update: 2.0.0 - the post revision (needs further verification and changes)

Author: Felix Manrique

.gitignore

@@ -1 +1,3 @@
 /vendor/
+/issues-resolver/
+

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [2.0.0] - 2026-03-03
+### The Post Revision Update
+
+### Fixed
+- **Hard-coded Language Strings:** Replaced all hard-coded user-facing text with proper `get_string()` calls for full internationalization support. Added 27 new language strings for CSV report headers, deprecated function descriptions, and unsafe function warnings across all supported languages (en, es, fr, it, pt).
+- **Non-English Comments:** Translated all Spanish comments in `db/upgrade.php` to English for international collaboration compliance.
+- **Database Performance (N+1 Queries):** Optimized `dashboard.php` role heatmap generation by preloading all roles in a single bulk query using `get_in_or_equal()`, eliminating N+1 query problem in role risk display.
+- **Third-Party Library Documentation:** Created `thirdpartylibs.xml` to properly document Chart.js v4.5.1 (MIT License) as required by Moodle plugin guidelines.
+
+### Changed
+- **Plugin Name:** Rebranded from "Moodle Risk & Compliance Analyzer" to "Risk & Compliance Analyzer for Moodle" across all language files and CLI scripts for better naming consistency.
+- **CSV Report Generation:** All CSV headers and labels now use language strings from `get_string()` instead of hard-coded English text, enabling proper translation.
+- **Deprecated Functions Detection:** Refactored `structural_scanner.php` to store language string keys instead of hard-coded messages, with runtime translation via `get_string()`.
+
+### Added
+- **Language Strings:** Added 27 new translatable strings for deprecated Moodle functions (`dep_func_*`) and unsafe PHP functions (`unsafe_func_*`) across all 5 supported languages (en, es, fr, it, pt).
+
+
 ## [1.5.0] - 2026-02-26
 
 ### Patch & Chill Update

amd/src/dashboard.js

@@ -158,7 +158,7 @@ define(
                 // ===== PII FIELD TOGGLE =====
                 $(document).on('click', '.mrca-toggle-pii', function (e) {
                     e.preventDefault();
-                    var target = $($(this).data('target'));
+                    var target = $($(this).data('bs-target') || $(this).data('target'));
                     target.toggle();
                     // Toggle icon.
                     var icon = $(this).find('i');

classes/reporting/csv_generator.php

@@ -54,24 +54,31 @@ public function generate_report(int $scanid): void {
         $output = fopen('php://output', 'w');
 
         // Info header.
-        fputcsv($output, ['MRCA Scan Report']);
-        fputcsv($output, ['Scan Date', userdate($scan->timecreated)]);
-        fputcsv($output, ['Total Score', $scan->total_score]);
-        fputcsv($output, ['Site Risk Index', round($scan->site_risk_index, 1) . '/100']);
-        fputcsv($output, ['Plugins Scanned', $scan->plugins_scanned]);
-        fputcsv($output, ['Roles Scanned', $scan->roles_scanned]);
+        fputcsv($output, [get_string('csv_header_report_title', 'local_mrca')]);
+        fputcsv($output, [get_string('csv_label_scan_date', 'local_mrca'), userdate($scan->timecreated)]);
+        fputcsv($output, [get_string('csv_label_total_score', 'local_mrca'), $scan->total_score]);
+        fputcsv($output, [get_string('csv_label_site_risk_index', 'local_mrca'), round($scan->site_risk_index, 1) . '/100']);
+        fputcsv($output, [get_string('csv_label_plugins_scanned', 'local_mrca'), $scan->plugins_scanned]);
+        fputcsv($output, [get_string('csv_label_roles_scanned', 'local_mrca'), $scan->roles_scanned]);
         fputcsv($output, []);
 
