Cacti is vulnerable to cross-Site scripting (XSS) DOM

An authorized attacker crafts a link with a malicious `returnto` parameter pointing to an attacker-controlled server (e.g., `//attacker-server/index.php?//host.php`). The payload avoids filtered special characters like `"`, `'`, `(`, `)`, `<`, `>`. When the victim clicks the link and then clicks the "Cancel" button, the `cactiReturnTo` function passes the unsanitized URL to `loadPageNoHeader`, which makes an AJAX request and inserts the response via the `.html()` function, executing arbitrary JavaScript in the victim's browser [ref_id=1].

The vulnerable component is `graphs_new.php`. The `cactiReturnTo` function calls `loadPageNoHeader` with a user-controlled `returnto` parameter, and `loadPageNoHeader` uses the unsanitized `.html()` function, leading to DOM XSS [ref_id=1]. The patch modifies the `saveFilter()` function in `graphs_new.php` to validate the `returnto` parameter against the server's hostname [ref_id=2].

The patch in `graphs_new.php` adds hostname validation for the `returnto` parameter. It parses the `HTTP_REFERER` and the `returnto` parameter using `parse_url()`, and if the host does not match `$_SERVER['SERVER_NAME']`, it resets `returnto` to the safe default `'host.php'` [ref_id=2]. This prevents an attacker from injecting an external URL that would be passed to `loadPageNoHeader` and rendered unsanitized via `.html()`.