+ * @copyright Catalyst IT
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die;
+
+function xmldb_local_csp_upgrade($oldversion) {
+ global $DB;
+ $dbman = $DB->get_manager();
+
+ if ($oldversion < 2019100100) {
+
+ // Changing precision of field documenturi on table local_csp to (1333).
+ $table = new xmldb_table('local_csp');
+ $field = new xmldb_field('documenturi', XMLDB_TYPE_CHAR, '1333', null, null, null, null, 'id');
+
+ // Launch change of precision for field documenturi.
+ $dbman->change_field_precision($table, $field);
+
+ // Changing precision of field blockeduri on table local_csp to (1333).
+ $table = new xmldb_table('local_csp');
+ $field = new xmldb_field('blockeduri', XMLDB_TYPE_CHAR, '1333', null, null, null, null, 'documenturi');
+
+ // Launch change of precision for field blockeduri.
+ $dbman->change_field_precision($table, $field);
+
+ // Csp savepoint reached.
+ upgrade_plugin_savepoint(true, 2019100100, 'local', 'csp');
+ }
+
+ return true;
+}
+
diff --git a/lang/en/local_csp.php b/lang/en/local_csp.php
index b8f489a..fb9bd97 100644
--- a/lang/en/local_csp.php
+++ b/lang/en/local_csp.php
@@ -45,7 +45,9 @@
$string['cspsettings'] = 'Content security policy settings';
$string['cspsettingsinfo'] = 'CSP works through adding a special HTTP response header to every Moodle page. Modern browsers, when they see this header, are able to perform certain actions e.g. block insecure content on such pages. Please read more about CSP here.
If you leave any of these settings blank CSP headers will not be used.
';
$string['documenturi'] = 'Violation at';
-$string['failcounter'] = 'Count';
+$string['failcounter'] = '#';
+$string['highestviolaters'] = 'Top Violation Sources';
+$string['highestviolaterscount'] = 'Count: {$a}';
$string['loadingmixedcontentdescription'] = 'When accessing moodle website via HTTPS browser prohibits displaying of the below resources because they origin from HTTP.
You should be able to see it in your browser\'s Javascript console.';
$string['loadinsecurecss'] = 'Load insecure css from {$a}';
$string['loadinsecureiframe'] = 'Load insecure iframe from {$a}';
@@ -58,7 +60,6 @@
$string['reset'] = 'Reset';
$string['resetallcspstatistics'] = 'Reset all statistics';
$string['scspheadernone'] = 'Not used';
-$string['timecreated'] = 'Recorded';
$string['timeupdated'] = 'Last';
$string['violateddirective'] = 'Policy';
$string['privacy:metadata'] = 'The CSP plugin contains no user specific data.';
diff --git a/samples/sample.html b/samples/sample.html
index efc9aa1..e0656fc 100644
--- a/samples/sample.html
+++ b/samples/sample.html
@@ -7,4 +7,4 @@
Successfully loaded sample.html!
-
diff --git a/classes/table/csp_report.php b/classes/table/csp_report.php
index cd61db6..94c8cc6 100644
--- a/classes/table/csp_report.php
+++ b/classes/table/csp_report.php
@@ -40,6 +40,30 @@
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class csp_report extends \table_sql {
+
+ /**
+ * Embeds a link to a drilldown table showing only 1 violation class
+ *
+ * @param stdObject $record fieldset object of db table with field timecreated
+ * @return string Link to drilldown table
+ */
+ protected function col_failcounter($record) {
+ // Get blocked URI, and set as param for page if clicked on
+ $url = new \moodle_url('/local/csp/csp_report.php', array ('viewviolationclass' => $record->blockeduri));
+ return \html_writer::link($url, $record->failcounter);
+ }
+
+ /**
+ * Stop violateddirective from wrapping when long urls are present
+ *
+ * @param stdObject $record fieldset object of db table with field timecreated
+ * @return string Non breaking text line
+ */
+ protected function col_violateddirective($record) {
+ // Stop line from wrapping
+ return \html_writer::tag('span', $record->violateddirective, array('style' => 'white-space: nowrap'));
+ }
+
/**
* Formatting unix timestamps in column named timecreated to human readable time.
*
@@ -115,17 +139,57 @@ protected function col_blockeduri($record) {
* @return string HTML link.
*/
protected function col_action($record) {
- global $OUTPUT;
-
- $action = new \confirm_action(get_string('areyousuretodeleteonerecord', 'local_csp'));
- $url = new \moodle_url($this->baseurl);
- $url->params(array(
- 'removerecordwithhash' => $record->sha1hash,
- 'sesskey' => sesskey(),
- 'redirecttopage' => $this->currpage,
- ));
- $actionlink = $OUTPUT->action_link($url, get_string('reset', 'local_csp'), $action);
-
- return $actionlink;
+ global $OUTPUT, $PAGE;
+
+ // Find whether drilldown flag is present in PAGE params
+ $viewviolationclass = optional_param('viewviolationclass', false, PARAM_TEXT);
+ if ($viewviolationclass !== false) {
+ $action = new \confirm_action(get_string('areyousuretodeleteonerecord', 'local_csp'));
+ $url = new \moodle_url($this->baseurl);
+ $url->params(array(
+ 'removerecordwithid' => $record->id,
+ 'sesskey' => sesskey(),
+ 'redirecttopage' => $this->currpage,
+ ));
+ $actionlink = $OUTPUT->action_link($url, get_string('reset', 'local_csp'), $action);
+
+ return $actionlink;
+ } else {
+ // Else delete entire violation class
+ $action = new \confirm_action(get_string('areyousuretodeleteonerecord', 'local_csp'));
+ $url = new \moodle_url($this->baseurl);
+ $url->params(array(
+ 'removeviolationclass' => $record->blockeduri,
+ 'sesskey' => sesskey(),
+ 'redirecttopage' => $this->currpage,
+ ));
+ $actionlink = $OUTPUT->action_link($url, get_string('reset', 'local_csp'), $action);
+
+ return $actionlink;
+ }
+ }
+
+ /**
+ * Gets the 3 highest violater documentURIs for each blockedURI
+ *
+ * @param stdObject $record fieldset object of db table with field timecreated
+ * @return string details of the highest violating documents
+ */
+ protected function col_highestviolaters($record) {
+ global $DB, $CFG;
+
+ // Get 3 highest violaters for each blocked URI
+ $sql = "SELECT *
+ FROM {local_csp}
+ WHERE blockeduri = ?
+ ORDER BY failcounter DESC";
+ $violaters = $DB->get_records_sql($sql, array($record->blockeduri), 0, 3);
+ $return = '';
+ foreach ($violaters as $violater) {
+ // Strip the top level domain out of the display
+ $urlstring = str_replace($CFG->wwwroot, '', $violater->documenturi);
+ $return .= get_string('highestviolaterscount', 'local_csp', $violater->failcounter).' '.\html_writer::link($violater->documenturi, $urlstring).'