From 622ae7d903d316dc466094e54177dec87800d518 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Wed, 15 Jul 2020 12:23:23 -0400 Subject: [PATCH 01/33] Verify nonce in user_registration hook --- includes/class-gdpr.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/includes/class-gdpr.php b/includes/class-gdpr.php index a19d2ca5..c236eebc 100755 --- a/includes/class-gdpr.php +++ b/includes/class-gdpr.php @@ -296,8 +296,11 @@ public static function similar_in_array( $needle, $haystack ) { public static function save_user_consent_on_registration( $user_id ) { // phpcs:ignore GDPR_Audit_Log::log( $user_id, esc_html__( 'User registered to the site.', 'gdpr' ) ); + if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce_create-user'] ) ), 'create-user' ) ) { + GDPR_Audit_Log::log( $user_id, esc_html__( 'Invalid Security Token.', 'gdpr' ) ); + } + if ( isset( $_POST['user_consents'] ) && is_array( $_POST['user_consents'] ) ) { - $consents = array_map( 'sanitize_text_field', array_keys( wp_unslash( $_POST['user_consents'] ) ) ); // phpcs:ignore foreach ( $consents as $consent ) { /* translators: Name of consent */ From 6ec6a2c5a46905520688274eea49e76a24d13de2 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 16 Jul 2020 10:30:36 -0400 Subject: [PATCH 02/33] Fixed error "Overriding WordPress globals is prohibited". --- admin/partials/settings.php | 4 ++-- includes/class-gdpr-requests.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/admin/partials/settings.php b/admin/partials/settings.php index 36f49423..3cb2cf4e 100755 --- a/admin/partials/settings.php +++ b/admin/partials/settings.php @@ -396,8 +396,8 @@ diff --git a/includes/class-gdpr-requests.php b/includes/class-gdpr-requests.php index 9a588855..97e25a73 100644 --- a/includes/class-gdpr-requests.php +++ b/includes/class-gdpr-requests.php @@ -99,7 +99,7 @@ static function user_has_content( $user ) { if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { $post_count = wpcom_vip_count_user_posts( $user->ID, $pt ); } else { - $post_count = count_user_posts( $user->ID, $pt ); + $post_count = count_user_posts( $user->ID, $pt ); // phpcs:ignore } if ( $post_count > 0 ) { return true; From 3d2716581f580e71ea65bcb4f4cd0cf5e59ac281 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 16 Jul 2020 10:36:15 -0400 Subject: [PATCH 03/33] Changed $type to $consent_type --- public/partials/reconsent-modal.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/public/partials/reconsent-modal.php b/public/partials/reconsent-modal.php index 67a12afe..c7bdc1b4 100755 --- a/public/partials/reconsent-modal.php +++ b/public/partials/reconsent-modal.php @@ -43,13 +43,13 @@
    - $type ) : ?> + $consent_type ) : ?> -
    • +
From 9822cc5f7ff24a58350653e8098453fb99c4ef88 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 16 Jul 2020 15:28:18 -0400 Subject: [PATCH 04/33] Escaped output --- public/partials/reconsent-modal.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/public/partials/reconsent-modal.php b/public/partials/reconsent-modal.php index c7bdc1b4..704bce7c 100755 --- a/public/partials/reconsent-modal.php +++ b/public/partials/reconsent-modal.php @@ -66,9 +66,9 @@ ID, 'panels_data', true ) ) { - echo SiteOrigin_Panels::renderer()->render( $page_obj->ID ); + echo wp_kses_post( SiteOrigin_Panels::renderer()->render( $page_obj->ID ) ); } else { - echo apply_filters( 'the_content', $page_obj->post_content ); + echo wp_kses_post( apply_filters( 'the_content', $page_obj->post_content ) ); } ?