feat: make plugin CSP compliant

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Jamf Plugin for GLPI Changelog
 
+## [Unreleased]
+
+### Changed
+
+- Make the plugin compatible with the Content Security Policy
+
 ## [3.2.4] - 2026-11-05
 
 ### Fixed

inc/computer.class.php

@@ -74,9 +74,12 @@ public static function showForItem(array $params)
         $match = $jamf_item->fields;
         $match = array_merge($match, $jamf_item->getJamfDeviceData());
 
+        $sync_button_id = 'jamf_sync_' . $item->getID();
         $js = '';
         if ($item->canUpdate()) {
             $ajax_url = $CFG_GLPI['root_doc'] . '/plugins/jamf/ajax/sync.php';
+            $itemtype = $item::getType();
+            $items_id = $item->getID();
             $js       = <<<JAVASCRIPT
                function syncDevice(itemtype, items_id) {
                   $.ajax({
@@ -89,6 +92,7 @@ function syncDevice(itemtype, items_id) {
                      }
                   });
                }
+               $('#{$sync_button_id}').on('click', () => syncDevice("{$itemtype}", {$items_id}));
 JAVASCRIPT;
         }
 
@@ -135,8 +139,8 @@ function syncDevice(itemtype, items_id) {
                         'url'     => self::getJamfDeviceURL($match['jamf_items_id']),
                     ],
                     'sync' => [
-                        'caption'  => _x('action', 'Sync now', 'jamf'),
-                        'on_click' => sprintf('syncDevice("%s", %s); return false;', $item::getType(), $item->getID()),
+                        'caption' => _x('action', 'Sync now', 'jamf'),
+                        'id'      => $sync_button_id,
                     ],
                 ],
                 'extra_js' => $js,

inc/mobiledevice.class.php

@@ -287,8 +287,11 @@ public static function showForItem(array $params)
         $match = array_merge($match, $jamf_item->getJamfDeviceData());
 
         $js = '';
+        $sync_button_id = 'jamf_sync_' . $item->getID();
         if ($item->canUpdate()) {
             $ajax_url = $CFG_GLPI['root_doc'] . '/plugins/jamf/ajax/sync.php';
+            $itemtype = $item::getType();
+            $items_id = $item->getID();
             $js       = <<<JAVASCRIPT
                function syncDevice(itemtype, items_id) {
                   $.ajax({
@@ -301,6 +304,7 @@ function syncDevice(itemtype, items_id) {
                      }
                   });
                }
+               $('#{$sync_button_id}').on('click', () => syncDevice("{$itemtype}", {$items_id}));
 JAVASCRIPT;
         }
 
@@ -355,8 +359,8 @@ function syncDevice(itemtype, items_id) {
                         'url'     => self::getJamfDeviceURL($match['jamf_items_id']),
                     ],
                     'sync' => [
-                        'caption'  => _x('action', 'Sync now', 'jamf'),
-                        'on_click' => sprintf('syncDevice("%s", %d); return false;', $item::getType(), $item->getID()),
+                        'caption' => _x('action', 'Sync now', 'jamf'),
+                        'id'      => $sync_button_id,
                     ],
                 ],
                 'extra_js' => $js,
@@ -401,9 +405,11 @@ function syncDevice(itemtype, items_id) {
                 ],
                 'lost_location' => [
                     'caption' => _x('field', 'GPS', 'jamf'),
-                    'value'   => Html::link(sprintf('%s, %s', $lat, $long), sprintf('https://www.google.com/maps/place/%s,%s', $lat, $long), [
-                        'display' => false,
-                    ]),
+                    'value'   => sprintf(
+                        '<a href="%s">%s</a>',
+                        htmlescape(sprintf('https://www.google.com/maps/place/%s,%s', $lat, $long)),
+                        htmlescape(sprintf('%s, %s', $lat, $long)),
+                    ),
                 ],
                 'lost_location_altitude' => [
                     'caption' => _x('field', 'Altitude', 'jamf'),

