Skip to content

Make admin UI CSP-compatible (nonce inline scripts, drop inline onclick) #477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dereuromark merged 1 commit into from
Apr 22, 2026
Merged

Make admin UI CSP-compatible (nonce inline scripts, drop inline onclick) #477

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 32 additions & 20 deletions templates/Admin/Queue/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,38 +188,44 @@
</td>
<td>
<?php if ($this->Queue->hasFailed($pendingJob)): ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-redo"></i>',
['action' => 'resetJob', $pendingJob->id],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-primary',
'confirm' => __d('queue', 'Sure?'),
'title' => __d('queue', 'Reset'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash"></i>',
['action' => 'removeJob', $pendingJob->id],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-danger',
'confirm' => __d('queue', 'Sure?'),
'title' => __d('queue', 'Remove'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php elseif ($pendingJob->fetched): ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash"></i>',
['action' => 'removeJob', $pendingJob->id],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-danger',
'confirm' => __d('queue', 'Sure?'),
'title' => __d('queue', 'Remove'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php endif; ?>
Expand Down Expand Up @@ -276,15 +282,17 @@
<?php endif; ?>
</td>
<td>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash"></i>',
['action' => 'removeJob', $scheduledJob->id],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-danger',
'confirm' => __d('queue', 'Sure?'),
'title' => __d('queue', 'Remove'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
</td>
Expand Down Expand Up @@ -365,15 +373,17 @@
}
?>
<?php $description = $taskDescriptions[$task] ?? null; ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-plus me-1"></i>' . h($task),
['action' => 'addJob', '?' => ['task' => $task]],
[
'escapeTitle' => false,
'class' => 'btn btn-outline-primary btn-sm text-start',
'confirm' => __d('queue', 'Sure?'),
'class' => 'btn btn-outline-primary btn-sm text-start w-100',
'title' => $description,
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php endforeach; ?>
Expand Down Expand Up @@ -402,15 +412,17 @@
continue;
} ?>
<?php $description = $taskDescriptions[$task] ?? null; ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-flask me-1"></i>' . h($task),
['action' => 'addJob', '?' => ['task' => $task]],
[
'escapeTitle' => false,
'class' => 'btn btn-outline-secondary btn-sm text-start',
'confirm' => __d('queue', 'Sure?'),
'class' => 'btn btn-outline-secondary btn-sm text-start w-100',
'title' => $description,
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php endforeach; ?>
Expand Down
16 changes: 10 additions & 6 deletions templates/Admin/Queue/processes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,28 +55,32 @@
</div>

<div class="d-flex gap-2">
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-stop me-1"></i>' . __d('queue', 'Finish & End'),
['action' => 'processes', '?' => ['end' => $process->pid]],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-warning',
'confirm' => __d('queue', 'Sure?'),
'title' => __d('queue', 'Finish current job and end worker'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>

