security(csp): version-safe inline-script nonce wrapper + strengthen PO/MO instructions

.github/copilot-instructions.md

@@ -209,7 +209,8 @@ Document all changes in `CHANGELOG.md`; use descriptive commit messages referenc
 ## Internationalization (i18n)
 
 - Translatable strings are managed with GNU gettext via `locales/build_gettext.sh`. `locales/po/cacti.pot` is the source template; Weblate owns syncing the per-language `.po`/`.mo` files from it.
-- When a pull request adds or changes a string wrapped in `__()`/`__n()`/`__esc()`/`__x()`/`__xn()`/`__gettext()`, run `locales/build_gettext.sh` before pushing and add the resulting change to `locales/po/cacti.pot` only. Do not commit the regenerated per-language `.po`/`.mo` files in the same PR — Weblate takes care of the rest.
+- **Never commit the per-language `.po` or compiled `.mo` files** (`locales/po/*.po`, `locales/LC_MESSAGES/*.mo`) in a plugin PR. Weblate is the sole owner of those catalogs, and regenerating them here produces spurious diffs and merge conflicts. `locales/po/cacti.pot` is the ONLY translation artifact a PR may add or modify.
+- When a pull request adds or changes a string wrapped in `__()`/`__n()`/`__esc()`/`__x()`/`__xn()`/`__gettext()`, run `locales/build_gettext.sh` before pushing and stage `locales/po/cacti.pot` only. `build_gettext.sh` also rewrites the `.po`/`.mo` files as a side effect; revert those before committing (`git checkout -- locales/po/*.po locales/LC_MESSAGES`), or run only the `xgettext` step that targets `cacti.pot`.
 
 ## References
 

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* security: Add a version-safe CSP nonce (`plugin_flowview_csp_nonce()`) to every inline `<script>` tag so pages stay compatible with Cacti's Content-Security-Policy nonce enforcement, while falling back cleanly on older Cacti releases that lack the `CactiSecureHeaders` class
 * chore: Harmonize CI workflow, issue/PR templates, and PHP-compatibility test structure with the shared Cacti plugin baseline
 * issue#261: Cacti 1.2.x flowview 5.0 update of 16.09 error on call db_check_reconnect inside flow_capture
 * issue#240: Call to db_table_exists is incorrect in some cases

flowview_databases.php

@@ -962,7 +962,7 @@ function view_db_table($tab, &$tabs) {
 				</tr>
 			</table>
 			</form>
-			<script type='text/javascript'>
+			<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 
 			var tab='<?php print $tab;?>';
 			var myTimer;
@@ -1331,7 +1331,7 @@ function view_dns_cache() {
 				</tr>
 			</table>
 			</form>
-			<script type='text/javascript'>
+			<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 
 			function applyFilter() {
 				strURL  = 'flowview_databases.php?header=false';
@@ -1626,7 +1626,7 @@ function view_routes($tab) {
 				</tr>
 			</table>
 			</form>
-			<script type='text/javascript'>
+			<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 
 			var tab='<?php print $tab;?>';
 			var myTimer;

flowview_devices.php

@@ -635,7 +635,7 @@ function edit_device() {
 					</tr>
 				</table>
 			</form>
-			<script type='text/javascript'>
+			<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 			function applyFilter() {
 				strURL  = 'flowview_devices.php?action=edit&id=<?php print get_filter_request_var('id'); ?>&tab=templates&header=false';
 				strURL += '&template=' + $('#template').val();
@@ -878,7 +878,7 @@ function show_devices () {
 				</tr>
 			</table>
 		</form>
-		<script type='text/javascript'>
+		<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 		function applyFilter() {
 			strURL  = 'flowview_devices.php?header=false';
 			strURL += '&filter='+escape($('#filter').val());

flowview_filters.php

@@ -296,7 +296,7 @@ function show_filters() {
 				</tr>
 			</table>
 		</form>
-		<script type='text/javascript'>
+		<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 		function applyFilter() {
 			strURL  = 'flowview_filters.php?header=false';
 			strURL += '&filter='+escape($('#filter').val());

flowview_schedules.php

@@ -580,7 +580,7 @@ function edit_log($header_label, $report) {
 				</tr>
 			</table>
 		</form>
-		<script type='text/javascript'>
+		<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 		var id = '<?php print get_filter_request_var('id'); ?>';
 
 		function applyFilter() {
@@ -716,7 +716,7 @@ function clearFilter() {
 
 	?>
 	<div id='reportDiv'></div>
-	<script type='text/javascript'>
+	<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 	var log_id='<?php print get_filter_request_var('id'); ?>';
 
 	function exportLog() {
@@ -762,7 +762,7 @@ function edit_general($header_label, $report) {
 	html_end_box();
 
 	?>
-	<script type='text/javascript'>
+	<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 	var startOpen = false;
 
 	$(function() {
@@ -877,7 +877,7 @@ function show_schedules() {
 				</tr>
 			</table>
 		</form>
-		<script type='text/javascript'>
+		<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 		function applyFilter() {
 			strURL  = 'flowview_schedules.php?header=false';
 			strURL += '&filter='+escape($('#filter').val());

functions.php

@@ -280,7 +280,7 @@ function edit_filter() {
 	form_save_button($page, 'return');
 
 	?>
-	<script type='text/javascript'>
+	<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 	var date1Open  = false;
 	var date2Open  = false;
 	var returnPage = '<?php print $page;?>';
@@ -1001,7 +1001,7 @@ function flowview_display_filter() {
 		</td>
 	</tr>
 	<tr><td>
-	<script type='text/javascript'>
+	<script type='text/javascript' <?php print plugin_flowview_csp_nonce(); ?>>
 
 	var height    = $(window).height() - 200;
 	var date1Open = false;