In principle the text should probably use whom (on the grounds that a possible resolution is It should be him, not he).
But whom is hopelessly old-fashioned today (except after to, in To whom am I speaking? on the phone - but we often avoid that one by asking Who am I speaking to?, so it doesn't come immediately after the preposition).
So the easy answer is just go with who and forget about the who / whom distinction, same as most native speakers (different morphology for verb subject and object is primarily a feature of Latin, not English).
As commented, some people are happy with (or prefer) From whom did you get it? Which is again a context where the immediately preceding term is a preposition - unless we rephrase to put it at the end, as Who did you get it from?
It may be worth noting that OP's cited example features a very "weak" preposition on. I say "weak" because we can easily just remove it entirely without affecting anything else (except that if there's no preposition at all before who / whom, we're much more likely to use the modern simpler style.