<?php if ($process->workerkey === $key || !$this->Configure->read('Queue.multiserver')): ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-skull me-1"></i>' . __d('queue', 'Kill'),
['action' => 'processes', '?' => ['kill' => $process->pid]],
[
'escapeTitle' => false,
'class' => 'btn btn-sm btn-outline-danger',
'confirm' => __d('queue', 'Sure? This sends SIGTERM to the process.'),
'title' => __d('queue', 'Send SIGTERM to terminate immediately'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure? This sends SIGTERM to the process.'),
],
]
) ?>
<?php endif; ?>
Expand Down
16 changes: 10 additions & 6 deletions templates/Admin/QueueProcesses/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,16 @@
['controller' => 'Queue', 'action' => 'processes'],
['class' => 'btn btn-outline-primary btn-sm', 'escapeTitle' => false],
) ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-broom me-1"></i>' . __d('queue', 'Cleanup'),
['action' => 'cleanup'],
[
'class' => 'btn btn-outline-warning btn-sm',
'escapeTitle' => false,
'confirm' => __d('queue', 'Sure to remove all outdated ones (>{0}s)?', Config::defaultworkertimeout() * 2),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure to remove all outdated ones (>{0}s)?', Config::defaultworkertimeout() * 2),
],
],
) ?>
</div>
Expand Down Expand Up @@ -101,16 +103,18 @@
],
) ?>
<?php if (!$queueProcess->terminate) : ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-times"></i>',
['action' => 'terminate', $queueProcess->id],
[
'escapeTitle' => false,
'class' => 'btn btn-outline-warning',
'confirm' => __d('queue', 'Are you sure you want to terminate # {0}?', $queueProcess->id),
'title' => __d('queue', 'Terminate'),
'aria-label' => __d('queue', 'Terminate'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to terminate # {0}?', $queueProcess->id),
],
],
) ?>
<?php endif; ?>
Expand Down
20 changes: 12 additions & 8 deletions templates/Admin/QueueProcesses/view.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,25 +80,29 @@
['class' => 'list-group-item list-group-item-action', 'escapeTitle' => false]
) ?>
<?php if (!$queueProcess->terminate): ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-times me-2"></i>' . __d('queue', 'Terminate (Graceful)'),
['action' => 'terminate', $queueProcess->id],
[
'class' => 'list-group-item list-group-item-action text-warning',
'class' => 'list-group-item list-group-item-action text-warning btn btn-link text-start w-100',
'escapeTitle' => false,
'confirm' => __d('queue', 'Are you sure you want to terminate # {0}?', $queueProcess->id),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to terminate # {0}?', $queueProcess->id),
],
]
) ?>
<?php else: ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash me-2"></i>' . __d('queue', 'Delete (Force)'),
['action' => 'delete', $queueProcess->id],
[
'class' => 'list-group-item list-group-item-action text-danger',
'class' => 'list-group-item list-group-item-action text-danger btn btn-link text-start w-100',
'escapeTitle' => false,
'confirm' => __d('queue', 'Are you sure you want to delete # {0}?', $queueProcess->id),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to delete # {0}?', $queueProcess->id),
],
]
) ?>
<?php endif; ?>
Expand Down
10 changes: 6 additions & 4 deletions templates/Admin/QueuedJobs/edit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,16 @@
['action' => 'data', $queuedJob->id],
['class' => 'list-group-item list-group-item-action', 'escapeTitle' => false]
) ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash me-2"></i>' . __d('queue', 'Delete Job'),
['action' => 'delete', $queuedJob->id],
[
'class' => 'list-group-item list-group-item-action text-danger',
'class' => 'list-group-item list-group-item-action text-danger btn btn-link text-start w-100',
'escapeTitle' => false,
'confirm' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
],
]
) ?>
</div>
Expand Down
8 changes: 5 additions & 3 deletions templates/Admin/QueuedJobs/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,16 +216,18 @@
]
) ?>
<?php endif; ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash"></i>',
['action' => 'delete', $queuedJob->id],
[
'escapeTitle' => false,
'class' => 'btn btn-outline-danger',
'confirm' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
'title' => __d('queue', 'Delete'),
'aria-label' => __d('queue', 'Delete'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
],
]
) ?>
</div>
Expand Down
3 changes: 2 additions & 1 deletion templates/Admin/QueuedJobs/stats.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,8 @@
?>

<?php $this->append('script'); ?>
<script>
<?php $cspNonce = (string)$this->getRequest()->getAttribute('cspNonce', ''); ?>
<script<?= $cspNonce !== '' ? ' nonce="' . h($cspNonce) . '"' : '' ?>>
document.addEventListener('DOMContentLoaded', function() {
var chartCanvas = document.getElementById('job-chart');
if (!chartCanvas) return;
Expand Down
32 changes: 20 additions & 12 deletions templates/Admin/QueuedJobs/view.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,16 @@
['class' => 'btn btn-outline-primary', 'escapeTitle' => false]
) ?>
<?php else: ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-copy me-1"></i>' . __d('queue', 'Clone & Re-run'),
['action' => 'clone', $queuedJob->id],
[
'class' => 'btn btn-outline-success',
'escapeTitle' => false,
'confirm' => __d('queue', 'Sure?'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php endif; ?>
Expand All @@ -37,14 +39,16 @@
['action' => 'view', $queuedJob->id, '_ext' => 'json', '?' => ['download' => true]],
['class' => 'btn btn-outline-secondary', 'escapeTitle' => false]
) ?>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-trash me-1"></i>' . __d('queue', 'Delete'),
['action' => 'delete', $queuedJob->id],
[
'class' => 'btn btn-outline-danger',
'escapeTitle' => false,
'confirm' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Are you sure you want to delete # {0}?', $queuedJob->id),
],
]
) ?>
</div>
Expand Down Expand Up @@ -306,26 +310,30 @@
<!-- Actions -->
<?php if ($this->Queue->hasFailed($queuedJob)): ?>
<hr>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-redo me-1"></i>' . __d('queue', 'Soft Reset'),
['controller' => 'Queue', 'action' => 'resetJob', $queuedJob->id],
[
'class' => 'btn btn-primary w-100',
'escapeTitle' => false,
'confirm' => __d('queue', 'Sure?'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure?'),
],
]
) ?>
<?php elseif (!$queuedJob->completed && $queuedJob->fetched && $queuedJob->attempts && $queuedJob->failure_message): ?>
<hr>
<?= $this->Form->postLink(
<?= $this->Form->postButton(
'<i class="fas fa-redo me-1"></i>' . __d('queue', 'Force Reset'),
['controller' => 'Queue', 'action' => 'resetJob', $queuedJob->id],
[
'class' => 'btn btn-warning w-100',
'escapeTitle' => false,
'confirm' => __d('queue', 'Sure? This job is currently waiting to be re-queued.'),
'block' => true,
'form' => [
'class' => 'd-inline',
'data-confirm-message' => __d('queue', 'Sure? This job is currently waiting to be re-queued.'),
],
]
) ?>
<?php endif; ?>
Expand Down
Loading
Loading