security: convert cactiReturnTo cancel buttons to the CSP-safe class

[TheWitness]

Summary

Pilots the cactiReturnTo CSS-class approach for the plugin fleet's confirmation-page Cancel buttons, replacing the inline onClick='cactiReturnTo()' handlers that trip Cacti's Content-Security-Policy script-src-attr directive.

Approach (no shim in core or plugin)

• Markup switches from onClick='cactiReturnTo(url)' to class='cactiReturnTo' (plus data-url='<url>' only when a target URL is passed; the no-arg case falls back to document.referrer, which cactiReturnTo() already does).
• Cacti 1.2.31+ binds this class automatically.
• To preserve the plugin's 1.2.29 compatibility floor, the README documents a one-time include/layout.js snippet that operators on 1.2.29–1.2.30 add before upgrading. Nothing is baked into core or the plugin.

Changes

• webseer.php, webseer_servers.php, webseer_proxies.php — 8 Cancel buttons converted to class='cactiReturnTo'.
• README.md — new "Cacti 1.2.29 - 1.2.30 compatibility" section with the snippet.
• CHANGELOG.md — entry.

All three PHP files are already in the patch-coverage gate's allowlist; the edits are same-line (no source-line shift), so cacti.pot is unaffected.

Depends on the core delegated .cactiReturnTo handler landing in 1.2.31 (tracked in the core CSP issue). Until a site is on such a core, the README snippet is the bridge.

This is the pilot — once the pattern/README wording is approved, I'll roll it across the rest of the fleet.

[Copilot]

🟡 Changes recommended

Regression coverage is needed because the changed entry points are exempt from patch-coverage enforcement.

1 open finding

• Add regression tests for CSP migration controls · New

What changed in this PR

Updates confirmation-page Cancel buttons to use Cacti’s CSP-safe delegated event handler while documenting compatibility for older Cacti releases.

Changes:

• Replaces eight inline handlers with cactiReturnTo classes.
• Documents the Cacti 1.2.29–1.2.30 compatibility bridge.
• Records the security change.

File	Description
webseer.php	Converts URL action Cancel buttons.
webseer_servers.php	Converts server action Cancel buttons.
webseer_proxies.php	Converts the proxy action Cancel button.
README.md	Documents compatibility setup.
CHANGELOG.md	Records the CSP improvement.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.