Repository navigation
security: move filter inline onChange handlers into ready() for CSP - #40
Merged
Merged
Conversation
The WMI Accounts and Queries filter pages each carried an inline
onChange='applyFilter()' attribute on their rows selector. Under Cacti's
Content-Security-Policy these trip the script-src-attr directive (inline
event handlers). Bind the selects in each page's existing
$(function(){...}) ready block alongside the Refresh/Clear/submit bindings
already there. Regenerated locales/po/cacti.pot for the shifted source
line references.
wmi_accounts.php and wmi_queries.php are already in the patch-coverage
gate's allowlist. The cactiReturnTo() cancel buttons are left inline
(shared Cacti-core pattern, tracked separately).
TheWitness
requested review from
bmfmancini,
browniebraun and
xmacan
and
a balanced review from Copilot
October 7, 2026 20:16
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The CSP-sensitive behavior lacks regression coverage in both patch-coverage-excluded entry points.
2 open findings
What changed in this PR
Moves filter event handlers into nonce-protected ready blocks to improve CSP compliance.
Changes:
- Removes inline
onChangehandlers from both row selectors. - Adds equivalent jQuery change bindings.
- Updates changelog and gettext metadata.
| File | Description |
|---|---|
wmi_accounts.php |
Moves the rows handler into the ready block. |
wmi_queries.php |
Moves the rows handler into the ready block. |
locales/po/cacti.pot |
Refreshes POT creation metadata. |
CHANGELOG.md |
Documents the CSP cleanup. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The confirmation pages' Cancel buttons used an inline onClick='cactiReturnTo()' handler, which trips Cacti's Content-Security-Policy script-src-attr directive. Switch them to the CSP-safe cactiReturnTo CSS class (class='cactiReturnTo', plus an optional data-url when a target is passed). Cacti 1.2.31 and later bind this class automatically. The README documents a one-time include/layout.js applySkin() snippet for operators still on an earlier release - no shim is baked into the core or the plugin.
Assert the WMI Accounts and Queries filters carry no inline onChange handler on the rows select and bind the change event from the ready block. Both files are exempt from the patch-coverage gate, so this source-level test is what catches a reintroduced inline handler.
bmfmancini
approved these changes
Oct 8, 2026
browniebraun
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the inline
onChangeevent handlers from the WMI Accounts and Queries filters so the pages no longer violate Cacti's Content-Security-Policyscript-src-attrdirective (continuing the CSP cleanup across the plugin fleet).Changes
onChange='applyFilter()'. Bound them in each page's existing$(function(){...})ready block (alongside the#refresh/#clear/form-submit bindings already there).locales/po/cacti.potfor the shifted source line references (msgid set unchanged).Both files are already in the patch-coverage gate's allowlist (web UI entry points). The
cactiReturnTo()cancel buttons are left inline — shared Cacti-core pattern, handled separately.Deferred
setup.phpstill has one inlineonClickon the account edit dialog's Cancel button ($("#cdialog").dialog("close")); it lives in a coverage-measured file, so it's deferred to a follow-up that can add the needed coverage.