From e095d6024c7b8d84f2f389dac4fb0ec3bd705852 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Wed, 5 Oct 2016 10:55:04 +0100
Subject: [PATCH 1/2] Revert "Remove Google Analytics"

This reverts commit f31170f5a29dfa4574ad3335d0c406d15a2c6b9c.
---
 app/__init__.py                      | 4 ++--
 app/templates/admin_template.html    | 8 ++++++++
 tests/app/main/views/test_headers.py | 4 ++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/app/__init__.py b/app/__init__.py
index 5b2c31e6d..17b5a4595 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -359,10 +359,10 @@ def useful_headers_after_request(response):
     response.headers.add('X-XSS-Protection', '1; mode=block')
     response.headers.add('Content-Security-Policy', (
         "default-src 'self' 'unsafe-inline';"
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;"
+        "script-src 'self' *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
         "object-src 'self';"
         "font-src 'self' data:;"
-        "img-src 'self' *.notifications.service.gov.uk data:;"
+        "img-src 'self' *.google-analytics.com *.notifications.service.gov.uk data:;"
     ))
     if 'Cache-Control' in response.headers:
         del response.headers['Cache-Control']
diff --git a/app/templates/admin_template.html b/app/templates/admin_template.html
index 08f4587b5..aa57f52d5 100644
--- a/app/templates/admin_template.html
+++ b/app/templates/admin_template.html
@@ -129,4 +129,12 @@
 
 {% block body_end %}
   <script type="text/javascript" src="{{ asset_url('javascripts/all.js') }}" /></script>
+  <script>
+    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+      (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+      m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+    ga('create', 'UA-75215134-1', 'auto');
+    ga('send', 'pageview');
+  </script>
 {% endblock %}
diff --git a/tests/app/main/views/test_headers.py b/tests/app/main/views/test_headers.py
index 8bf3d9d99..9f4ec9b80 100644
--- a/tests/app/main/views/test_headers.py
+++ b/tests/app/main/views/test_headers.py
@@ -8,8 +8,8 @@ def test_owasp_useful_headers_set(app_):
     assert response.headers['X-XSS-Protection'] == '1; mode=block'
     assert response.headers['Content-Security-Policy'] == (
         "default-src 'self' 'unsafe-inline';"
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;"
+        "script-src 'self' *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
         "object-src 'self';"
         "font-src 'self' data:;"
-        "img-src 'self' *.notifications.service.gov.uk data:;"
+        "img-src 'self' *.google-analytics.com *.notifications.service.gov.uk data:;"
     )

From 4ea7d806fbbe2556b1aff4ebc75b3cda9fd2cd4c Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Wed, 5 Oct 2016 10:58:33 +0100
Subject: [PATCH 2/2] Remove UUIDs from URLs sent to Google Analytics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If all our URLs are unique (because they contain service/job/template
IDs) then it makes it hard to aggrate how users are behaving across a
range of services/jobs/templates.

This commit replaces anything that looks like a UUID in a URL with `…`.
---
 app/templates/admin_template.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/templates/admin_template.html b/app/templates/admin_template.html
index aa57f52d5..4de2bf288 100644
--- a/app/templates/admin_template.html
+++ b/app/templates/admin_template.html
@@ -135,6 +135,10 @@
       m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
     })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
     ga('create', 'UA-75215134-1', 'auto');
-    ga('send', 'pageview');
+    // strip UUIDs
+    page = window.location.href.replace(
+      /[a-f0-9]{8}-?[a-f0-9]{4}-?4[a-f0-9]{3}-?[89ab][a-f0-9]{3}-?[a-f0-9]{12}/g, '…'
+    )
+    ga('send', 'pageview', page);
   </script>
 {% endblock %}