Replace inline onClick/onChange handlers with jQuery bindings and cactiReturnTo class

[TheWitness]

Description

Removes all inline DOM event-handler attributes (onClick/onChange/onclick/onChange) from the Syslog plugin pages and replaces them with unobtrusive jQuery bindings, plus the Cacti cactiReturnTo class.

• Filter selects (#rows, #refresh, #removal, #grouping, #enabled) no longer carry onChange='applyFilter*()'. They are bound with .change() inside the existing initSyslog*() jQuery ready blocks in js/functions.js, alongside the handlers already registered there (#refresh, #clear, #import, form submit).
• Search filter toggle no longer uses onclick='toggleSyslogSearch()'; #syslog_search_toggle is bound via .click() in initSyslogMain().
• Classic autocomplete dropdown (syslog_form_callback()): dropped the inline onChange and route the change through the existing whitelisted syslogInvokeCallback() helper (the autocomplete branch already used it), keeping the server-provided callback identifier.
• Cancel / Return buttons (syslog_alerts.php, syslog_dashboards.php, syslog_device_rules.php, syslog_removal.php, syslog_reports.php, syslog_saved_searches.php) drop onClick='cactiReturnTo()' and use the cactiReturnTo class that the page JS already queries (saveRow.find('.cactiReturnTo')).

Motivation and Context

Inline event-handler attributes require script-src 'unsafe-inline' and conflict with a strict Content-Security-Policy. Moving them to jQuery bindings and the cactiReturnTo class aligns these pages with Cacti core conventions and the handler bindings already present in this plugin, with no change to user-visible behavior.

How Has This Been Tested?

• php -l passes on every modified PHP file.
• Verified no inline on*= handler attributes remain in production PHP (tests excluded).
• Existing js/functions.js function names referenced by unit tests are unchanged.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation repository accordingly.

[Copilot]

🟡 Changes recommended

The generated classic-dropdown binding remains an un-nonced inline script and is blocked by nonce-enforced CSP.

1 open finding

• Inline dropdown script lacks CSP nonce · New

What changed in this PR

Replaces inline DOM event handlers with jQuery bindings and Cacti return-button classes to improve CSP compatibility.

Changes:

• Moves filter and search-toggle handlers into js/functions.js.
• Replaces inline cancel handlers with cactiReturnTo.
• Routes classic dropdown callbacks through the whitelist helper.

File	Description
js/​functions.js	Adds unobtrusive filter and toggle bindings.
syslog.php	Removes inline handlers and updates callback binding.
syslog_alerts.php	Updates filters and cancel button.
syslog_dashboards.php	Updates row filter and cancel button.
syslog_device_rules.php	Updates cancel button.
syslog_removal.php	Updates filters and cancel button.
syslog_reports.php	Updates filters and return buttons.
syslog_saved_searches.php	Updates row filter and cancel button.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[TheWitness]

Pushed c3c3e73 to address the automated review.

Addressed: the classic-dropdown branch of syslog_form_callback() no longer emits an inline <script>. The whitelisted callback is now rendered as a data-on-change attribute on the <select> and bound via a delegated change handler in initSyslogMain(), so it survives AJAX filter reloads and trips no nonce-enforced CSP. The callback still flows through the existing syslogInvokeCallback() whitelist. That review thread is resolved.

CI note: the PHP 8.2 and 8.4 Integration Test failures are unrelated to this change — they failed in the Initialize containers step with Docker Hub toomanyrequests while pulling mariadb:11.8 (unauthenticated pull rate limit), before any plugin code ran. PHP 8.3 passed, as did CodeQL and the JS/Python analyses. A re-run should clear 8.2/8.4.