouping' onChange='applyFilter()' title='<?php print __esc('Group Duplicate Messages', 'syslog'); ?>'>
+							<select id='grouping' title='<?php print __esc('Group Duplicate Messages', 'syslog'); ?>'>
 								<option value='0'<?php if (get_request_var('grouping') == '0') { ?> selected<?php } ?>><?php print __('Individual Messages', 'syslog'); ?></option>
 								<option value='1'<?php if (get_request_var('grouping') == '1') { ?> selected<?php } ?>><?php print __('Grouped Messages', 'syslog'); ?></option>
 							</select>
@@ -2735,7 +2734,7 @@ function syslog_form_callback(string $form_name, string $classic_sql, string $co
 	$theme = get_selected_theme();
 
 	if ($theme == 'classic' || read_config_option('autocomplete') > 0) {
-		print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . ($on_change != '' ? "onChange='$on_change'" : '') . '>';
+		print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . '>';
 
 		if (!empty($none_entry)) {
 			print "<option value='-2'" . (empty($previous_value) ? ' selected' : '') . ">$none_entry</option>";
@@ -2746,6 +2745,12 @@ function syslog_form_callback(string $form_name, string $classic_sql, string $co
 		html_create_list($form_data, $column_display, $column_id, html_escape((string) $previous_id));
 
 		print '</select>';
+
+		if ($on_change != '') {
+			// JSON_HEX_TAG escapes </script>; the other flags block HTML context escapes.
+			$js_flags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_THROW_ON_ERROR;
+			print "<script type='text/javascript'>$(function(){ $('#" . html_escape($form_name) . "').change(function(){ syslogInvokeCallback(" . json_encode($on_change, $js_flags) . "); }); });</script>";
+		}
 	} else {
 		if (empty($previous_id) && $previous_value == '') {
 			$previous_value = $none_entry;
diff --git a/syslog_alerts.php b/syslog_alerts.php
index 344cd3c6..938759a3 100644
--- a/syslog_alerts.php
+++ b/syslog_alerts.php
@@ -237,7 +237,7 @@ function form_actions(): void {
 			$title = __esc('Export Syslog Alert Rule(s)', 'syslog');
 		}
 
-		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
+		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
 	} else {
 		raise_message(40);
 		header('Location: syslog_alerts.php?header=false');
@@ -1053,7 +1053,7 @@ function syslog_alerts_filter(): void {
 						<?php print __('Enabled', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='enabled' onChange='applyFilterAlerts()'>
+						<select id='enabled'>
 							<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
 							<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
 							<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
@@ -1063,7 +1063,7 @@ function syslog_alerts_filter(): void {
 						<?php print __('Rows', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilterAlerts()'>
+						<select id='rows'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 							if (cacti_sizeof($item_rows)) {
diff --git a/syslog_dashboards.php b/syslog_dashboards.php
index 39fe6431..c0a3b67d 100644
--- a/syslog_dashboards.php
+++ b/syslog_dashboards.php
@@ -231,7 +231,7 @@ function syslog_dashboard_filter() {
 						<?php print __('Rows', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilterDashboards()'>
+						<select id='rows'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 							if (cacti_sizeof($item_rows)) {
@@ -423,7 +423,7 @@ function syslog_dashboard_actions() {
 			$title = __esc('Export Dashboard(s)', 'syslog');
 		}
 
-		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
+		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
 	} else {
 		raise_message(40);
 		header('Location: syslog_dashboards.php');
diff --git a/syslog_device_rules.php b/syslog_device_rules.php
index b4cf7e22..80596d71 100644
--- a/syslog_device_rules.php
+++ b/syslog_device_rules.php
@@ -121,7 +121,7 @@ function device_rule_actions(): void {
 	}
 	$verb = [1 => __('Delete', 'syslog'), 2 => __('Disable', 'syslog'), 3 => __('Enable', 'syslog'), 4 => __('Export', 'syslog')][(int) get_request_var('drp_action')];
 	print '<tr><td class="textArea"><p>' . __esc('Click Continue to %s the following Device Alert Rule(s).', strtolower($verb), 'syslog') . '</p><div class="itemlist"><ul>' . $list . '</ul></div></td></tr>';
-	print '<tr><td align="right" class="saveRow"><input type="hidden" name="action" value="actions"><input type="hidden" name="selected_items" value="' . html_escape(serialize($items)) . '"><input type="hidden" name="drp_action" value="' . (int) get_request_var('drp_action') . '"><input type="button" value="' . __esc('Cancel', 'syslog') . '" onClick="cactiReturnTo()">&nbsp;<input type="submit" value="' . __esc('Continue', 'syslog') . '"></td></tr>';
+	print '<tr><td align="right" class="saveRow"><input type="hidden" name="action" value="actions"><input type="hidden" name="selected_items" value="' . html_escape(serialize($items)) . '"><input type="hidden" name="drp_action" value="' . (int) get_request_var('drp_action') . '"><input type="button" value="' . __esc('Cancel', 'syslog') . '" class="cactiReturnTo">&nbsp;<input type="submit" value="' . __esc('Continue', 'syslog') . '"></td></tr>';
 	html_end_box();
 	form_end(false);
 	bottom_footer();
diff --git a/syslog_removal.php b/syslog_removal.php
index 95419f42..d30b0ccb 100644
--- a/syslog_removal.php
+++ b/syslog_removal.php
@@ -255,7 +255,7 @@ function form_actions(): void {
 			$title = __esc('Export Syslog Removal Rule(s)', 'syslog');
 		}
 