> From 1b134b3ccddc81a92ac27ee373ddf5139b71c5e0 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Wed, 5 Aug 2020 08:32:21 -0400 Subject: [PATCH 05/33] Removed set cookie from register & update user hook --- admin/class-gdpr-admin.php | 2 -- includes/class-gdpr.php | 1 - 2 files changed, 3 deletions(-) diff --git a/admin/class-gdpr-admin.php b/admin/class-gdpr-admin.php index 4ab521bd..643336e6 100755 --- a/admin/class-gdpr-admin.php +++ b/admin/class-gdpr-admin.php @@ -912,8 +912,6 @@ public function user_profile_update( $user_id ) { } GDPR_Audit_Log::log( $user_id, $consent ); } - - setcookie( 'gdpr[consent_types]', wp_json_encode( $consents ), time() + YEAR_IN_SECONDS, '/' ); } /** diff --git a/includes/class-gdpr.php b/includes/class-gdpr.php index c236eebc..541831a0 100755 --- a/includes/class-gdpr.php +++ b/includes/class-gdpr.php @@ -311,7 +311,6 @@ public static function save_user_consent_on_registration( $user_id ) { // phpcs: add_user_meta( $user_id, 'gdpr_consents', $consent ); } } - setcookie( 'gdpr[consent_types]', wp_json_encode( $consents ), time() + YEAR_IN_SECONDS, '/' ); } } From e4fe1410e6269d7276f3a9d4f953b03b79279470 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 6 Aug 2020 13:02:40 -0400 Subject: [PATCH 06/33] Added JS version for save_consent & remove_consent --- admin/class-gdpr-admin.php | 41 ++++++++++---------- includes/class-gdpr.php | 9 +++++ public/class-gdpr-public.php | 73 ++++++++++++++++++++++++++++++++++++ src/js/public.js | 52 ++++++++++++++++++++++--- 4 files changed, 150 insertions(+), 25 deletions(-) diff --git a/admin/class-gdpr-admin.php b/admin/class-gdpr-admin.php index 643336e6..c6773143 100755 --- a/admin/class-gdpr-admin.php +++ b/admin/class-gdpr-admin.php @@ -858,26 +858,26 @@ public function edit_user_profile( $user ) { return; } ?> -

- - - $consent ) : ?> - - - - - -
- - - - - - - > - - allowed_html ); ?> -
+

+ + + $consent ) : ?> + + + + + +
+ + + + + + + > + + allowed_html ); ?> +
esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find any consent.', 'gdpr' ), + ) + ); + } + $consent_ids = array_keys( $registered_consent ); + $user = get_user_by( 'ID', $user_id ); + + if ( $user ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + $user_consent = ( ! empty ( get_user_attribute( $user_id, 'gdpr_consents' ) ) ) ? get_user_attribute( $user_id, 'gdpr_consents' ) : array(); + } else { + $user_consent = ( ! empty ( get_user_meta( $user_id, 'gdpr_consents' ) ) ) ? get_user_meta( $user_id, 'gdpr_consents' ) : array(); + } + if ( in_array( $consent, $consent_ids, true ) && ! in_array( $consent, $user_consent, true ) ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + add_user_attribute( $user_id, 'gdpr_consents', $consent ); + } else { + add_user_meta( $user_id, 'gdpr_consents', $consent ); + } + $user_consent[] = $consent; + } + wp_send_json_success( $user_consent ); + } else { + wp_send_json_error( + array( + 'title' => esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find user.', 'gdpr' ), + ) + ); + } + } + + public function remove_user_content() { + $user_id = absint( $_POST['userid'] ); + $consent = esc_html( $_POST['consent'] ); + + $user = get_user_by( 'ID', $user_id ); + if ( $user ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + $user_consent = get_user_attribute( $user_id, 'gdpr_consents' ); + } else { + $user_consent = get_user_meta( $user_id, 'gdpr_consents' ); + } + + $key = array_search( $consent, $user_consent, true ); + if ( false !