security: move inline event handlers to CSP-safe bindings

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* security: Move the graph 'Add to QuickTree' icon's inline `onClick='addQuickTree()'` handler into a delegated jQuery binding in `js/quicktree.js` (via a `quicktreeAddLink` class and `data-` attributes) and replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class, so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive
 * dev: Replace the translation-template CI check that regenerated locales/po/cacti.pot and compared it with a diff-based gate (tests/bin/check-i18n-pot.php) requiring cacti.pot to be updated only when a pull request adds, removes, or modifies an i18n function call
 * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure)
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step

README.md

@@ -32,6 +32,20 @@ Known Issue: the way Cacti caches Graph Trees means that you might need to
 switch to another graph tree before the newly-created one appears in your list.
 This is true for Cacti-created trees too, so it seems to just be how it is.
 
+## Cacti compatibility
+
+If you are running a version of Cacti below 1.2.31, please add the function
+below to the `applySkin()` function in `include/layout.js` to enable the Cancel
+buttons on forms to work:
+
+```js
+$(document).off('click.cactiReturnTo', '.cactiReturnTo')
+    .on('click.cactiReturnTo', '.cactiReturnTo', function(event) {
+        event.preventDefault();
+        cactiReturnTo($(this).attr('data-url'));
+    });
+```
+
 ## History
 
 See CHANGELOG.md

js/quicktree.js

@@ -41,3 +41,11 @@ function addQuickTree(local_graph_id, rra_id) {
 		displayMessages();
 	});
 }
+
+$(function() {
+	$(document).off('click.quicktreeAdd', '.quicktreeAddLink')
+		.on('click.quicktreeAdd', '.quicktreeAddLink', function(event) {
+			event.preventDefault();
+			addQuickTree($(this).data('local-graph-id'), $(this).data('rra-id'));
+		});
+});

quicktree.php

@@ -131,7 +131,7 @@
 
 		print '<tr><td class="saveRow">
 			<input type="hidden" name="action" value="save">
-			<input type="button" value="' . __esc('Cancel') . '" onClick="cactiReturnTo()">&nbsp;<input type="submit" value="' . __esc('Continue') . '" title="' . __esc('Add To Branch', 'quicktree') . '">
+			<input type="button" class="cactiReturnTo" value="' . __esc('Cancel') . '">&nbsp;<input type="submit" value="' . __esc('Continue') . '" title="' . __esc('Add To Branch', 'quicktree') . '">
 		</td></tr>';
 
 		quicktree_action_form_end();
@@ -183,7 +183,7 @@
 
 		print '<tr><td class="saveRow">
 			<input type="hidden" name="action" value="save">
-			<input type="button" value="' . __esc('Cancel') . '" onClick="cactiReturnTo()"><input type="submit" value="' . __esc('Continue') . '" title="' . __esc('Add To Branch', 'quicktree') . '">
+			<input type="button" class="cactiReturnTo" value="' . __esc('Cancel') . '"><input type="submit" value="' . __esc('Continue') . '" title="' . __esc('Add To Branch', 'quicktree') . '">
 		</td></tr>';
 
 		quicktree_action_form_end();

setup.php

@@ -216,7 +216,7 @@ function quicktree_graph_buttons($data): void {
 		$local_graph_id = $data[1]['local_graph_id'];
 		$rra_id         = $data[1]['rra'];
 
-		print "<a class='iconLink' onClick='addQuickTree($local_graph_id, $rra_id)' title='" . __esc('Add this graph to QuickTree', 'quicktree') . "' href='#'><i class='quicktreeAdd fas fa-plus-circle'></i></a><br>";
+		print "<a class='iconLink quicktreeAddLink' data-local-graph-id='$local_graph_id' data-rra-id='$rra_id' title='" . __esc('Add this graph to QuickTree', 'quicktree') . "' href='#'><i class='quicktreeAdd fas fa-plus-circle'></i></a><br>";
 	}
 }
 

tests/Unit/QuicktreeGraphButtonsTest.php

@@ -26,7 +26,16 @@
 
 	expect($output)->toContain('quicktreeAdd');
 	expect($output)->toContain('fa-plus-circle');
-	expect($output)->toContain('addQuickTree(42, 7)');
+	expect($output)->toContain("data-local-graph-id='42'");
+	expect($output)->toContain("data-rra-id='7'");
+
+	// The delegated click binding in js/quicktree.js keys off this class, so
+	// its presence is what actually wires the glyph up once the inline
+	// handler is gone.
+	expect($output)->toContain('quicktreeAddLink');
+
+	// Guard the CSP objective: no inline event-handler attribute may return.
+	expect($output)->not->toMatch('/on[a-z]+\s*=/i');
 });
 
 it('prints nothing when the user is not authorized for the quicktree realm', function () {