-		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
+		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
 	} else {
 		raise_message(40);
 		header('Location: syslog_removal.php?header=false');
@@ -825,7 +825,7 @@ function syslog_removal_filter(): void {
 						<?php print __('Enabled', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='enabled' onChange='applyFilterRemoval()'>
+						<select id='enabled'>
 							<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
 							<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
 							<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
@@ -835,7 +835,7 @@ function syslog_removal_filter(): void {
 						<?php print __('Rules', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilterRemoval()'>
+						<select id='rows'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 								if (cacti_sizeof($item_rows)) {
diff --git a/syslog_reports.php b/syslog_reports.php
index 81b40d90..f849cffa 100644
--- a/syslog_reports.php
+++ b/syslog_reports.php
@@ -220,10 +220,10 @@ function form_actions(): void {
 			$title = __esc('Export Syslog Report Rule(s)', 'syslog');
 		}
 
-		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
+		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
 	} else {
 		print "<tr><td class='odd'><span class='textError'>" . __('You must select at least one Syslog Report.', 'syslog') . "</span></td></tr>\n";
-		$save_html = "<input type='button' value='" . __esc('Return', 'syslog') . "' onClick='cactiReturnTo()'>";
+		$save_html = "<input type='button' value='" . __esc('Return', 'syslog') . "' class='cactiReturnTo'>";
 	}
 
 	print "<tr>
@@ -663,7 +663,7 @@ function syslog_reports_filter(): void {
 						<?php print __('Enabled', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='enabled' onChange='applyFilterReports()'>
+						<select id='enabled'>
 							<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
 							<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
 							<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
@@ -673,7 +673,7 @@ function syslog_reports_filter(): void {
 						<?php print __('Rows', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilterReports()'>
+						<select id='rows'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 								if (cacti_sizeof($item_rows)) {
diff --git a/syslog_saved_searches.php b/syslog_saved_searches.php
index 5cb4254f..98628379 100644
--- a/syslog_saved_searches.php
+++ b/syslog_saved_searches.php
@@ -222,7 +222,7 @@ function syslog_saved_search_filter() {
 						<?php print __('Rows', 'syslog'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilterSavedSearches()'>
+						<select id='rows'>
 							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
 							<?php
 							if (cacti_sizeof($item_rows)) {
@@ -378,7 +378,7 @@ function syslog_template_actions() {
 
 		$title = $export ? __esc('Export Saved Search Template(s)', 'syslog') : __esc('Delete Saved Search Template(s)', 'syslog');
 
-		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
+		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
 	} else {
 		raise_message(40);
 		header('Location: syslog_saved_searches.php');

From c3c3e734db20e069a13e32f83b2b7c1184b511bf Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Fri, 9 Oct 2026 18:04:18 -0400
Subject: [PATCH 2/2] Bind classic dropdown via data-on-change instead of an
 inline script

Addresses CSP review feedback: the per-select inline <script> would be blocked under nonce-enforced CSP. Emit the whitelisted callback as a data-on-change attribute on the select and bind it with a delegated change handler in initSyslogMain(), which survives AJAX filter reloads.
---
 js/functions.js |  6 ++++++
 syslog.php      | 10 +++-------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/js/functions.js b/js/functions.js
index 096c1640..8d6f7417 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -1283,6 +1283,12 @@ function initSyslogMain(config) {
 		$('#rows, #refresh, #removal, #grouping').change(function() {
 			applyFilter();
 		});
+
+		// Delegated so classic/autocomplete dropdowns injected via AJAX keep working
+		// without an inline per-select script under nonce-enforced CSP.
+		$(document).off('change.syslogCallback').on('change.syslogCallback', 'select[data-on-change]', function() {
+			syslogInvokeCallback($(this).attr('data-on-change'));
+		});
 	});
 }
 
diff --git a/syslog.php b/syslog.php
index 9ee433f1..4ada2d6e 100644
--- a/syslog.php
+++ b/syslog.php
@@ -2734,7 +2734,9 @@ function syslog_form_callback(string $form_name, string $classic_sql, string $co
 	$theme = get_selected_theme();
 
 	if ($theme == 'classic' || read_config_option('autocomplete') > 0) {
-		print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . '>';
+		$data_on_change = ($on_change != '' ? " data-on-change='" . html_escape($on_change) . "'" : '');
+
+		print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . $data_on_change . '>';
 
 		if (!empty($none_entry)) {
 			print "<option value='-2'" . (empty($previous_value) ? ' selected' : '') . ">$none_entry</option>";
@@ -2745,12 +2747,6 @@ function syslog_form_callback(string $form_name, string $classic_sql, string $co
 		html_create_list($form_data, $column_display, $column_id, html_escape((string) $previous_id));
 
 		print '</select>';
-
-		if ($on_change != '') {
-			// JSON_HEX_TAG escapes </script>; the other flags block HTML context escapes.
-			$js_flags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_THROW_ON_ERROR;
-			print "<script type='text/javascript'>$(function(){ $('#" . html_escape($form_name) . "').change(function(){ syslogInvokeCallback(" . json_encode($on_change, $js_flags) . "); }); });</script>";
-		}
 	} else {
 		if (empty($previous_id) && $previous_value == '') {
 			$previous_value = $none_entry;