== $key ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + delete_user_attribute( $user_id, 'gdpr_consents', $consent ); + } else { + delete_user_meta( $user_id, 'gdpr_consents', $consent ); + } + unset( $user_consent[ $key ] ); + wp_send_json_success( $user_consent ); + } + } else { + wp_send_json_error( + array( + 'title' => esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find user.', 'gdpr' ), + ) + ); + } + } } diff --git a/src/js/public.js b/src/js/public.js index e4491912..ed472e08 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -8,13 +8,16 @@ const queryArgs = location.search; const baseUrl = location.protocol + '//' + location.host + location.pathname; window.has_consent = function( consent ) { - if ( Cookies.get( 'gdpr[consent_types]' ) ) { - const consentArray = JSON.parse( Cookies.get( 'gdpr[consent_types]' ) ); - if ( -1 < consentArray.indexOf( consent ) ) { - return true; - } + let consentArray = []; + if ( Cookies.get( 'gdpr_consent_types]' ) ) { + consentArray = JSON.parse( Cookies.get( 'gdpr_consent_types]' ) ); + } else if ( Cookies.get( 'gdpr[consent_types]' ) ) { + consentArray = JSON.parse( Cookies.get( 'gdpr[consent_types]' ) ); } + if ( -1 < consentArray.indexOf( consent ) ) { + return true; + } return false; }; @@ -29,6 +32,45 @@ window.is_allowed_cookie = function ( cookie ) { return false; }; +function save_consent ( userid, consent ) { + + $.post( + GDPR.ajaxurl, + { + action: 'save_user_content', + userid: userid, + consent: consent + }, + function( response ) { + console.log( response.data ); + if ( response.success ) { + Cookies.set( 'gdpr_consent_types', JSON.stringify( response.data ), { expires: 365 } ); + } else { + displayNotification( response.data.title, response.data.content ); + } + } + ); +}; + +function remove_consent( userid, consent ) { + $.post( + GDPR.ajaxurl, + { + action: 'remove_user_content', + userid: userid, + consent: consent + }, + function( response ) { + console.log( response.data ); + if ( response.success ) { + Cookies.set( 'gdpr_consent_types', JSON.stringify( response.data ), { expires: 365 } ); + } else { + displayNotification( response.data.title, response.data.content ); + } + } + ); +} + $( function() { if ( -1 !== queryArgs.indexOf( 'notify=1' ) ) { From b3e5d3a7bb589fd4f2553e5a285f144a36ad520f Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 6 Aug 2020 13:21:33 -0400 Subject: [PATCH 07/33] Set cookie inside JS for update_privacy_preferences() --- public/class-gdpr-public.php | 7 ++++++- src/js/public.js | 15 ++++++++++----- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index 6013dbae..cdb9434d 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -291,7 +291,12 @@ public function update_privacy_preferences() { } } - wp_send_json_success(); + $success_data = array( + 'cookies' => $approved_cookies, + 'consent' => $consent + ); + + wp_send_json_success( $success_data ); } /** diff --git a/src/js/public.js b/src/js/public.js index ed472e08..10136427 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -22,13 +22,16 @@ window.has_consent = function( consent ) { }; window.is_allowed_cookie = function ( cookie ) { - if ( Cookies.get( 'gdpr[allowed_cookies]' ) ) { - const cookiesArray = JSON.parse( Cookies.get( 'gdpr[allowed_cookies]' ) ); - if ( -1 < cookiesArray.indexOf( cookie ) ) { - return true; - } + let cookiesArray = []; + if ( Cookies.get( 'gdpr_allowed_cookies' ) ) { + cookiesArray = JSON.parse( Cookies.get( 'gdpr_allowed_cookies' ) ); + } else if ( Cookies.get( 'gdpr[allowed_cookies]' ) ) { + cookiesArray = JSON.parse( Cookies.get( 'gdpr[allowed_cookies]' ) ); } + if ( -1 < cookiesArray.indexOf( cookie ) ) { + return true; + } return false; }; @@ -94,6 +97,8 @@ $( function() { function( response ) { if ( response.success ) { Cookies.set( 'gdpr[privacy_bar]', 1, { expires: 365 } ); + Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( response.data.cookies ), { expires: 365 } ); + Cookies.set( 'gdpr_consent_types', JSON.stringify( response.data.consent ), { expires: 365 } ); if ( GDPR.refresh ) { window.location.reload(); } else { From aa5a64a649aee4a6274c514c405d532eb2982545 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 6 Aug 2020 15:37:45 -0400 Subject: [PATCH 08/33] Set & remove cookie on ajax success --- public/class-gdpr-public.php | 5 +++-- src/js/public.js | 16 ++++++++++++++-- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index cdb9434d..c6c902b7 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -292,8 +292,9 @@ public function update_privacy_preferences() { } $success_data = array( - 'cookies' => $approved_cookies, - 'consent' => $consent + 'remove_cookies' => $cookies_to_remove, + 'cookies' => $approved_cookies, + 'consents' => $consents ); wp_send_json_success( $success_data ); diff --git a/src/js/public.js b/src/js/public.js index 10136427..b310812c 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -97,8 +97,20 @@ $( function() { function( response ) { if ( response.success ) { Cookies.set( 'gdpr[privacy_bar]', 1, { expires: 365 } ); - Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( response.data.cookies ), { expires: 365 } ); - Cookies.set( 'gdpr_consent_types', JSON.stringify( response.data.consent ), { expires: 365 } ); + + if ( response.data.cookies ) { + Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( response.data.cookies ), { expires: 365 } ); + } + if ( response.data.consents ) { + Cookies.set( 'gdpr_consent_types', JSON.stringify( response.data.consents ), { expires: 365 } ); + } + + if ( response.data.removed_cookies ) { + for ( let i = 0, l = response.data.removed_cookies.length; i < l; i++ ) { + let cookie_name = response.data.removed_cookies[ i ]; + Cookies.remove( cookie_name, { path: '' } ); + } + } if ( GDPR.refresh ) { window.location.reload(); } else { From 6e1fbe938e5e1700435ca1651777e043271ab8f8 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Tue, 11 Aug 2020 13:39:57 -0400 Subject: [PATCH 09/33] Set script tag to 'text/javascript' --- src/js/public.js | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/js/public.js b/src/js/public.js index b310812c..0f85ec53 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -74,6 +74,15 @@ function remove_consent( userid, consent ) { ); } +function set_script_type() { + const scriptsTags = document.getElementsByTagName( 'script' ); + for ( let i = 0; i < scriptsTags.length; i++ ) { + if ( scripts[i].data( 'gdpr' ) && 'performance' == scripts[i].data( 'gdpr' ) ) { + scripts[i].attr( { type: 'text/javascript' } ); + } + } +} + $( function() { if ( -1 !== queryArgs.indexOf( 'notify=1' ) ) { @@ -374,4 +383,10 @@ $( function() { ]; displayNotification( GDPR.i18n.are_you_sure, GDPR.i18n.policy_disagree, actions, true ); } ); + + // set plugin cookie & consent + $( document ).ready( function() { + set_script_type(); + set_plugin_cookies(); + }); } ); From a24d4274a3c22c564a269257acfbdec0277ad425 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Tue, 11 Aug 2020 14:45:47 -0400 Subject: [PATCH 10/33] JS version of set_plugin_cookies() function --- public/class-gdpr-public.php | 24 ++++++++++++--- src/js/public.js | 60 ++++++++++++++++++++++++++++++++++-- 2 files changed, 76 insertions(+), 8 deletions(-) diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index c6c902b7..9240e87e 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -121,12 +121,24 @@ public function enqueue_scripts() { wp_enqueue_script( $this->plugin_name . '-recaptcha', 'https://www.google.com/recaptcha/api.js?hl=' . $lang ); } } + + // User consent + $user_id = get_current_user_id(); + $user_consent = array(); + if ( $user_id ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + $user_consents = (array) get_user_attribute( $user_id, 'gdpr_consents' ); + } else { + $user_consents = (array) get_user_meta( $user_id, 'gdpr_consents' ); + } + } + wp_enqueue_script( $this->plugin_name, plugin_dir_url( dirname( __FILE__ ) ) . 