Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
My team lead that knows a lot more about CSP than I do raised this in a work chat channel and it sounded like a legit quality of life fix that could be a quick win.
Steps to reproduce
Use the CSP settings form at any time.
Proposed resolution
Swap the default tab that is selected.
User interface changes
Default selected tab when you first hit the form.
API changes
None
Data model changes
None
| Comment | File | Size | Author |
|---|
Issue fork csp-3418744
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3418744-swap-default-active
compare - 2.x changes, plain diff MR !30
Comments
Comment #3
gappleI think I agree with that change - IIRC, my thought was that viewing that there is an enforced policy and its values would be important.
But if editing is the priority then having the report-only policy default makes sense. There's also the tab summary which indicates that a policy is enabled (and how many directives), and #2987910: Copy configuration between report-only and enforced would help with suggested workflow of tweaking the report-only policy, then copying it to enforced after testing.
I would not switch the order of the form tabs though. There is a following line that causes the switch to have the enforced policy tab as default if it is enabled:
Comment #4
gold@grapple, I did look at that snippet and tracked back to where the config for that value was being set. It started getting a bit convoluted though and I had a bit of time pressure.
This value seems to be being set in 1 place when the form is first submitted in CspSettingsForm.php:631.
I tried flipping the order that $policyTypeKey was processing at L626 but that didn't make any difference either.
I think the issue is tying the
$form['policies']['#default_tab']to the value in that config var.An alternative could be to add
#weightto the$form[$policyTypeKey]array.I'll push an update for that in a moment. Let me know what you think.
Comment #7
gappleI've just set the report-only options to always be default - I don't think having it switch to enforced if that's the only enabled policy provides much benefit, and having it always show the first possible tab is clear and consistent behaviour (that also reduces the likelyhood of making inadvertent changes to the enforced policy).