From c98b7f544bfce57c4b69aae3fb81bce27213a841 Mon Sep 17 00:00:00 2001
From: Rom1-B <8530352+Rom1-B@users.noreply.github.com>
Date: Fri, 13 Nov 2026 10:48:33 +0100
Subject: [PATCH] feat: make plugin CSP compliant

---
 setup.php                                    |  1 +
 src/Config.php                               | 11 ++++++-----
 src/Source_Zone.php                          | 12 +++++++++++-
 templates/config.html.twig                   | 12 ++++++++----
 templates/environmentalimpact-item.html.twig | 16 ++++++++--------
 5 files changed, 34 insertions(+), 18 deletions(-)

diff --git a/setup.php b/setup.php
index 9505e77f..e90dc20a 100644
--- a/setup.php
+++ b/setup.php
@@ -196,6 +196,7 @@ function plugin_version_carbon()
         'author'         => '<a href="http://www.teclib.com">Teclib\'</a>',
         'license'        => 'GPLv3',
         'homepage'       => '',
+        'csp_compliant'  => true,
         'requirements'   => [
             'glpi' => [
                 'min' => PLUGIN_CARBON_MIN_GLPI_VERSION,
diff --git a/src/Config.php b/src/Config.php
index 043657e8..63bd1a98 100644
--- a/src/Config.php
+++ b/src/Config.php
@@ -45,7 +45,6 @@
 use GlpiPlugin\Carbon\DataSource\Lca\ClientFactory as LcaClientFactory;
 use GlpiPlugin\Carbon\Impact\Embodied\Engine;
 use GuzzleHttp\Client;
-use Html;
 use Monitor as GlpiMonitor;
 use NetworkEquipment as GlpiNetworkEquipment;
 use Override;
@@ -132,8 +131,8 @@ public function showForm($ID, $options = [])
             '_glpi_csrf_token' => Session::getNewCSRFToken(),
             'reset_all'        => '',
         ]);
-        $usage_impact_action_url    = 'submitGetLink("' . $CFG_GLPI['root_doc'] . '/plugins/carbon/front/usageimpact.form.php", ' . $reset_args . ')';
-        $embodied_impact_action_url = 'submitGetLink("' . $CFG_GLPI['root_doc'] . '/plugins/carbon/front/embodiedimpact.form.php", ' . $reset_args . ')';
+        $usage_impact_action_url    = $CFG_GLPI['root_doc'] . '/plugins/carbon/front/usageimpact.form.php';
+        $embodied_impact_action_url = $CFG_GLPI['root_doc'] . '/plugins/carbon/front/embodiedimpact.form.php';
 
         $renderer = TemplateRenderer::getInstance();
         $environment = $renderer->getEnvironment();
@@ -147,8 +146,10 @@ public function showForm($ID, $options = [])
             'impact_engines'             => Engine::getAvailableBackends(),
             'include_configs'            => $include_configs,
             'action'                     => (isset($options['plugin_config']) ? Config::getFormURL() : GlpiConfig::getFormURL()),
-            'usage_impact_action_url'    => Html::getConfirmationOnActionScript($confirm_message, $usage_impact_action_url),
-            'embodied_impact_action_url' => Html::getConfirmationOnActionScript($confirm_message, $embodied_impact_action_url),
+            'confirm_message'            => $confirm_message,
+            'reset_args'                 => $reset_args,
+            'usage_impact_action_url'    => $usage_impact_action_url,
+            'embodied_impact_action_url' => $embodied_impact_action_url,
         ]);
 
         return true;
diff --git a/src/Source_Zone.php b/src/Source_Zone.php
index a3d7fd07..dbe20eba 100644
--- a/src/Source_Zone.php
+++ b/src/Source_Zone.php
@@ -211,6 +211,11 @@ public static function showForSource(CommonDBTM $item)
                         reloadTab();
                     });
                 };
+                document.querySelectorAll("[data-carbon-toggle-zone]").forEach(function (button) {
+                    button.addEventListener("click", function () {
+                        plugin_carbon_toggleZone(button.dataset.carbonToggleZone);
+                    });
+                });
             ');
         }
     }
@@ -314,6 +319,11 @@ public static function showForZone(CommonDBTM $item)
                         reloadTab();
                     });
                 };
+                document.querySelectorAll("[data-carbon-toggle-zone]").forEach(function (button) {
+                    button.addEventListener("click", function () {
+                        plugin_carbon_toggleZone(button.dataset.carbonToggleZone);
+                    });
+                });
             ');
         }
     }
@@ -428,7 +438,7 @@ public function getFallbackFromDB(Source_Zone $source_zone): bool
     protected static function getToggleLink(int $zone_id, ?string $state): string
     {
         $state = $state == 0 ? __('No') : __('Yes');
-        $link = '<a href="javascript:void(0)" onclick="plugin_carbon_toggleZone(' . $zone_id . ')" title="' . __('Enable / Disable', 'carbon') . '">' . $state . '</a>';
+        $link = '<button type="button" class="btn-as-link" data-carbon-toggle-zone="' . $zone_id . '" title="' . __('Enable / Disable', 'carbon') . '">' . $state . '</button>';
         return $link;
     }
 
