Skip to content

Fix: Respect outputowncss setting and add missing CSP nonce #463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skerbis merged 2 commits into from
Feb 16, 2026
Merged

Fix: Respect outputowncss setting and add missing CSP nonce #463

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a9716ea
fix: respect outputowncss setting and add missing CSP nonce
skerbis Feb 16, 2026
f7f7bb4
Bump version to 5.4.1-dev and add changelog entry for issue #462
skerbis Feb 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions fragments/ConsentManager/box.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,27 +10,32 @@

use FriendsOfRedaxo\ConsentManager\Frontend;

$addon = rex_addon::get('consent_manager');
$consent_manager = new Frontend(0);
if (is_string(rex_request::server('HTTP_HOST'))) {
$consent_manager->setDomain(rex_request::server('HTTP_HOST'));
}
if (0 === count($consent_manager->texts)) {
echo '<div id="consent_manager-background">' . rex_view::error(rex_addon::get('consent_manager')->i18n('consent_manager_error_noconfig')) . '</div>';
echo '<div id="consent_manager-background">' . rex_view::error($addon->i18n('consent_manager_error_noconfig')) . '</div>';
return;
}

// Check for CSS Framework Mode
$cssFrameworkMode = rex_addon::get('consent_manager')->getConfig('css_framework_mode');
$cssFrameworkMode = $addon->getConfig('css_framework_mode');
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$cssFrameworkMode is read without a default value, but later the fragment does strict checks against an empty string ("'' === $cssFrameworkMode"). If the config value is null on older installs, this will incorrectly suppress the inline CSS/style output even though no framework mode is active. Use the established pattern $addon->getConfig('css_framework_mode', '') so the value is always a string and the comparisons behave as intended.

Suggested change
$cssFrameworkMode = $addon->getConfig('css_framework_mode');
$cssFrameworkMode = $addon->getConfig('css_framework_mode', '');

Copilot uses AI. Check for mistakes.
if ($cssFrameworkMode) {
echo $this->parse('ConsentManager/box_' . $cssFrameworkMode . '.php');
return;
}

if (0 < count($consent_manager->cookiegroups)) : ?>
<div tabindex="-1" class="consent_manager-background consent_manager-hidden <?= $consent_manager->boxClass ?>" id="consent_manager-background" data-domain-name="<?= $consent_manager->domainName ?>" data-version="<?= $consent_manager->version ?>" data-consentid="<?= uniqid('', true) ?>" data-cachelogid="<?= $consent_manager->cacheLogId ?>" data-nosnippet aria-hidden="true">
<?php
// Inline-CSS nur ausgeben wenn kein Framework-Modus und kein eigenes CSS aktiv ist
if ('' === $cssFrameworkMode && false === $addon->getConfig('outputowncss', false)) :
?>
<style nonce="<?= rex_response::getNonce() ?>">
#consent_manager-background {
<?php if (rex_addon::get('consent_manager')->getConfig('backdrop', '1') === '0'): ?>
<?php if ($addon->getConfig('backdrop', '1') === '0'): ?>
background: transparent !important;
pointer-events: none !important;
<?php endif; ?>
Expand All @@ -39,7 +44,7 @@
max-height: 90vh !important;
overflow-y: auto !important;
border-radius: 0 !important;
<?php if (rex_addon::get('consent_manager')->getConfig('backdrop', '1') === '0'): ?>
<?php if ($addon->getConfig('backdrop', '1') === '0'): ?>
pointer-events: auto !important;
box-shadow: 0 0 20px rgba(0,0,0,0.2) !important;
background: #fff !important;
Expand Down Expand Up @@ -69,9 +74,10 @@
opacity: 1;
}
</style>
<?php endif; ?>
<div class="consent_manager-wrapper" id="consent_manager-wrapper" tabindex="-1" role="dialog" aria-modal="true" aria-labelledby="consent_manager-headline">
<div class="consent_manager-header">
<p class="consent_manager-headline" id="consent_manager-headline" style="margin:0; font-weight:bold; color: inherit;"><?= $consent_manager->texts['headline'] ?></p>
<p class="consent_manager-headline" id="consent_manager-headline"<?php if ('' === $cssFrameworkMode && false === $addon->getConfig('outputowncss', false)) : ?> style="margin:0; font-weight:bold; color: inherit;"<?php endif; ?>><?= $consent_manager->texts['headline'] ?></p>
<button class="consent_manager-close" aria-label="Close" type="button">×</button>
</div>
<div class="consent_manager-wrapper-inner">
Expand Down
2 changes: 1 addition & 1 deletion fragments/ConsentManager/theme_editor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -589,7 +589,7 @@ class="btn <?= $themeBase === $key ? 'btn-primary' : 'btn-default' ?>">
}
</style>

<script>
<script nonce="<?= rex_response::getNonce() ?>">
Comment on lines 588 to +592
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Theme Editor still outputs an inline <style> block without a CSP nonce directly above this script. On installations with a strict CSP that requires nonces for inline styles, adding the script nonce alone won't prevent CSP violations. Consider adding the nonce attribute to the <style> tag as well for consistent CSP compliance.

Copilot uses AI. Check for mistakes.
(function() {
'use strict';

Expand Down