Fix: Respect outputowncss setting and add missing CSP nonce#463
Fix: Respect outputowncss setting and add missing CSP nonce#463
Conversation
Fixes #458: Inline CSS and style attributes now only output when 'Use custom CSS' is disabled - Wrap style block in conditional check for outputowncss and css_framework_mode - Make inline style attribute on headline element conditional - Reuse $addon variable to avoid repeated rex_addon::get() calls Fixes #459: Add missing CSP nonce attribute to script tag in theme_editor.php - Backend script now has nonce attribute for CSP compliance Performance: - Store rex_addon::get('consent_manager') in $addon variable - Reuse $cssFrameworkMode variable instead of calling getConfig again
There was a problem hiding this comment.
Pull request overview
This PR updates Consent Manager frontend and backend fragments to better respect the “Use custom CSS” setting and to improve CSP compliance in the theme editor.
Changes:
- Conditionally suppress inline
<style>output and an inlinestyle=""attribute in the consent box whenoutputowncssis enabled. - Add a CSP nonce to the inline
<script>block in the theme editor fragment. - Minor refactor: reuse a single
$addoninstance instead of repeatedrex_addon::get()calls.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| fragments/ConsentManager/box.php | Gates inline CSS/style attribute output behind outputowncss (and framework mode), and reuses $addon for config/i18n calls. |
| fragments/ConsentManager/theme_editor.php | Adds CSP nonce attribute to the inline script block in the theme editor. |
|
|
||
| // Check for CSS Framework Mode | ||
| $cssFrameworkMode = rex_addon::get('consent_manager')->getConfig('css_framework_mode'); | ||
| $cssFrameworkMode = $addon->getConfig('css_framework_mode'); |
There was a problem hiding this comment.
$cssFrameworkMode is read without a default value, but later the fragment does strict checks against an empty string ("'' === $cssFrameworkMode"). If the config value is null on older installs, this will incorrectly suppress the inline CSS/style output even though no framework mode is active. Use the established pattern $addon->getConfig('css_framework_mode', '') so the value is always a string and the comparisons behave as intended.
| $cssFrameworkMode = $addon->getConfig('css_framework_mode'); | |
| $cssFrameworkMode = $addon->getConfig('css_framework_mode', ''); |
| appearance: auto; | ||
| } | ||
| </style> | ||
|
|
||
| <script> | ||
| <script nonce="<?= rex_response::getNonce() ?>"> |
There was a problem hiding this comment.
The Theme Editor still outputs an inline <style> block without a CSP nonce directly above this script. On installations with a strict CSP that requires nonces for inline styles, adding the script nonce alone won't prevent CSP violations. Consider adding the nonce attribute to the <style> tag as well for consistent CSP compliance.
Fixes
Changes
box.php (Issue #458)
theme_editor.php (Issue #459)
Performance improvements
Testing