mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
Thomas Vincent
d4e255b5d9
* security: add nonce CSP mode for inline JavaScript protection Reworks the content_security_policy_script setting into a three-mode Inline JavaScript Protection dropdown (HTMLX default, Nonce, None) and ports the per-request nonce, strict-dynamic policy, and CSP violation report endpoint from 1.2.x. The stored option key and its default are unchanged, so existing installs keep their current policy byte-for-byte; nonce mode is opt-in. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * security: stage nonce CSP enforcement safely Add report-only migration, gated enforcement, nonce-aware shared emitters, Linux Docker validation, and operator documentation.\n\nRefs #7703 * security: validate CSP header sources Reject malformed alternate-source configurations at the CSP boundary, validate fallback report URIs, and remove the obsolete Psalm header-taint baseline entry.\n\nRefs #7705 * chore: drop the composer.json change from this PR Dependency and manifest changes are a maintainer call and do not belong in this one. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
60 lines
3.0 KiB
PHP
60 lines
3.0 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
global $config, $menu, $is_request_ajax;
|
|
|
|
$page_title = api_plugin_hook_function('page_title', draw_navigation_text('title'));
|
|
$using_guest_account = false;
|
|
|
|
if (!$is_request_ajax) {?>
|
|
<!DOCTYPE html>
|
|
<html lang='<?php print CACTI_LOCALE; ?>'>
|
|
<head>
|
|
<?php html_common_header($page_title); ?>
|
|
</head>
|
|
<body>
|
|
<a class='skip-link' href='#main' style='display:none'>Skip to main</a>
|
|
<div id='cactiPageHead' class='cactiPageHead' role='banner'>
|
|
<div id='tabs'><?php html_show_tabs_left(); ?></div>
|
|
<div class='cactiGraphHeaderBackground' style='display:none'><div id='gtabs'><?php html_graph_tabs_right(); ?></div></div>
|
|
<div class='cactiConsolePageHeadBackdrop'></div>
|
|
</div>
|
|
<div id='breadCrumbBar' class='breadCrumbBar'>
|
|
<div id='navBar' class='navBar'><?php print draw_navigation_text(); ?></div>
|
|
<div class='scrollBar'></div>
|
|
<div class='infoBar'><?php draw_login_status($using_guest_account); ?></div>
|
|
</div>
|
|
<div class='cactiShadow'></div>
|
|
<?php } else {?>
|
|
<div id='navBar' class='navBar'><?php print draw_navigation_text(); ?></div>
|
|
<title><?php print $page_title; ?></title>
|
|
<?php } ?>
|
|
<div id='cactiContent' class='cactiContent'>
|
|
<div class='cactiConsoleNavigationArea' style='display:none;' id='navigation'>
|
|
<?php draw_menu(); ?>
|
|
<a class='cactiLogo' href='<?php print CACTI_PATH_URL; ?>about.php' aria-label='<?php print __esc('About Cacti'); ?>'></a>
|
|
</div>
|
|
<div id='navigation_right' class='cactiConsoleContentArea'>
|
|
<main id='main'>
|