Skip to content

security: move filter inline onChange handlers into ready() for CSP #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 2 commits into from
Oct 8, 2026
Merged

security: move filter inline onChange handlers into ready() for CSP #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
741fb68
security: move filter inline onChange handlers into ready() for CSP
Oct 7, 2026
8677bb9
security: convert cactiReturnTo cancel buttons to the CSP-safe class
Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

--- 2.1 ---

- security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
- security: Move the filter selects' inline onChange handlers into the ready block (bound via change, not click) so the page no longer trips Cacti's Content-Security-Policy script-src-attr directive
- refactor: Move the functions.php and gexport_security.php library files into includes/ and switch every file inclusion from include/include_once to require/require_once for fail-fast consistency (references updated across setup.php, gexport.php, poller_export.php, and the test suite)
- refactor: Move all schema management into includes/database.php (the thold model) and manage the graph_exports/graph_exports_tasks schema through Cacti's plugin table API - create with api_plugin_db_table_create() and refresh existing tables with db_update_table() from a single shared definition, replacing the raw CREATE TABLE/version-gated ALTER TABLE migrations (the one column rename is kept as a pre-step since db_update_table() can not rename)
- dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
Expand Down
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,20 @@ Exports can be performed each impersonating a different users permissions. Graph
Export contents can be transferred to remote sites using FTP, SFTP, RSYNC, and
SCP.

## Cacti compatibility

If you are running a version of Cacti below 1.2.31, please add the function
below to the `applySkin()` function in `include/layout.js` to enable the Cancel
buttons on forms to work:

```js
$(document).off('click.cactiReturnTo', '.cactiReturnTo')
.on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
event.preventDefault();
cactiReturnTo($(this).attr('data-url'));
});
```

## Installation

Install just like any other plugin, just copy it to the plugins directory,
Expand Down
18 changes: 9 additions & 9 deletions gexport.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,7 +312,7 @@ function export_form_actions() {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Cancel', 'gexport') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Cancel', 'gexport') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Delete Graph Export Definition(s)', 'gexport') . "'>" . __esc('Continue', 'gexport') . '</button>';
} elseif ($bulk_action === '2') { // disable
print " <tr>
Expand All @@ -322,7 +322,7 @@ function export_form_actions() {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Cancel', 'gexport') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Cancel', 'gexport') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Disable Graph Export Definition(s)', 'gexport') . "'>" . __esc('Continue', 'gexport') . '</button>';
} elseif ($bulk_action === '3') { // enable
print " <tr>
Expand All @@ -332,7 +332,7 @@ function export_form_actions() {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Cancel', 'gexport') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Cancel', 'gexport') . "</button>
<input type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Enable Graph Export Definition(s)', 'gexport') . "'>" . __esc('Continue', 'gexport') . '</button>';
} elseif ($bulk_action === '4') { // export now
print "<tr>
Expand All @@ -342,15 +342,15 @@ function export_form_actions() {
</td>
</tr>";

$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Cancel', 'gexport') . "</button>
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Cancel', 'gexport') . "</button>
<button type='submit' class='ui-button ui-corner-all ui-widget ui-state-active' title='" . __esc('Run Graph Export Definition(s) Now', 'gexport') . "'>" . __esc('Continue', 'gexport') . '</button>';
} else {
print "<tr><td class='odd'><span class='textError'>" . __('You must select a valid action.', 'gexport') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Return', 'gexport') . '</button>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Return', 'gexport') . '</button>';
}
} else {
print "<tr><td class='odd'><span class='textError'>" . __('You must select at least one Graph Export Definition.', 'gexport') . '</span></td></tr>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo()'>" . __esc('Return', 'gexport') . '</button>';
$save_html = "<button type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo'>" . __esc('Return', 'gexport') . '</button>';
}

print "<tr>
Expand Down Expand Up @@ -697,7 +697,7 @@ function export_filter() {
<?php print __('Exports', 'gexport'); ?>
</td>
<td>
<select id='rows' onChange='applyFilter()'>
<select id='rows'>
<option value='-1'<?php print (get_request_var('rows') == '-1' ? ' selected>' : '>') . __('Default', 'gexport'); ?></option>
<?php
if (sizeof($item_rows)) {
Expand All @@ -716,7 +716,7 @@ function export_filter() {
<?php print __('Refresh', 'gexport'); ?>
</td>
<td>
<select id='refresh' onChange='applyFilter()'>
<select id='refresh'>
<?php
$frequency = [
99999999 => __('Never', 'gexport'),
Expand Down Expand Up @@ -759,7 +759,7 @@ function clearFilter() {
}

$(function() {
$('#refresh').click(function() {
$('#rows, #refresh').change(function() {
applyFilter();
});

Expand Down
2 changes: 1 addition & 1 deletion locales/po/cacti.pot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ msgid ""
msgstr ""
"Project-Id-Version: Cacti \n"
"Report-Msgid-Bugs-To: developers@cacti.net\n"
"POT-Creation-Date: 2026-09-29 21:21-0400\n"
"POT-Creation-Date: 2026-10-07 16:13-0400\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: Cacti Developers <developers@cacti.net>>\n"
"Language-Team: Cacti Developers <developers@cacti.net>\n"
Expand Down
Loading