[us-commits] [ehb54/us3lims_dbinst] e58bdf: CSP: eliminate all remaining inline handlers, scri...

Fri Aug 7 12:05:54 MDT 2026

  Branch: refs/heads/ehb54-issue-478-rebase
  Home:   https://github.com/ehb54/us3lims_dbinst
  Commit: e58bdf84581fc1c0ac08f40fde6db756770d006d
      https://github.com/ehb54/us3lims_dbinst/commit/e58bdf84581fc1c0ac08f40fde6db756770d006d
  Author: ehb54 <brookes at uthscsa.edu>
  Date:   2026-08-07 (Fri, 07 Aug 2026)

  Changed paths:
    M 2DSA-CG_2.php
    M 2DSA_2.php
    M DMGA_2.php
    M GA_2.php
    M GA_3.php
    M PCSA_2.php
    A css/edit_users.css
    M css/queue_viewer.css
    A css/view_people_audit.css
    M edit_users.php
    M edit_users_actions.php
    M header.php
    M js/GA_2.js
    M js/queue_viewer.js
    M js/sorttable.js
    M js/supporting_files_setup.js
    M queue_content.php
    M queue_viewer.php
    M report_detail.php
    M solution_detail.php
    M supporting_files.php
    M view_people_audit.php

  Log Message:
  -----------
  CSP: eliminate all remaining inline handlers, scripts and styles

Brings the tree to zero violations of default-src 'self'.

Inline event handlers:
- queue_content.php (6): the checkboxes already carried data-runid /
  data-analtype / data-status / data-gfacid holding exactly the arguments
  the inline handlers passed, so the new listeners read them straight from
  the dataset.  These must be delegated from the document, not bound
  directly: update_queue_content() replaces #queue_content wholesale on
  every poll, so directly bound handlers would be dropped each refresh.
- supporting_files.php (9): bound in js/supporting_files_setup.js, which
  already runs at the bottom of that page.  This markup is static, so the
  controls are bound directly rather than delegated.
- queue_viewer.php: dropped $onload, which header.php injected onto
  <body>; js/queue_viewer.js now starts polling on DOMContentLoaded.  It
  was the only user of the $onload mechanism, so header.php no longer
  carries it.

javascript: URLs:
- report_detail.php, solution_detail.php: close links now use the
  onclick-window-close class.  Both build their own <html> and did not
  load main.js, so they now do.
- js/sorttable.js: removed the IE branch that document.write()'s a script
  element with a javascript URL.  It sat inside a JScript conditional
  compilation block, which no browser has honoured since IE11 dropped it
  in 2013, so it was already dead everywhere.

Inline styles:
- edit_users_actions.php (12 identical): .form-section-header in the new
  css/edit_users.css.
- 2DSA_2, 2DSA-CG_2, DMGA_2, GA_3, PCSA_2: red bold error spans now use
  the shared text-red + font-bold utilities.
- queue_content.php: #selection_controls moved to css/queue_viewer.css;
  the bulk-delete button uses the d-none class, and queue_viewer.js
  toggles that class instead of calling jQuery show()/hide().
- view_people_audit.php: 62-line inline <style> block extracted to the
  new css/view_people_audit.css.

Also fixes js/GA_2.js, which contained a raw <?php echo $sol_count; ?>.
The file is served statically as .js, so the tag was never executed -- it
reached the browser verbatim and made the whole script a syntax error,
leaving get_solute_count() and validate_solutes() undefined on GA_2.php.
Both are targets of delegated CSP handlers, so the conversion could not
have worked there.  The rendered count now arrives via a
data-rendered-count attribute on #sol.

To unsubscribe from these emails, change your notification settings at https://github.com/ehb54/us3lims_dbinst/settings/notifications