Skip to content

security: move inline event handlers to CSP-safe bindings #392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
TheWitness wants to merge 2 commits into from
Closed

security: move inline event handlers to CSP-safe bindings #392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c961840
security: move inline event handlers to CSP-safe bindings
Oct 7, 2026
bbdba94
compat: lower the Cacti floor to 1.2.29 and document the 1.2.29-1.2.3…
Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

--- develop ---

* compat: Lower the minimum Cacti compatibility floor (INFO `compat`) from 1.2.23 to 1.2.29. On Cacti 1.2.31+ the CSP-safe `cactiReturnTo` Cancel buttons bind automatically; on 1.2.29/1.2.30 the README documents the one-time `applySkin()` snippet needed
* security: Move the syslog pages' inline event handlers to CSP-safe bindings so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive: the confirmation Cancel buttons use the `cactiReturnTo` class, and the filter selects (plus the collapse-filters toggle) are bound via a delegated handler in `js/functions.js` keyed off a `data-onchange` attribute so each select still calls its own `applyFilter*` function
* feature: Add Remote Data Collector processing, rules-sync, and record-storage options to the setup advisor; reject Aria selections whenever any collector option is enabled
* change: Use TEXT for message columns previously limited to VARCHAR(2048), including existing installations
* dev: Size the severity-legend chips to the longest label and lay them out as a CSS grid so every chip stays equal width as the legend wraps (matching the thold/monitor/servcheck/mactrack legends)
Expand Down
2 changes: 1 addition & 1 deletion INFO
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@ longname = Syslog Monitoring
author = The Cacti Group
email =
homepage = http://www.cacti.net
compat = 1.2.23
compat = 1.2.29
nosync = config.php
capabilities = online_view:1, online_mgmt:1, offline_view:1, offline_mgmt:1, remote_collect:0, remote_poller:1
16 changes: 16 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,22 @@ exercises the syslog poller end-to-end on the PHP 8.2-8.4 matrix on Linux. The
Docker E2E runner refuses unsafe temporary-directory paths before performing
recursive cleanup.

## Cacti compatibility

This plugin supports Cacti 1.2.29 and later. On Cacti 1.2.31 and later the
confirmation-page Cancel buttons work automatically. If you are running Cacti
between 1.2.29 and 1.2.31 (i.e. 1.2.29 or 1.2.30), please add the function
below to the `applySkin()` function in `include/layout.js` to enable the Cancel
buttons on forms to work:

```js
$(document).off('click.cactiReturnTo', '.cactiReturnTo')
.on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
event.preventDefault();
cactiReturnTo($(this).attr('data-url'));
});
```

## Installation

To install the syslog plugin, simply copy the plugin_syslog directory to Cacti's
Expand Down
18 changes: 18 additions & 0 deletions js/functions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1387,3 +1387,21 @@ function testSyslogRule(formSelector, dialogSelector, title) {
}
});
}

jQuery(function() {
jQuery(document).off('change.syslogFilter', '.syslogFilter')
.on('change.syslogFilter', '.syslogFilter', function() {
var fn = jQuery(this).data('onchange');

if (fn && typeof window[fn] === 'function') {
window[fn]();
}
});