setup.php

@@ -89,6 +89,7 @@ function plugin_version_jamf()
         'author'       => "<a href=\"mailto:contact@teclib.com\">Teclib'</a> & Curtis Conard",
         'license'      => 'GPLv2',
         'homepage'     => 'https://github.com/pluginsGLPI/jamf',
+        'csp_compliant' => true,
         'requirements' => [
             'glpi' => [
                 'min' => PLUGIN_JAMF_MIN_GLPI,

templates/import.html.twig

@@ -80,9 +80,9 @@
     </div>
     <br>
     <div class="text-center">
-        <button name="import" type="button" class="btn btn-primary" onclick="importDevices();">{{ _x('action', 'Import', 'jamf') }}</button>
-        <button name="discover" type="button" class="btn btn-primary" onclick="discoverNow();">{{ _x('action', 'Discover now', 'jamf') }}</button>
-        <button name="clear" type="button" class="btn btn-danger" onclick="clearPendingImports();">{{ _x('action', 'Clear pending imports', 'jamf') }}</button>
+        <button name="import" type="button" class="btn btn-primary">{{ _x('action', 'Import', 'jamf') }}</button>
+        <button name="discover" type="button" class="btn btn-primary">{{ _x('action', 'Discover now', 'jamf') }}</button>
+        <button name="clear" type="button" class="btn btn-danger">{{ _x('action', 'Clear pending imports', 'jamf') }}</button>
         <script>
             function importDevices() {
                 const import_ids = $(':checkbox:checked').filter(':not([name^="_checkall"])').map(function() {
@@ -147,6 +147,9 @@
                 });
             }
 
+            $('button[name="import"]').on('click', () => importDevices());
+            $('button[name="discover"]').on('click', () => discoverNow());
+            $('button[name="clear"]').on('click', () => clearPendingImports());
         </script>
     </div>
 </form>

templates/inventory_info.html.twig

@@ -43,7 +43,7 @@
             {% if button.url %}
                <a class="btn btn-outline-secondary {{ loop.index0 != 0 ? 'ms-3' : '' }}" href="{{ button.url }}">{{ button.caption }}</a>
             {% else %}
-               <button class="btn btn-outline-secondary {{ loop.index0 != 0 ? 'ms-3' : '' }}" type="button" onclick="{{ button.on_click|default('') }}">{{ button.caption }}</button>
+               <button class="btn btn-outline-secondary {{ loop.index0 != 0 ? 'ms-3' : '' }}" type="button" id="{{ button.id }}">{{ button.caption }}</button>
             {% endif %}
          {% endfor %}
       </div>

templates/mdm_commands.html.twig

@@ -38,7 +38,7 @@
 
 <div class="mdm-button-group">
    {% for command, command_params in commands %}
-      <div class="mdm-button p-2 me-2 mb-2 d-inline-block cursor-pointer btn btn-outline-secondary" onclick="jamfPlugin.onMDMCommandButtonClick('{{ command }}', event)"
+      <div class="mdm-button p-2 me-2 mb-2 d-inline-block cursor-pointer btn btn-outline-secondary" data-jamf-mdm-command="{{ command }}"
            style="border-radius: 30px">
          <i class="{{ command_params.icon }} me-2 fs-4 align-middle" style="color: {{ command_params.icon_color|default('inherit') }}"></i>
          {{ command_params.name }}
@@ -103,5 +103,8 @@
            itemtype: "{{ jamf_itemtype }}",
            items_id: {{ jamf_items_id }},
        });
+       $('[data-jamf-mdm-command]').on('click', (e) => {
+           jamfPlugin.onMDMCommandButtonClick(e.currentTarget.dataset.jamfMdmCommand, e);
+       });
    });
 </script>

templates/merge.html.twig

@@ -82,7 +82,7 @@
     </div>
     <br>
     <div class="text-center">
-        <button name="merge" type="button" class="btn btn-primary" onclick="mergeDevices();">{{ _x('action', 'Merge', 'jamf') }}</button>
+        <button name="merge" type="button" class="btn btn-primary">{{ _x('action', 'Merge', 'jamf') }}</button>
         <script>
             function mergeDevices() {
                 const post_data = {};
@@ -113,6 +113,8 @@
                     }
                 });
             }
+
+            $('button[name="merge"]').on('click', () => mergeDevices());
         </script>
     </div>
 </form>