steve/att-consent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening and accessibility improvements (v1.1.0)

Browse Source 
Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Steve Hanlon
2026-02-18 10:32:16 +00:00
parent 0a73181ea7
commit 2294c8eda7
7 changed files with 146 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
includes/class-frontend.php
View File

@@ -80,7 +80,9 @@ g('js',new Date());
if(c.ads_data_redaction){g('set','ads_data_redaction',true);}
if(c.url_passthrough){g('set','url_passthrough',true);}
var ck=document.cookie.match(/(?:^|; )att_cc_consent=([^;]*)/);
var st=ck?JSON.parse(decodeURIComponent(ck[1])):null;
var st=null;
if(ck){try{st=JSON.parse(decodeURIComponent(ck[1]));}catch(e){}}
if(st){
g('consent','default',{
ad_storage:st.marketing?'granted':'denied',
@@ -235,10 +237,10 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
esc_attr( $s['btn_preferences_text'] )
);
$banner_html = '<div id="att-cc-banner" class="' . esc_attr( $position_class ) . '" role="dialog" aria-label="' . esc_attr__( 'Cookie consent', 'att-consent' ) . '" aria-hidden="false" style="' . $style_vars . '">
$banner_html = '<div id="att-cc-banner" class="' . esc_attr( $position_class ) . '" role="dialog" aria-labelledby="att-cc-banner-heading" aria-hidden="false" tabindex="-1" style="' . $style_vars . '">
<div class="att-cc-banner__inner">
<div class="att-cc-banner__content">
<h2 class="att-cc-banner__heading">' . esc_html( $s['banner_heading'] ) . '</h2>
<h2 id="att-cc-banner-heading" class="att-cc-banner__heading">' . esc_html( $s['banner_heading'] ) . '</h2>
<p class="att-cc-banner__message">' . wp_kses_post( $s['banner_message'] ) . '</p>
</div>
<div class="att-cc-banner__actions">
@@ -249,10 +251,10 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
</div>
</div>';
$modal_html = '<div id="att-cc-modal" role="dialog" aria-label="' . esc_attr__( 'Cookie preferences', 'att-consent' ) . '" aria-hidden="true" aria-modal="true" style="' . $style_vars . '">
$modal_html = '<div id="att-cc-modal" role="dialog" aria-labelledby="att-cc-modal-heading" aria-hidden="true" aria-modal="true" style="' . $style_vars . '">
<div class="att-cc-modal__overlay"></div>
<div class="att-cc-modal__dialog">
<h2 class="att-cc-modal__heading">' . esc_html__( 'Manage Cookie Preferences', 'att-consent' ) . '</h2>
<h2 id="att-cc-modal-heading" class="att-cc-modal__heading">' . esc_html__( 'Manage Cookie Preferences', 'att-consent' ) . '</h2>
<div class="att-cc-modal__category">
<div class="att-cc-modal__cat-header">