         // Results.
-        fputcsv($output, ['Plugin', 'Risk Score', 'Risk Level', 'Privacy API']);
+        fputcsv($output, [
+            get_string('csv_header_plugin', 'local_mrca'),
+            get_string('csv_header_risk_score', 'local_mrca'),
+            get_string('csv_header_risk_level', 'local_mrca'),
+            get_string('csv_header_privacy_api', 'local_mrca'),
+        ]);
 
         foreach ($results as $result) {
             $level = $engine->get_risk_level($result->risk_score);
             fputcsv($output, [
                 $result->plugin,
                 $result->risk_score,
                 ucfirst($level),
-                $result->has_privacy_provider ? 'Yes' : 'No',
+                $result->has_privacy_provider ?
+                    get_string('csv_label_yes', 'local_mrca') :
+                    get_string('csv_label_no', 'local_mrca'),
             ]);
         }
 

classes/reporting/dashboard.php

@@ -421,11 +421,19 @@ private function add_dependency_audit(array $data, $db, \stdClass $scan): array
     private function add_role_heatmap(array $data, $db, \stdClass $scan): array {
         $rolerisks = $db->get_records('local_mrca_role_risks', ['scanid' => $scan->id], 'risk_score DESC');
 
+        // Preload all roles to avoid N+1 query problem.
+        $roleids = array_column($rolerisks, 'roleid');
+        $roles = [];
+        if (!empty($roleids)) {
+            list($insql, $inparams) = $db->get_in_or_equal($roleids, SQL_PARAMS_NAMED);
+            $roles = $db->get_records_select('role', "id $insql", $inparams, '', 'id,shortname');
+        }
+
         foreach ($rolerisks as $rr) {
-            $role = $db->get_record('role', ['id' => $rr->roleid]);
-            if (!$role) {
+            if (!isset($roles[$rr->roleid])) {
                 continue;
             }
+            $role = $roles[$rr->roleid];
 
             $heatmapclass = 'success';
             $emoji = '🟢';

classes/scanners/structural_scanner.php

@@ -62,33 +62,33 @@ class structural_scanner {
 
     /** @var array Known deprecated Moodle functions to detect. */
     private const DEPRECATED_FUNCTIONS = [
-        'print_object' => 'Use debugging() or var_dump for debugging.',
-        'print_header' => 'Replaced by $OUTPUT->header().',
-        'print_footer' => 'Replaced by $OUTPUT->footer().',
-        'print_heading' => 'Replaced by $OUTPUT->heading().',
-        'print_table' => 'Replaced by html_writer::table().',
-        'print_simple_box' => 'Deprecated UI function.',
-        'choose_from_menu' => 'Replaced by html_writer::select().',
-        'helpbutton' => 'Replaced by $OUTPUT->help_icon().',
-        'print_recent_activity_note' => 'Deprecated activity function.',
-        'get_context_instance' => 'Use context_*::instance() instead.',
-        'add_to_log' => 'Replaced by Events API (\\core\\event).',
-        'events_trigger' => 'Replaced by Events 2 API.',
-        'print_error' => 'Use throw new moodle_exception() instead.',
+        'print_object' => 'dep_func_print_object',
+        'print_header' => 'dep_func_print_header',
+        'print_footer' => 'dep_func_print_footer',
+        'print_heading' => 'dep_func_print_heading',
+        'print_table' => 'dep_func_print_table',
+        'print_simple_box' => 'dep_func_print_simple_box',
+        'choose_from_menu' => 'dep_func_choose_from_menu',
+        'helpbutton' => 'dep_func_helpbutton',
+        'print_recent_activity_note' => 'dep_func_print_recent_activity_note',
+        'get_context_instance' => 'dep_func_get_context_instance',
+        'add_to_log' => 'dep_func_add_to_log',
+        'events_trigger' => 'dep_func_events_trigger',
+        'print_error' => 'dep_func_print_error',
     ];
 
     /** @var array PHP functions that should not be used in Moodle plugins. */
     private const UNSAFE_PHP_FUNCTIONS = [
-        'eval' => 'Arbitrary code execution risk.',
-        'exec' => 'System command execution.',
-        'shell_exec' => 'System command execution.',
-        'passthru' => 'System command execution.',
-        'popen' => 'Process execution.',
-        'proc_open' => 'Process execution.',
-        'dl' => 'Dynamic extension loading.',
-        'mysql_query' => 'Deprecated MySQL extension. Use $DB API.',
-        'mysql_connect' => 'Deprecated MySQL extension. Use $DB API.',
-        'mysqli_query' => 'Direct DB access. Use Moodle $DB API.',
+        'eval' => 'unsafe_func_eval',
+        'exec' => 'unsafe_func_exec',
+        'shell_exec' => 'unsafe_func_shell_exec',
+        'passthru' => 'unsafe_func_passthru',
+        'popen' => 'unsafe_func_popen',
+        'proc_open' => 'unsafe_func_proc_open',
+        'dl' => 'unsafe_func_dl',
+        'mysql_query' => 'unsafe_func_mysql_query',
+        'mysql_connect' => 'unsafe_func_mysql_connect',
+        'mysqli_query' => 'unsafe_func_mysqli_query',
     ];
 
