diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d3a6b6..4646a93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
--- 2.1 ---
+- security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
+- security: Move the filter selects' inline onChange handlers into the ready block (bound via change, not click) so the page no longer trips Cacti's Content-Security-Policy script-src-attr directive
- refactor: Move the functions.php and gexport_security.php library files into includes/ and switch every file inclusion from include/include_once to require/require_once for fail-fast consistency (references updated across setup.php, gexport.php, poller_export.php, and the test suite)
- refactor: Move all schema management into includes/database.php (the thold model) and manage the graph_exports/graph_exports_tasks schema through Cacti's plugin table API - create with api_plugin_db_table_create() and refresh existing tables with db_update_table() from a single shared definition, replacing the raw CREATE TABLE/version-gated ALTER TABLE migrations (the one column rename is kept as a pre-step since db_update_table() can not rename)
- dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
diff --git a/README.md b/README.md
index bab7f34..bebb6bd 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,20 @@ Exports can be performed each impersonating a different users permissions. Graph
Export contents can be transferred to remote sites using FTP, SFTP, RSYNC, and
SCP.
+## Cacti compatibility
+
+If you are running a version of Cacti below 1.2.31, please add the function
+below to the `applySkin()` function in `include/layout.js` to enable the Cancel
+buttons on forms to work:
+
+```js
+$(document).off('click.cactiReturnTo', '.cactiReturnTo')
+ .on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
+ event.preventDefault();
+ cactiReturnTo($(this).attr('data-url'));
+ });
+```
+
## Installation
Install just like any other plugin, just copy it to the plugins directory,
diff --git a/gexport.php b/gexport.php
index 30596f9..393a787 100644
--- a/gexport.php
+++ b/gexport.php
@@ -312,7 +312,7 @@ function export_form_actions() {
";
- $save_html = "
+ $save_html = "
';
} elseif ($bulk_action === '2') { // disable
print "
@@ -322,7 +322,7 @@ function export_form_actions() {