From 8c49be86bf2281c6a376516175cf65a1ab7e4e4d Mon Sep 17 00:00:00 2001
From: TheWitness <larry@thewitness.org>
Date: Wed, 7 Oct 2026 16:15:57 -0400
Subject: [PATCH 1/3] security: move filter inline onChange handlers into
 ready() for CSP

The WMI Accounts and Queries filter pages each carried an inline
onChange='applyFilter()' attribute on their rows selector. Under Cacti's
Content-Security-Policy these trip the script-src-attr directive (inline
event handlers). Bind the selects in each page's existing
$(function(){...}) ready block alongside the Refresh/Clear/submit bindings
already there. Regenerated locales/po/cacti.pot for the shifted source
line references.

wmi_accounts.php and wmi_queries.php are already in the patch-coverage
gate's allowlist. The cactiReturnTo() cancel buttons are left inline
(shared Cacti-core pattern, tracked separately).
---
 CHANGELOG.md         | 1 +
 locales/po/cacti.pot | 1 +
 wmi_accounts.php     | 6 +++++-
 wmi_queries.php      | 6 +++++-
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88fa878..2a38e6a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* security: Move the WMI Accounts and Queries filter rows selects' inline onChange handlers into the ready block so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
 * security: Add a version-safe CSP nonce (`plugin_wmi_csp_nonce()`) to every inline `<script>` tag so pages stay compatible with Cacti's Content-Security-Policy nonce enforcement, while falling back cleanly on older Cacti releases that lack the `CactiSecureHeaders` class
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index c26374d..af6a14a 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,6 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti \n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
+"POT-Creation-Date: 2026-10-07 16:15-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Cacti Developers <developers@cacti.net>>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
diff --git a/wmi_accounts.php b/wmi_accounts.php
index a37a9db..8ce851d 100644
--- a/wmi_accounts.php
+++ b/wmi_accounts.php
@@ -316,7 +316,7 @@ function account_filter() {
 						<?php print __('Accounts', 'wmi'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilter()'>
+						<select id='rows'>
 							<option value='-1'<?php print (get_request_var('rows') == '-1' ? ' selected>' : '>') . __('Default', 'wmi'); ?></option>
 							<?php
 							if (sizeof($item_rows)) {
@@ -357,6 +357,10 @@ function clearFilter() {
 			}
 
 			$(function() {
+				$('#rows').change(function() {
+					applyFilter();
+				});
+
 				$('#refresh').click(function() {
 					applyFilter();
 				});
diff --git a/wmi_queries.php b/wmi_queries.php
index d01f467..61b4a7f 100644
--- a/wmi_queries.php
+++ b/wmi_queries.php
@@ -339,7 +339,7 @@ function query_filter() {
 						<?php print __('Queries', 'wmi'); ?>
 					</td>
 					<td>
-						<select id='rows' onChange='applyFilter()'>
+						<select id='rows'>
 							<option value='-1'<?php print (get_request_var('rows') == '-1' ? ' selected>' : '>') . __('Default', 'wmi'); ?></option>
 							<?php
 							if (sizeof($item_rows)) {
@@ -383,6 +383,10 @@ function clearFilter() {
 			}
 
 			$(function() {
+				$('#rows').change(function() {
+					applyFilter();
+				});
+
 				$('#refresh').click(function() {
 					applyFilter();
 				});

From f6cc4c9bd2cb1b97f48c5935e06bed3eb4035d51 Mon Sep 17 00:00:00 2001
From: TheWitness <larry@thewitness.org>
Date: Wed, 7 Oct 2026 17:11:52 -0400
Subject: [PATCH 2/3] security: convert cactiReturnTo cancel buttons to the
 CSP-safe class

The confirmation pages' Cancel buttons used an inline
onClick='cactiReturnTo()' handler, which trips Cacti's Content-Security-Policy
script-src-attr directive. Switch them to the CSP-safe cactiReturnTo CSS
class (class='cactiReturnTo', plus an optional data-url when a target is
passed).

Cacti 1.2.31 and later bind this class automatically. The README documents a
one-time include/layout.js applySkin() snippet for operators still on an
earlier release - no shim is baked into the core or the plugin.
---
 CHANGELOG.md     |  1 +
 README.md        | 14 ++++++++++++++
 wmi_accounts.php |  2 +-
 wmi_queries.php  |  4 ++--
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a38e6a..1f3f53e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
 * security: Move the WMI Accounts and Queries filter rows selects' inline onChange handlers into the ready block so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
diff --git a/README.md b/README.md
index 4dd48ef..ac141e8 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,20 @@ system (see Transports below).
 This plugin is NOT fully functional.  It should not be used on production
 systems.  Use at your own risk!
 