     /**
@@ -228,15 +228,23 @@ private function scan_php_sources(string $dir, array &$findings, int &$score): v
      */
     private function scan_content(string $content, string $relative, array &$findings): int {
         $score = 0;
-        foreach (self::DEPRECATED_FUNCTIONS as $func => $reason) {
+        foreach (self::DEPRECATED_FUNCTIONS as $func => $stringkey) {
             if ($this->contains_function_call($content, $func)) {
-                $findings['deprecated_calls'][] = ['file' => $relative, 'function' => $func, 'reason' => $reason];
+                $findings['deprecated_calls'][] = [
+                    'file' => $relative,
+                    'function' => $func,
+                    'reason' => get_string($stringkey, 'local_mrca'),
+                ];
                 $score += self::SCORE_DEPRECATED_CALL;
             }
         }
-        foreach (self::UNSAFE_PHP_FUNCTIONS as $func => $reason) {
+        foreach (self::UNSAFE_PHP_FUNCTIONS as $func => $stringkey) {
             if ($this->contains_function_call($content, $func)) {
-                $findings['unsafe_calls'][] = ['file' => $relative, 'function' => $func, 'reason' => $reason];
+                $findings['unsafe_calls'][] = [
+                    'file' => $relative,
+                    'function' => $func,
+                    'reason' => get_string($stringkey, 'local_mrca'),
+                ];
                 $score += self::SCORE_DEPRECATED_CALL;
             }
         }

cli/run_scan_cli.php

@@ -31,7 +31,7 @@
 [$options, $unrecognised] = cli_get_params(['help' => false], ['h' => 'help']);
 
 if ($options['help']) {
-    echo "MRCA — Moodle Risk & Compliance Analyzer CLI Scan
+    echo "MRCA — Risk & Compliance Analyzer for Moodle CLI Scan
 
 Usage:
     php run_scan_cli.php [--help]
@@ -48,7 +48,7 @@
 }
 
 mtrace("===================================================");
-mtrace(" MRCA — Moodle Risk & Compliance Analyzer");
+mtrace(" MRCA — Risk & Compliance Analyzer for Moodle");
 mtrace(" Starting CLI Scan...");
 mtrace("===================================================");
 

db/upgrade.php

@@ -30,11 +30,11 @@
  * @return bool Always returns true.
  */
 function xmldb_local_mrca_upgrade($oldversion) {
-    global $DB; // Moodle pide que esté aquí aunque no se use en este bloque.
+    global $DB; // Required by Moodle, even if not used in this block.
 
     if ($oldversion < 2026022400) {
         // MRCA Golden Release 1.1.5 upgrade step.
-        // Aquí podrías poner lógica de base de datos, pero el savepoint es OBLIGATORIO.
+        // Database schema logic can be placed here, but the savepoint is MANDATORY.
         upgrade_plugin_savepoint(true, 2026022400, 'local', 'mrca');
     }
 