jQuery(document).off('click.syslogToggle', '#syslog_search_toggle')
.on('click.syslogToggle', '#syslog_search_toggle', function() {
if (typeof toggleSyslogSearch === 'function') {
toggleSyslogSearch();
}
});
});
12 changes: 6 additions & 6 deletions syslog.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1870,7 +1870,7 @@ function syslog_filter(string $sql_where, string $tab): void {
title='<?php print __esc('Collapse filters', 'syslog'); ?>'
data-hide='<?php print __esc('Collapse filters', 'syslog'); ?>'
data-show='<?php print __esc('Edit filters', 'syslog'); ?>'
onclick='toggleSyslogSearch()'><span><?php print __esc('Collapse filters', 'syslog'); ?></span><i class='fa fa-chevron-up' aria-hidden='true'></i></button>
><span><?php print __esc('Collapse filters', 'syslog'); ?></span><i class='fa fa-chevron-up' aria-hidden='true'></i></button>
<input type='hidden' id='search_mode' value='logical'>
</div>
<div class='syslogSearchSavedBar'>
Expand Down Expand Up @@ -1939,7 +1939,7 @@ function syslog_filter(string $sql_where, string $tab): void {
</div>
<div class='syslogSearchOption syslogResultsLimit'>
<label for='rows'><?php print __('Results limit', 'syslog'); ?></label>
<select id='rows' onChange='applyFilter()' title='<?php print __esc('Display Rows', 'syslog'); ?>'>
<select id='rows' class='syslogFilter' data-onchange='applyFilter' title='<?php print __esc('Display Rows', 'syslog'); ?>'>
<option value='-1'<?php if (get_request_var('rows') == '-1') { ?> selected<?php } ?>><?php print __('Default', 'syslog'); ?></option>
<?php
foreach ($item_rows as $rows => $display_text) {
Expand All @@ -1958,7 +1958,7 @@ function syslog_filter(string $sql_where, string $tab): void {
<details id='syslog_view_options' class='syslogMenu'><summary><?php print __esc('View options', 'syslog'); ?></summary><div class='syslogMenuBody syslogSearchOptions'>
<div class='syslogSearchOption'>
<label for='refresh'><?php print __('Refresh', 'syslog'); ?></label>
<select id='refresh' onChange='applyFilter()'>
<select id='refresh' class='syslogFilter' data-onchange='applyFilter'>
<?php
foreach ($page_refresh_interval as $seconds => $display_text) {
print "<option value='" . $seconds . "'";
Expand All @@ -1975,7 +1975,7 @@ function syslog_filter(string $sql_where, string $tab): void {
<?php if (get_nfilter_request_var('tab') == 'syslog') { ?>
<div class='syslogSearchOption'>
<label for='removal'><?php print __('Record Type', 'syslog'); ?></label>
<select id='removal' onChange='applyFilter()' title='<?php print __esc('Removal Handling', 'syslog'); ?>'>
<select id='removal' class='syslogFilter' data-onchange='applyFilter' title='<?php print __esc('Removal Handling', 'syslog'); ?>'>
<option value='1'<?php if (get_request_var('removal') == '1') { ?> selected<?php } ?>><?php print __('All Records', 'syslog'); ?></option>
<option value='-1'<?php if (get_request_var('removal') == '-1') { ?> selected<?php } ?>><?php print __('Main Records', 'syslog'); ?></option>
<option value='2'<?php if (get_request_var('removal') == '2') { ?> selected<?php } ?>><?php print __('Removed Records', 'syslog'); ?></option>
Expand All @@ -1987,7 +1987,7 @@ function syslog_filter(string $sql_where, string $tab): void {
<?php if (get_nfilter_request_var('tab') == 'syslog') { ?>
<div class='syslogSearchOption'>
<label for='grouping'><?php print __('Display', 'syslog'); ?></label>
<select id='grouping' onChange='applyFilter()' title='<?php print __esc('Group Duplicate Messages', 'syslog'); ?>'>
<select id='grouping' class='syslogFilter' data-onchange='applyFilter' title='<?php print __esc('Group Duplicate Messages', 'syslog'); ?>'>
<option value='0'<?php if (get_request_var('grouping') == '0') { ?> selected<?php } ?>><?php print __('Individual Messages', 'syslog'); ?></option>
<option value='1'<?php if (get_request_var('grouping') == '1') { ?> selected<?php } ?>><?php print __('Grouped Messages', 'syslog'); ?></option>
</select>
Expand Down Expand Up @@ -2549,7 +2549,7 @@ function syslog_form_callback(string $form_name, string $classic_sql, string $co
$theme = get_selected_theme();

if ($theme == 'classic' || read_config_option('autocomplete') > 0) {
print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . ($on_change != '' ? "onChange='$on_change'" : '') . '>';
print "<select id='" . html_escape($form_name) . "' name='" . html_escape($form_name) . "'" . $class . ($on_change != '' ? " class='syslogFilter' data-onchange='" . str_replace('()', '', $on_change) . "'" : '') . '>';

if (!empty($none_entry)) {
print "<option value='-2'" . (empty($previous_value) ? ' selected' : '') . ">$none_entry</option>";
Expand Down
6 changes: 3 additions & 3 deletions syslog_alerts.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,7 @@ function form_actions(): void {
$title = __esc('Export Syslog Alert Rule(s)', 'syslog');
}

$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel', 'syslog') . "'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
} else {
raise_message(40);
header('Location: syslog_alerts.php?header=false');
Expand Down Expand Up @@ -1053,7 +1053,7 @@ function syslog_alerts_filter(): void {
<?php print __('Enabled', 'syslog'); ?>
</td>
<td>
<select id='enabled' onChange='applyFilterAlerts()'>
<select id='enabled' class='syslogFilter' data-onchange='applyFilterAlerts'>
<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
Expand All @@ -1063,7 +1063,7 @@ function syslog_alerts_filter(): void {
<?php print __('Rows', 'syslog'); ?>
</td>
<td>
<select id='rows' onChange='applyFilterAlerts()'>
<select id='rows' class='syslogFilter' data-onchange='applyFilterAlerts'>
<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
<?php
if (cacti_sizeof($item_rows)) {
Expand Down
4 changes: 2 additions & 2 deletions syslog_dashboards.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,7 @@ function syslog_dashboard_filter() {
<?php print __('Rows', 'syslog'); ?>
</td>
<td>
<select id='rows' onChange='applyFilterDashboards()'>
<select id='rows' class='syslogFilter' data-onchange='applyFilterDashboards'>
<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
<?php
if (cacti_sizeof($item_rows)) {
Expand Down Expand Up @@ -425,7 +425,7 @@ function syslog_dashboard_actions() {
$title = __esc('Export Dashboard(s)', 'syslog');
}