+## Cacti compatibility
+
+If you are running a version of Cacti below 1.2.31, please add the function
+below to the `applySkin()` function in `include/layout.js` to enable the Cancel
+buttons on forms to work:
+
+```js
+$(document).off('click.cactiReturnTo', '.cactiReturnTo')
+    .on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
+        event.preventDefault();
+        cactiReturnTo($(this).attr('data-url'));
+    });
+```
+
 ## Installation
 
 To install the plugin, simply copy the plugin_wmi directory to Cacti's plugins
diff --git a/wmi_accounts.php b/wmi_accounts.php
index 8ce851d..2c26628 100644
--- a/wmi_accounts.php
+++ b/wmi_accounts.php
@@ -191,7 +191,7 @@ function actions_accounts() {
 			<input type='hidden' name='action' value='actions'>
 			<input type='hidden' name='selected_items' value='" . (isset($account_array) ? serialize($account_array) : '') . "'>
 			<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
-			<input type='button' value='" . __('Cancel', 'wmi') . "' onClick='cactiReturnTo()'>
+			<input class='cactiReturnTo' type='button' value='" . __('Cancel', 'wmi') . "'>
 			$save_html
 		</td>
 	</tr>";
diff --git a/wmi_queries.php b/wmi_queries.php
index 61b4a7f..807bff2 100644
--- a/wmi_queries.php
+++ b/wmi_queries.php
@@ -208,9 +208,9 @@ function actions_queries() {
 
 	if (!isset($query_array)) {
 		print "<tr><td class='odd'><span class='textError'>" . __('You must select at least one WMI Query.', 'wmi') . '</span></td></tr>';
-		$save_html = "<input type='button' value='" . __('Return', 'wmi') . "' onClick='cactiReturnTo()'>";
+		$save_html = "<input class='cactiReturnTo' type='button' value='" . __('Return', 'wmi') . "'>";
 	} else {
-		$save_html = "<input type='button' value='" . __('Cancel', 'wmi') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __('Continue', 'wmi') . "' title='" . __('Delete WMI Query', 'wmi') . "'>";
+		$save_html = "<input class='cactiReturnTo' type='button' value='" . __('Cancel', 'wmi') . "'>&nbsp;<input type='submit' value='" . __('Continue', 'wmi') . "' title='" . __('Delete WMI Query', 'wmi') . "'>";
 	}
 
 	print "<tr>

From 48f6e06049aac822352533fa91c1aeb6e8cd4c21 Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Wed, 7 Oct 2026 18:25:16 -0400
Subject: [PATCH 3/3] test: add CSP filter rows-select regression coverage

Assert the WMI Accounts and Queries filters carry no inline onChange handler on the rows select and bind the change event from the ready block. Both files are exempt from the patch-coverage gate, so this source-level test is what catches a reintroduced inline handler.
---
 tests/Security/CspFilterHandlersTest.php | 37 ++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 tests/Security/CspFilterHandlersTest.php

diff --git a/tests/Security/CspFilterHandlersTest.php b/tests/Security/CspFilterHandlersTest.php
new file mode 100644
index 0000000..efc639c
--- /dev/null
+++ b/tests/Security/CspFilterHandlersTest.php
@@ -0,0 +1,37 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Regression coverage for the CSP migration of the WMI Accounts and Queries
+ * filter "rows" selects. Both entry points are excluded from the patch-
+ * coverage gate, so without this source-level assertion CI would not catch a
+ * reintroduced inline `onChange='applyFilter()'` handler (which trips Cacti's
+ * Content-Security-Policy script-src-attr directive) or a lost ready-block
+ * binding.
+ */
+
+$filter_files = array('wmi_accounts.php', 'wmi_queries.php');
+
+foreach ($filter_files as $file) {
+	describe("csp filter handler migration in {$file}", function () use ($file) {
+		$source = plugin_test_read_source($file);
+
+		it('has no inline onChange handler on the rows select', function () use ($source, $file) {
+			expect($source)->not->toMatch('/<select\s+id=[\'"]rows[\'"][^>]*\sonChange\s*=/i', "{$file} still has an inline onChange handler on the rows select");
+		});
+
+		it('has no inline applyFilter onChange handler anywhere', function () use ($source, $file) {
+			expect($source)->not->toMatch('/onChange\s*=\s*[\'"]applyFilter\(/i', "{$file} still contains an inline applyFilter onChange handler");
+		});
+
+		it('binds the rows select change event from the ready block', function () use ($source, $file) {
+			expect($source)->toMatch('/\$\(\s*[\'"]#rows[\'"]\s*\)\s*\.change\s*\(/', "{$file} does not bind #rows change() from the ready block");
+		});
+	});
+}