[Rom1-B]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes # (issue number, if applicable)
• The plugin now works under the GLPI Content Security Policy: no inline event handlers and no <script> tags printed from PHP remain. Behaviour is unchanged.
• The plugin declares 'csp_compliant' => true in plugin_version_jamf().

Converted patterns:

• templates/import.html.twig: onclick on the Import, Discover now and Clear pending imports buttons replaced by jQuery listeners in the template script.
• templates/merge.html.twig: onclick on the Merge button replaced by a jQuery listener in the template script.
• templates/mdm_commands.html.twig: onclick on each MDM command button replaced by a data-jamf-mdm-command attribute and a jQuery listener calling jamfPlugin.onMDMCommandButtonClick().
• templates/inventory_info.html.twig: the generic on_click button option is replaced by an id; the click is bound in the extra_js script.
• inc/computer.class.php and inc/mobiledevice.class.php: the "Sync now" button no longer carries an on_click string; its listener is bound in the generated extra_js.
• inc/mobiledevice.class.php: deprecated Html::link() replaced by an escaped <a href> (same markup minus an empty display attribute).

Blocked by: glpi-project/glpi#26020 and its 11.0 / 12.0 backports. The minimum GLPI version (PLUGIN_JAMF_MIN_GLPI) must be bumped to the first CSP-enabled release before merging.

Manual test checklist (keep the browser console open, CSP violations are logged there):

• Computer or mobile device item, Jamf inventory card: click "Sync now", the device syncs and the page reloads.
• Jamf import page: "Import", "Discover now" and "Clear pending imports" trigger their AJAX action and reload.
• Jamf merge page: "Merge" sends the merge request.
• Jamf MDM commands tab on a device: each command button opens its form or confirmation dialog, and a command without parameters or confirmation is sent directly.
• Mobile device with lost mode enabled: the GPS value is a link to Google Maps.
• No Refused to execute inline event handler or Refused to execute inline script message in the console on these pages.

Screenshots (if appropriate):