lang/en/local_mrca.php

@@ -40,12 +40,37 @@
 $string['capability_score'] = 'Capability Score';
 $string['confirm_scan'] = 'This will run a complete risk & compliance scan. Continue?';
 $string['correlation_engine'] = 'Correlation Engine';
+$string['csv_header_plugin'] = 'Plugin';
+$string['csv_header_privacy_api'] = 'Privacy API';
+$string['csv_header_report_title'] = 'MRCA Scan Report';
+$string['csv_header_risk_level'] = 'Risk Level';
+$string['csv_header_risk_score'] = 'Risk Score';
+$string['csv_label_no'] = 'No';
+$string['csv_label_plugins_scanned'] = 'Plugins Scanned';
+$string['csv_label_roles_scanned'] = 'Roles Scanned';
+$string['csv_label_scan_date'] = 'Scan Date';
+$string['csv_label_site_risk_index'] = 'Site Risk Index';
+$string['csv_label_total_score'] = 'Total Score';
+$string['csv_label_yes'] = 'Yes';
 $string['correlation_engine_desc'] = 'Systemic risk detection by correlating findings across all layers.';
 $string['critical_caps'] = 'Critical Capabilities';
 $string['dashboard_desc'] = 'Comprehensive risk analysis for your Moodle installation.';
 $string['dashboard_title'] = 'MRCA Dashboard';
 $string['dep_core_mismatch'] = 'Core version mismatch — plugin requires a newer Moodle version.';
 $string['dep_deprecated_apis'] = '{$a} deprecated API call(s) detected.';
+$string['dep_func_add_to_log'] = 'Replaced by Events API (\\core\\event).';
+$string['dep_func_choose_from_menu'] = 'Replaced by html_writer::select().';
+$string['dep_func_events_trigger'] = 'Replaced by Events 2 API.';
+$string['dep_func_get_context_instance'] = 'Use context_*::instance() instead.';
+$string['dep_func_helpbutton'] = 'Replaced by $OUTPUT->help_icon().';
+$string['dep_func_print_error'] = 'Use throw new moodle_exception() instead.';
+$string['dep_func_print_footer'] = 'Replaced by $OUTPUT->footer().';
+$string['dep_func_print_header'] = 'Replaced by $OUTPUT->header().';
+$string['dep_func_print_heading'] = 'Replaced by $OUTPUT->heading().';
+$string['dep_func_print_object'] = 'Use debugging() or var_dump for debugging.';
+$string['dep_func_print_recent_activity_note'] = 'Deprecated activity function.';
+$string['dep_func_print_simple_box'] = 'Deprecated UI function.';
+$string['dep_func_print_table'] = 'Replaced by html_writer::table().';
 $string['dep_issues'] = 'Issues';
 $string['dep_missing'] = 'Missing dependency: {$a}';
 $string['dep_outdated'] = 'Plugin version is outdated (not updated in 2+ years).';
@@ -80,7 +105,7 @@
 $string['no_scans_yet'] = 'No scans have been run yet. Click "Scan Now" to start your first analysis.';
 $string['plugin'] = 'Plugin';
 $string['plugin_risk_details'] = 'Plugin Risk Details';
-$string['pluginname'] = 'Moodle Risk & Compliance Analyzer';
+$string['pluginname'] = 'Risk & Compliance Analyzer for Moodle';
 $string['plugins_scanned'] = 'Plugins Scanned';
 $string['privacy:metadata:whitelist'] = 'Records of fields whitelisted by administrators during risk scans.';
 $string['privacy:metadata:whitelist:component'] = 'The plugin component the whitelisted field belongs to.';
@@ -149,6 +174,16 @@
 $string['top_risky_plugins'] = 'Top 5 Risky Plugins';
 $string['top_risky_roles'] = 'Top 5 Risky Roles';
 $string['total_score'] = 'Total Score';
+$string['unsafe_func_dl'] = 'Dynamic extension loading.';
+$string['unsafe_func_eval'] = 'Arbitrary code execution risk.';
+$string['unsafe_func_exec'] = 'System command execution.';
+$string['unsafe_func_mysqli_query'] = 'Direct DB access. Use Moodle $DB API.';
+$string['unsafe_func_mysql_connect'] = 'Deprecated MySQL extension. Use $DB API.';
+$string['unsafe_func_mysql_query'] = 'Deprecated MySQL extension. Use $DB API.';
+$string['unsafe_func_passthru'] = 'System command execution.';
+$string['unsafe_func_popen'] = 'Process execution.';
+$string['unsafe_func_proc_open'] = 'Process execution.';
+$string['unsafe_func_shell_exec'] = 'System command execution.';
 $string['verified_encrypted'] = 'Content verified as encrypted';
 $string['verified_plaintext'] = 'Content detected as plaintext';
 $string['webhook_token'] = 'Webhook Token';

