steve/att-consent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor script injection to type="text/plain" inert pattern

Browse Source 
Custom scripts are now rendered as inert <script type="text/plain"
data-att-cc-category="..."> tags in the page HTML. On consent,
consent-manager.js scans the DOM and activates matching elements.
This replaces the JSON-in-config approach and allows third-party
plugins (e.g. HFCM) to output consent-gated scripts using the
same data attribute convention.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Steve Hanlon
2026-02-17 09:28:11 +00:00
parent 256a4a9dec
commit 0a73181ea7
4 changed files with 131 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
includes/class-frontend.php
View File

@@ -30,6 +30,10 @@ class ATT_Consent_Frontend {
// Priority 2: gtag.js or GTM (Advanced mode only).
add_action( 'wp_head', array( $this, 'output_tracking_script' ), 2 );
// Custom scripts as inert type="text/plain" tags.
add_action( 'wp_head', array( $this, 'output_custom_scripts_head' ), 99 );
add_action( 'wp_footer', array( $this, 'output_custom_scripts_footer' ), 99 );
// Footer: banner HTML.
add_action( 'wp_footer', array( $this, 'output_banner_html' ), 5 );
@@ -58,9 +62,6 @@ class ATT_Consent_Frontend {
$config['tracking_snippet'] = $this->get_tracking_snippet();
}
// Pass custom scripts for conditional injection.
$config['scripts'] = ATT_Consent_Scripts_Manager::get_scripts_for_frontend();
$config_json = wp_json_encode( $config );
?>
@@ -170,6 +171,20 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
return '';
}
/**
* Output custom scripts in <head> as inert type="text/plain" tags.
*/
public function output_custom_scripts_head() {
echo ATT_Consent_Scripts_Manager::render_scripts_as_html( 'head' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- contains script/template tags.
}
/**
* Output custom scripts in footer as inert type="text/plain" tags.
*/
public function output_custom_scripts_footer() {
echo ATT_Consent_Scripts_Manager::render_scripts_as_html( 'footer' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- contains script/template tags.
}
/**
* Enqueue frontend assets.
*/