diff --git a/templates/config.html.twig b/templates/config.html.twig
index 3f688a71..bb5124a7 100644
--- a/templates/config.html.twig
+++ b/templates/config.html.twig
@@ -79,8 +79,10 @@
                     <tr>
                         <td>{{ __('Reset usage impacts. This will delete all calculated usage impacts for all assets.', 'carbon') }}</td>
                         <td class="text-end">
-                            {% set reset_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', reset_all: ''}" %}
-                            <a class="btn btn-outline-warning me-2" onclick='{{ usage_impact_action_url|raw }};'>
+                            <a class="btn btn-outline-warning me-2"
+                                data-glpi-confirm="{{ confirm_message }}"
+                                data-glpi-submit-get-link="{{ usage_impact_action_url }}"
+                                data-glpi-submit-get-link-fields="{{ reset_args }}">
                                 <i class="ti ti-device-floppy"></i>
                                 <span>{{ _x('button', 'Reset usage impacts') }}</span>
                             </a>
@@ -89,8 +91,10 @@
                     <tr>
                         <td>{{ __('Reset embodied impacts. This will delete all calculated embodied impacts for all assets.', 'carbon') }}</td>
                         <td class="text-end">
-                            {% set reset_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', reset_all: ''}" %}
-                            <a class="btn btn-outline-warning me-2" onclick='{{ embodied_impact_action_url|raw }};'>
+                            <a class="btn btn-outline-warning me-2"
+                                data-glpi-confirm="{{ confirm_message }}"
+                                data-glpi-submit-get-link="{{ embodied_impact_action_url }}"
+                                data-glpi-submit-get-link-fields="{{ reset_args }}">
                                 <i class="ti ti-device-floppy"></i>
                                 <span>{{ _x('button', 'Reset embodied impacts') }}</span>
                             </a>
diff --git a/templates/environmentalimpact-item.html.twig b/templates/environmentalimpact-item.html.twig
index a499c1ec..c04db988 100644
--- a/templates/environmentalimpact-item.html.twig
+++ b/templates/environmentalimpact-item.html.twig
@@ -61,11 +61,11 @@
 </div>
 <div>
   {% if not usage_impact.isNewItem() or usage_carbon_emission_count > 0 %}
-    {% set reset_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', reset: '', itemtype: '" ~ asset.getType() ~ "', items_id: '" ~ asset.getID() ~ "'}" %}
-    <a class="btn btn-outline-warning me-2" onclick="submitGetLink('{{ usage_impact_action_url }}', {{ reset_args }})"><i class="ti ti-trash"></i><span>{{ __('Reset data', 'carbon') }}</span></a>
+    {% set reset_args = {_glpi_csrf_token: csrf_token(), reset: '', itemtype: asset.getType(), items_id: asset.getID()}|json_encode %}
+    <a class="btn btn-outline-warning me-2" data-glpi-submit-get-link="{{ usage_impact_action_url }}" data-glpi-submit-get-link-fields="{{ reset_args }}"><i class="ti ti-trash"></i><span>{{ __('Reset data', 'carbon') }}</span></a>
   {% endif %}
-  {% set calculate_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', calculate: '', itemtype: '" ~ asset.getType() ~ "', items_id: '" ~ asset.getID() ~ "'}" %}
-  <a class="btn btn-primary" onclick="submitGetLink('{{ usage_impact_action_url }}', {{ calculate_args }})">{{ __('Calculate data', 'carbon') }}</a>
+  {% set calculate_args = {_glpi_csrf_token: csrf_token(), calculate: '', itemtype: asset.getType(), items_id: asset.getID()}|json_encode %}
+  <a class="btn btn-primary" data-glpi-submit-get-link="{{ usage_impact_action_url }}" data-glpi-submit-get-link-fields="{{ calculate_args }}">{{ __('Calculate data', 'carbon') }}</a>
 </div>
 
 {{ fields.largeTitle(
@@ -96,10 +96,10 @@
   </div>
   <div>
     {% if not embodied_impact.isNewItem() %}
-      {% set reset_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', reset: '', id: '" ~ embodied_impact.getID() ~ "'}" %}
-      <a class="btn btn-outline-warning me-2" onclick="submitGetLink('{{ embodied_impact_action_url }}', {{ reset_args }})"><i class="ti ti-trash"></i><span>{{ __('Reset data', 'carbon') }}</span></a>
+      {% set reset_args = {_glpi_csrf_token: csrf_token(), reset: '', id: embodied_impact.getID()}|json_encode %}
+      <a class="btn btn-outline-warning me-2" data-glpi-submit-get-link="{{ embodied_impact_action_url }}" data-glpi-submit-get-link-fields="{{ reset_args }}"><i class="ti ti-trash"></i><span>{{ __('Reset data', 'carbon') }}</span></a>
     {% endif %}
-    {% set calculate_args = "{_glpi_csrf_token: '" ~ csrf_token() ~ "', calculate: '', itemtype: '" ~ asset.getType() ~ "', items_id: '" ~ asset.getID() ~ "'}" %}
-    <a class="btn btn-primary" onclick="submitGetLink('{{ embodied_impact_action_url }}', {{ calculate_args }})">{{ __('Calculate data', 'carbon') }}</a>
+    {% set calculate_args = {_glpi_csrf_token: csrf_token(), calculate: '', itemtype: asset.getType(), items_id: asset.getID()}|json_encode %}
+    <a class="btn btn-primary" data-glpi-submit-get-link="{{ embodied_impact_action_url }}" data-glpi-submit-get-link-fields="{{ calculate_args }}">{{ __('Calculate data', 'carbon') }}</a>
   </div>
 </div>