lang/es/local_mrca.php

@@ -40,6 +40,18 @@
 $string['capability_score'] = 'Puntuación de Capacidades';
 $string['confirm_scan'] = 'Esto ejecutará un escaneo completo de riesgos y cumplimiento. ¿Continuar?';
 $string['correlation_engine'] = 'Motor de Correlación';
+$string['csv_header_plugin'] = 'Plugin';
+$string['csv_header_privacy_api'] = 'API de Privacidad';
+$string['csv_header_report_title'] = 'Informe de Riesgos y Cumplimiento de MRCA';
+$string['csv_header_risk_level'] = 'Nivel de Riesgo';
+$string['csv_header_risk_score'] = 'Puntuación de Riesgo';
+$string['csv_label_no'] = 'No';
+$string['csv_label_plugins_scanned'] = 'Plugins Escaneados';
+$string['csv_label_roles_scanned'] = 'Roles Escaneados';
+$string['csv_label_scan_date'] = 'Fecha del Escaneo';
+$string['csv_label_site_risk_index'] = 'Índice de Riesgo del Sitio';
+$string['csv_label_total_score'] = 'Puntuación Total';
+$string['csv_label_yes'] = 'Sí';
 $string['correlation_engine_desc'] = 'Detección de riesgos sistémicos correlacionando hallazgos de todas las capas.';
 $string['critical_caps'] = 'Capacidades Críticas';
 $string['dashboard_desc'] = 'Análisis integral de riesgos para tu instalación Moodle.';
@@ -49,6 +61,19 @@
 $string['dep_issues'] = 'Problemas';
 $string['dep_missing'] = 'Dependencia faltante: {$a}';
 $string['dep_outdated'] = 'La versión del plugin es antigua (sin actualización en más de 2 años).';
+$string['dep_func_add_to_log'] = 'Reemplazado por Events API (\\core\\event).';
+$string['dep_func_choose_from_menu'] = 'Reemplazado por html_writer::select().';
+$string['dep_func_events_trigger'] = 'Reemplazado por Events 2 API.';
+$string['dep_func_get_context_instance'] = 'Usar context_*::instance() en su lugar.';
+$string['dep_func_helpbutton'] = 'Reemplazado por $OUTPUT->help_icon().';
+$string['dep_func_print_error'] = 'Usar throw new moodle_exception() en su lugar.';
+$string['dep_func_print_footer'] = 'Reemplazado por $OUTPUT->footer().';
+$string['dep_func_print_header'] = 'Reemplazado por $OUTPUT->header().';
+$string['dep_func_print_heading'] = 'Reemplazado por $OUTPUT->heading().';
+$string['dep_func_print_object'] = 'Usar debugging() o var_dump para depuración.';
+$string['dep_func_print_recent_activity_note'] = 'Función de actividad obsoleta.';
+$string['dep_func_print_simple_box'] = 'Función de UI obsoleta.';
+$string['dep_func_print_table'] = 'Reemplazado por html_writer::table().';
 $string['dependency_audit'] = 'Auditoría de Dependencias';
 $string['dependency_scanner'] = 'Capa de Dependencias y Compatibilidad';
 $string['dependency_scanner_desc'] = 'Requisitos de plugins, compatibilidad con el core y detección de APIs obsoletas.';
@@ -149,6 +174,16 @@
 $string['top_risky_plugins'] = 'Top 5 Plugins Más Riesgosos';
 $string['top_risky_roles'] = 'Top 5 Roles Más Riesgosos';
 $string['total_score'] = 'Puntuación Total';
+$string['unsafe_func_dl'] = 'Carga dinámica de extensiones.';
+$string['unsafe_func_eval'] = 'Riesgo de ejecución arbitraria de código.';
+$string['unsafe_func_exec'] = 'Ejecución de comandos del sistema.';
+$string['unsafe_func_mysqli_query'] = 'Acceso directo a BD. Usar la API $DB de Moodle.';
+$string['unsafe_func_mysql_connect'] = 'Extensión MySQL obsoleta. Usar la API $DB.';
+$string['unsafe_func_mysql_query'] = 'Extensión MySQL obsoleta. Usar la API $DB.';
+$string['unsafe_func_passthru'] = 'Ejecución de comandos del sistema.';
+$string['unsafe_func_popen'] = 'Ejecución de procesos.';
+$string['unsafe_func_proc_open'] = 'Ejecución de procesos.';
+$string['unsafe_func_shell_exec'] = 'Ejecución de comandos del sistema.';
 $string['verified_encrypted'] = 'Contenido verificado como cifrado';
 $string['verified_plaintext'] = 'Contenido detectado como texto plano';
 $string['webhook_token'] = 'Token del Webhook';