security: move inline event handlers to CSP-safe bindings

[TheWitness]

Summary

Removes the plugin's remaining inline event-handler attributes so pages comply with Cacti's Content-Security-Policy script-src-attr directive. Part of the fleet-wide CSP inline-handler cleanup. Every control is bound in its view's existing ready block to the same function the inline handler already called, so behavior is unchanged.

Changes

• mikrotik.php — across all ten filter views, the device/rows/type/status/list selects, active/sincereset checkboxes, and Go/Clear/Export buttons drop their inline onChange/onClick and are bound to applyFilter/clearFilter/exportData.
• mikrotik_users.php — the type/rows/status selects and Go/Clear buttons are bound the same way; the confirmation Cancel/Return buttons switch from onClick='cactiReturnTo()' to the CSP-safe cactiReturnTo class.

Gate / coverage

mikrotik.php and mikrotik_users.php are web UI entry points (chdir + include auth.php, top-level execution) that cannot be loaded into the isolated unit process, so their rendered HTML lines are not coverable — the harness already eval-isolates their pure helpers via mikrotik_test_load_function(), which records coverage against an eval()'d code pseudo-file rather than these files. They therefore move from the phpunit measured <source> set into the patch-coverage allowlist, matching how every other plugin in the fleet treats its UI entry points. Their pure helper functions remain exercised by the existing unit tests. No __()/__esc() calls changed, so check-i18n-pot.php passes without regenerating cacti.pot.

Compatibility

Cacti 1.2.31+ binds the cactiReturnTo class automatically. The README documents a one-time applySkin() snippet for earlier releases. No shim is baked into core or the plugin.

[Copilot]

🔵 Needs a closer look

Event-handler preservation needs correction, and browser validation remains necessary for CSP, AJAX navigation, and legacy compatibility.

1 open finding

• Avoid removing Select2 change listeners when rebinding filters · New

What changed in this PR

Moves the MikroTik plugin’s UI controls from inline event handlers to bindings compatible with Cacti’s Content Security Policy.

Changes:

• Binds filter controls through jQuery and confirmation navigation through cactiReturnTo.
• Documents compatibility steps for Cacti versions below 1.2.31.
• Excludes UI entry points from measured coverage while retaining helper tests.

File	Description
tests/​bin/​patch-coverage.php	Allowlists unmeasured UI entry points.
README.md	Documents legacy navigation compatibility.
phpunit.xml	Removes UI entry points from measured sources.
mikrotik.php	Rebinds controls across ten filter views.
mikrotik_users.php	Rebinds filters and confirmation navigation.
CHANGELOG.md	Records CSP and coverage changes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bmfmancini]

Reviewed the CSP-safe event bindings; behavior is preserved and checks pass.

[bmfmancini]

Reviewed the CSP-safe event bindings; behavior is preserved and checks pass.