$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "'>&nbsp;<input type='submit' class='export cactiReturnTo' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
} else {
raise_message(40);
header('Location: syslog_dashboards.php');
Expand Down
2 changes: 1 addition & 1 deletion syslog_device_rules.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ function device_rule_actions(): void {
}
$verb = [1 => __('Delete', 'syslog'), 2 => __('Disable', 'syslog'), 3 => __('Enable', 'syslog'), 4 => __('Export', 'syslog')][(int) get_request_var('drp_action')];
print '<tr><td class="textArea"><p>' . __esc('Click Continue to %s the following Device Alert Rule(s).', strtolower($verb), 'syslog') . '</p><div class="itemlist"><ul>' . $list . '</ul></div></td></tr>';
print '<tr><td align="right" class="saveRow"><input type="hidden" name="action" value="actions"><input type="hidden" name="selected_items" value="' . html_escape(serialize($items)) . '"><input type="hidden" name="drp_action" value="' . (int) get_request_var('drp_action') . '"><input type="button" value="' . __esc('Cancel', 'syslog') . '" onClick="cactiReturnTo()">&nbsp;<input type="submit" value="' . __esc('Continue', 'syslog') . '"></td></tr>';
print '<tr><td align="right" class="saveRow"><input type="hidden" name="action" value="actions"><input type="hidden" name="selected_items" value="' . html_escape(serialize($items)) . '"><input type="hidden" name="drp_action" value="' . (int) get_request_var('drp_action') . '"><input type="button" class="cactiReturnTo" value="' . __esc('Cancel', 'syslog') . '">&nbsp;<input type="submit" value="' . __esc('Continue', 'syslog') . '"></td></tr>';
html_end_box();
form_end(false);
bottom_footer();
Expand Down
6 changes: 3 additions & 3 deletions syslog_removal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@ function form_actions(): void {
$title = __esc('Export Syslog Removal Rule(s)', 'syslog');
}

$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel', 'syslog') . "'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
} else {
raise_message(40);
header('Location: syslog_removal.php?header=false');
Expand Down Expand Up @@ -825,7 +825,7 @@ function syslog_removal_filter(): void {
<?php print __('Enabled', 'syslog'); ?>
</td>
<td>
<select id='enabled' onChange='applyFilterRemoval()'>
<select id='enabled' class='syslogFilter' data-onchange='applyFilterRemoval'>
<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
Expand All @@ -835,7 +835,7 @@ function syslog_removal_filter(): void {
<?php print __('Rules', 'syslog'); ?>
</td>
<td>
<select id='rows' onChange='applyFilterRemoval()'>
<select id='rows' class='syslogFilter' data-onchange='applyFilterRemoval'>
<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
<?php
if (cacti_sizeof($item_rows)) {
Expand Down
8 changes: 4 additions & 4 deletions syslog_reports.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,10 +220,10 @@ function form_actions(): void {
$title = __esc('Export Syslog Report Rule(s)', 'syslog');
}

$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Cancel', 'syslog') . "'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
} else {
print "<tr><td class='odd'><span class='textError'>" . __('You must select at least one Syslog Report.', 'syslog') . "</span></td></tr>\n";
$save_html = "<input type='button' value='" . __esc('Return', 'syslog') . "' onClick='cactiReturnTo()'>";
$save_html = "<input class='cactiReturnTo' type='button' value='" . __esc('Return', 'syslog') . "'>";
}

print "<tr>
Expand Down Expand Up @@ -663,7 +663,7 @@ function syslog_reports_filter(): void {
<?php print __('Enabled', 'syslog'); ?>
</td>
<td>
<select id='enabled' onChange='applyFilterReports()'>
<select id='enabled' class='syslogFilter' data-onchange='applyFilterReports'>
<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
Expand All @@ -673,7 +673,7 @@ function syslog_reports_filter(): void {
<?php print __('Rows', 'syslog'); ?>
</td>
<td>
<select id='rows' onChange='applyFilterReports()'>
<select id='rows' class='syslogFilter' data-onchange='applyFilterReports'>
<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
<?php
if (cacti_sizeof($item_rows)) {
Expand Down
4 changes: 2 additions & 2 deletions syslog_saved_searches.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ function syslog_saved_search_filter() {
<?php print __('Rows', 'syslog'); ?>
</td>
<td>
<select id='rows' onChange='applyFilterSavedSearches()'>
<select id='rows' class='syslogFilter' data-onchange='applyFilterSavedSearches'>
<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
<?php
if (cacti_sizeof($item_rows)) {
Expand Down Expand Up @@ -381,7 +381,7 @@ function syslog_template_actions() {

$title = $export ? __esc('Export Saved Search Template(s)', 'syslog') : __esc('Delete Saved Search Template(s)', 'syslog');

$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' onClick='cactiReturnTo()'>&nbsp;<input type='submit' class='export' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "'>&nbsp;<input type='submit' class='export cactiReturnTo' value='" . __esc('Continue', 'syslog') . "' title='$title'>";
} else {
raise_message(40);
header('Location: syslog_saved_searches.php');
Expand Down
Loading