From c961840368c5f7464c71b3e551d83f1a7c82ece4 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Wed, 7 Oct 2026 18:46:14 -0400 Subject: [PATCH 1/2] security: move inline event handlers to CSP-safe bindings Cacti's Content-Security-Policy script-src-attr directive blocks inline event-handler attributes. This converts syslog's remaining inline handlers: - The confirmation-page Cancel/Return buttons across syslog_alerts.php, syslog_dashboards.php, syslog_device_rules.php, syslog_removal.php, syslog_reports.php and syslog_saved_searches.php switch from onClick='cactiReturnTo()' to the CSP-safe cactiReturnTo class. - The filter selects on every page (and the syslog_form_callback-generated program select) drop their inline onChange='applyFilterX()' for a syslogFilter class + data-onchange attribute naming the function; a single delegated handler in js/functions.js reads data-onchange and calls the same function, so each page keeps its own applyFilter/applyFilterAlerts/ applyFilterRemoval/applyFilterReports/applyFilterDashboards/ applyFilterSavedSearches behaviour. - The collapse-filters toggle button drops its inline onclick in favour of a delegated #syslog_search_toggle click binding. All changed pages are already in the patch-coverage allowlist. No i18n calls changed, so cacti.pot is untouched. Cacti 1.2.31+ binds the cactiReturnTo class automatically; the README documents a one-time applySkin() snippet for earlier releases. --- CHANGELOG.md | 1 + README.md | 14 ++++++++++++++ js/functions.js | 18 ++++++++++++++++++ syslog.php | 12 ++++++------ syslog_alerts.php | 6 +++--- syslog_dashboards.php | 4 ++-- syslog_device_rules.php | 2 +- syslog_removal.php | 6 +++--- syslog_reports.php | 8 ++++---- syslog_saved_searches.php | 4 ++-- 10 files changed, 54 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c95a8c6..979068b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ --- develop --- +* security: Move the syslog pages' inline event handlers to CSP-safe bindings so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive: the confirmation Cancel buttons use the `cactiReturnTo` class, and the filter selects (plus the collapse-filters toggle) are bound via a delegated handler in `js/functions.js` keyed off a `data-onchange` attribute so each select still calls its own `applyFilter*` function * feature: Add Remote Data Collector processing, rules-sync, and record-storage options to the setup advisor; reject Aria selections whenever any collector option is enabled * change: Use TEXT for message columns previously limited to VARCHAR(2048), including existing installations * dev: Size the severity-legend chips to the longest label and lay them out as a CSS grid so every chip stays equal width as the legend wraps (matching the thold/monitor/servcheck/mactrack legends) diff --git a/README.md b/README.md index 265e7f3f..afe4b436 100644 --- a/README.md +++ b/README.md @@ -129,6 +129,20 @@ exercises the syslog poller end-to-end on the PHP 8.2-8.4 matrix on Linux. The Docker E2E runner refuses unsafe temporary-directory paths before performing recursive cleanup. +## Cacti compatibility + +If you are running a version of Cacti below 1.2.31, please add the function +below to the `applySkin()` function in `include/layout.js` to enable the Cancel +buttons on forms to work: + +```js +$(document).off('click.cactiReturnTo', '.cactiReturnTo') + .on('click.cactiReturnTo', '.cactiReturnTo', function(event) { + event.preventDefault(); + cactiReturnTo($(this).attr('data-url')); + }); +``` + ## Installation To install the syslog plugin, simply copy the plugin_syslog directory to Cacti's diff --git a/js/functions.js b/js/functions.js index 9c81ef16..c92a7cd6 100644 --- a/js/functions.js +++ b/js/functions.js @@ -1387,3 +1387,21 @@ function testSyslogRule(formSelector, dialogSelector, title) { } }); } + +jQuery(function() { +jQuery(document).off('change.syslogFilter', '.syslogFilter') +.on('change.syslogFilter', '.syslogFilter', function() { +var fn = jQuery(this).data('onchange'); + +if (fn && typeof window[fn] === 'function') { +window[fn](); +} +}); + +jQuery(document).off('click.syslogToggle', '#syslog_search_toggle') +.on('click.syslogToggle', '#syslog_search_toggle', function() { +if (typeof toggleSyslogSearch === 'function') { +toggleSyslogSearch(); +} +}); +}); \ No newline at end of file diff --git a/syslog.php b/syslog.php index 44fbc7d0..cfce6eed 100644 --- a/syslog.php +++ b/syslog.php @@ -1870,7 +1870,7 @@ function syslog_filter(string $sql_where, string $tab): void { title='' data-hide='' data-show='' - onclick='toggleSyslogSearch()'> + >
@@ -1939,7 +1939,7 @@ function syslog_filter(string $sql_where, string $tab): void {
- '> $display_text) { @@ -1958,7 +1958,7 @@ function syslog_filter(string $sql_where, string $tab): void {
- $display_text) { print "