security: fix XSS and open redirect in auth and UI pages (1.2.x backport)

[somethingwithproof]

Summary

Surgical edits to current 1.2.x files (no wholesale file checkouts).

• Validate Referer host before using in Location header (auth_changepassword.php, link.php)
• Encode return target via json_encode in JS onClick handler (auth_changepassword.php)
• Encode tab parameter via json_encode in JS context (auth_profile.php)
• Encode pageAction and graphPage via json_encode in JS context (lib/html_graph.php)
• Add JS context hardening unit tests

5 files, +93/-7 lines.

Security

• GHSA-34rf-frc3-v48r (High) - Reflected XSS via tab parameter in auth_profile.php
• GHSA-2j98-xfjq-gw39 (Medium) - Reflected XSS in html_auth_footer
• GHSA-cfhh-pwvx-gp5g (Medium) - Reflected XSS via rfilter PCRE differential
• GHSA-rv79-cxhv-2jwq (Medium) - XSS in cacti

Test plan

• Verify password change flow works
• Verify auth_profile.php tab switching works
• Verify graph page JS functionality
• Run vendor/bin/pest tests/Unit/JsContextHardeningTest.php

[Copilot]

Pull request overview

Backports targeted XSS and open-redirect hardening to Cacti 1.2.x pages by ensuring request-derived values are safely embedded in JavaScript contexts and that Referer-based redirects are restricted to same-origin.

Changes:

• Harden JS string interpolation by switching to json_encode(...) for JS-bound variables in UI pages.
• Add same-origin validation before using HTTP_REFERER for Location: redirects.
• Introduce a new “JS context hardening” unit test file (currently not runnable / not aligned with the codebase).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
auth_changepassword.php	Adds Referer sanitization + same-origin checks for redirects; encodes $return for JS onclick usage.
auth_profile.php	Encodes the tab request variable via json_encode before embedding in JS.
lib/html_graph.php	Encodes $action and $page for safe JS embedding.
link.php	Validates/sanitizes Referer before using it as a redirect target fallback.
tests/Unit/JsContextHardeningTest.php	Adds regression tests for JS hardening (but currently references missing files/strings and requires Pest which isn’t present).