'dist/js/public.js', array( 'jquery' ), $this->version, false ); wp_localize_script( $this->plugin_name, 'GDPR', array( - 'ajaxurl' => admin_url( 'admin-ajax.php' ), - 'logouturl' => is_user_logged_in() ? esc_url( wp_logout_url( home_url() ) ) : '', - 'i18n' => array( + 'ajaxurl' => admin_url( 'admin-ajax.php' ), + 'logouturl' => is_user_logged_in() ? esc_url( wp_logout_url( home_url() ) ) : '', + 'i18n' => array( 'aborting' => esc_html__( 'Aborting', 'gdpr' ), 'logging_out' => esc_html__( 'You are being logged out.', 'gdpr' ), 'continue' => esc_html__( 'Continue', 'gdpr' ), @@ -137,8 +149,10 @@ public function enqueue_scripts() { 'are_you_sure' => esc_html__( 'Are you sure?', 'gdpr' ), 'policy_disagree' => esc_html__( 'By disagreeing you will no longer have access to our site and will be logged out.', 'gdpr' ), ), - 'is_user_logged_in' => is_user_logged_in(), - 'refresh' => get_option( 'gdpr_refresh_after_preferences_update', true ), + 'is_user_logged_in' => is_user_logged_in(), + 'refresh' => get_option( 'gdpr_refresh_after_preferences_update', true ), + 'registered_cookies' => get_option( 'gdpr_cookie_popup_content', array() ), + 'user_consent' => $user_consent, ) ); } diff --git a/src/js/public.js b/src/js/public.js index 0f85ec53..30b72976 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -76,11 +76,65 @@ function remove_consent( userid, consent ) { function set_script_type() { const scriptsTags = document.getElementsByTagName( 'script' ); - for ( let i = 0; i < scriptsTags.length; i++ ) { - if ( scripts[i].data( 'gdpr' ) && 'performance' == scripts[i].data( 'gdpr' ) ) { - scripts[i].attr( { type: 'text/javascript' } ); + $.each( scriptsTags, function( key, value ) { + $(this).attr( 'type', 'text/javascript' ); + } ); +} + +function set_plugin_cookies() { + + //consent + + let consentArray = []; + if ( Cookies.get( 'gdpr_consent_types]' ) ) { + consentArray = JSON.parse( Cookies.get( 'gdpr_consent_types]' ) ); + } else if ( Cookies.get( 'gdpr[consent_types]' ) ) { + consentArray = JSON.parse( Cookies.get( 'gdpr[consent_types]' ) ); + } + + if ( 0 < consentArray.length ) { + let difference = $( GDPR.user_consent ).not( consentArray ).get(); + if ( ! difference ) { + difference = $( consentArray ).not( GDPR.user_consent ).get(); + } + + if ( difference ) { + Cookies.set( 'gdpr_consent_types', JSON.stringify( GDPR.user_consent ), { expires: 365 } ); + } + } else { + if ( 0 < GDPR.user_consent.length ) { + Cookies.set( 'gdpr_consent_types', JSON.stringify( GDPR.user_consent ), { expires: 365 } ); + } else { + Cookies.set( 'gdpr_consent_types', '[]', { expires: 365 } ); } } + + // Cookie + let allowed_cookies = []; + let cookies = []; + if ( Cookies.get( 'gdpr_allowed_cookies' ) ) { + allowed_cookies = JSON.parse( Cookies.get( 'gdpr_allowed_cookies' ) ); + } else if ( Cookies.get( 'gdpr[allowed_cookies]' ) ) { + allowed_cookies = JSON.parse( Cookies.get( 'gdpr[allowed_cookies]' ) ); + } + + if ( GDPR.registered_cookies ) { + $.each( GDPR.registered_cookies, function( key, value ) { + if ( 'required' === value.status || 'soft' === value.status ) { + let used_cookie = value.cookies_used.split( ',' ); + $.each( used_cookie, function( cookie_key, cookie_value ) { + cookies.push( cookie_value ); + }); + } + }); + } + + if ( 0 < cookies.length ) { + Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( cookies ), { expires: 365 } ); + } else { + Cookies.set( 'gdpr_allowed_cookies', '[]', { expires: 365 } ); + } + } $( function() { From 45468d64ce352143d5ebe2c2318c87171248589b Mon Sep 17 00:00:00 2001 From: Moutushi Date: Wed, 12 Aug 2020 16:45:34 -0400 Subject: [PATCH 11/33] Fixed ajax call for save_consent() & remove_consent() functions --- includes/class-gdpr.php | 99 ++++++++++++++++++++++++++++++++++-- public/class-gdpr-public.php | 74 --------------------------- src/js/public.js | 4 +- 3 files changed, 96 insertions(+), 81 deletions(-) diff --git a/includes/class-gdpr.php b/includes/class-gdpr.php index 26d557a6..8fc5904a 100755 --- a/includes/class-gdpr.php +++ b/includes/class-gdpr.php @@ -270,11 +270,11 @@ private function define_public_hooks() { add_action( 'wp_ajax_gdpr_send_request_email', array( $requests_public, 'send_request_email' ) ); add_action( 'wp_ajax_nopriv_gdpr_send_request_email', array( $requests_public, 'send_request_email' ) ); - add_action( 'wp_ajax_save_user_content', array( $plugin_public, 'save_user_content' ) ); - add_action( 'wp_ajax_nopriv_save_user_content', array( $plugin_public, 'save_user_content' ) ); + add_action( 'wp_ajax_save_user_consent', array( $plugin_public, 'save_consent' ) ); + add_action( 'wp_ajax_nopriv_save_user_consent', array( $plugin_public, 'save_consent' ) ); - add_action( 'wp_ajax_remove_user_content', array( $plugin_public, 'remove_user_content' ) ); - add_action( 'wp_ajax_nopriv_remove_user_content', array( $plugin_public, 'remove_user_content' ) ); + add_action( 'wp_ajax_remove_user_consent', array( $plugin_public, 'remove_consent' ) ); + add_action( 'wp_ajax_nopriv_remove_user_consent', array( $plugin_public, 'remove_consent' ) ); } @@ -319,7 +319,6 @@ public static function save_user_consent_on_registration( $user_id ) { // phpcs: } } } - setcookie( 'gdpr[consent_types]', wp_json_encode( $consents ), time() + YEAR_IN_SECONDS, '/' ); } /** @@ -608,6 +607,14 @@ function export_data() { * @return void */ public static function save_consent( $user_id, $consent ) { + if ( wp_doing_ajax() ) { + save_consent_ajax(); + } else { + save_consent_v2( $user_id, $consent ); + } + } + + public static function save_consent_v2() { $registered_consent = get_option( 'gdpr_consent_types', array() ); if ( empty( $registered_consent ) ) { return false; @@ -638,6 +645,48 @@ public static function save_consent( $user_id, $consent ) { return false; } + public static function save_consent_ajax() { + $user_id = absint( $_POST['userid'] ); + $consent = esc_html( $_POST['consent'] ); + + $registered_consent = get_option( 'gdpr_consent_types', array() ); + + if ( empty( $registered_consent ) ) { + wp_send_json_error( + array( + 'title' => esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find any consent.', 'gdpr' ), + ) + ); + } + $consent_ids = array_keys( $registered_consent ); + $user = get_user_by( 'ID', $user_id ); + + if ( $user ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + $user_consent = ( ! empty ( get_user_attribute( $user_id, 'gdpr_consents' ) ) ) ? get_user_attribute( $user_id, 'gdpr_consents' ) : array(); + } else { + $user_consent = ( ! empty ( get_user_meta( $user_id, 'gdpr_consents' ) ) ) ? get_user_meta( $user_id, 'gdpr_consents' ) : array(); + } + if ( in_array( $consent, $consent_ids, true ) && ! in_array( $consent, $user_consent, true ) ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + add_user_attribute( $user_id, 'gdpr_consents', $consent ); + } else { + add_user_meta( $user_id, 'gdpr_consents', $consent ); + } + $user_consent[] = $consent; + } + wp_send_json_success( $user_consent ); + } else { + wp_send_json_error( + array( + 'title' => esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find user.', 'gdpr' ), + ) + ); + } + } + /** * Remove a user consent. * @since 1.1.4 @@ -647,6 +696,14 @@ public static function save_consent( $user_id, $consent ) { * @return void */ public static function remove_consent( $user_id, $consent ) { + if ( wp_doing_ajax() ) { + remove_consent_ajax(); + } else { + remove_consent_v2( $user_id, $consent ); + } + } + + public static function remove_consent_v2() { $user = get_user_by( 'ID', $user_id ); if ( $user ) { @@ -673,6 +730,38 @@ public static function remove_consent( $user_id, $consent ) { return false; } + public static function remove_consent_ajax() { + $user_id = absint( $_POST['userid'] ); + $consent = esc_html( $_POST['consent'] ); + + $user = get_user_by( 'ID', $user_id ); + if ( $user ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + $user_consent = get_user_attribute( $user_id, 'gdpr_consents' ); + } else { + $user_consent = get_user_meta( $user_id, 'gdpr_consents' ); + } + + $key = array_search( $consent, $user_consent, true ); + if ( false !== $key ) { + if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { + delete_user_attribute( $user_id, 'gdpr_consents', $consent ); + } else { + delete_user_meta( $user_id, 'gdpr_consents', $consent ); + } + unset( $user_consent[ $key ] ); + wp_send_json_success( $user_consent ); + } + } else { + wp_send_json_error( + array( + 'title' => esc_html__( 'Error!', 'gdpr' ), + 'content' => esc_html__( 'We could not find user.', 'gdpr' ), + ) + ); + } + } + /** * Generates a random 6 digit pin. diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index 9240e87e..368df8a9 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -464,78 +464,4 @@ public function agree_with_new_policies() { wp_send_json_success(); } - - public function save_user_content() { - $user_id = absint( $_POST['userid'] ); - $consent = esc_html( $_POST['consent'] ); - - $registered_consent = get_option( 'gdpr_consent_types', array() ); - - if ( empty( $registered_consent ) ) { - wp_send_json_error( - array( - 'title' => esc_html__( 'Error!', 'gdpr' ), - 'content' => esc_html__( 'We could not find any consent.', 'gdpr' ), - ) - ); - } - $consent_ids = array_keys( $registered_consent ); - $user = get_user_by( 'ID', $user_id ); - - if ( $user ) { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - $user_consent = ( ! empty ( get_user_attribute( $user_id, 'gdpr_consents' ) ) ) ? get_user_attribute( $user_id, 'gdpr_consents' ) : array(); - } else { - $user_consent = ( ! empty ( get_user_meta( $user_id, 'gdpr_consents' ) ) ) ? get_user_meta( $user_id, 'gdpr_consents' ) : array(); - } - if ( in_array( $consent, $consent_ids, true ) && ! in_array( $consent, $user_consent, true ) ) { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - add_user_attribute( $user_id, 'gdpr_consents', $consent ); - } else { - add_user_meta( $user_id, 'gdpr_consents', $consent ); - } - $user_consent[] = $consent; - } - wp_send_json_success( $user_consent ); - } else { - wp_send_json_error( - array( - 'title' => esc_html__( 'Error!', 'gdpr' ), - 'content' => esc_html__( 'We could not find user.', 'gdpr' ), - ) - ); - } - } - - public function remove_user_content() { - $user_id = absint( $_POST['userid'] ); - $consent = esc_html( $_POST['consent'] ); - - $user = get_user_by( 'ID', $user_id ); - if ( $user ) { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - $user_consent = get_user_attribute( $user_id, 'gdpr_consents' ); - } else { - $user_consent = get_user_meta( $user_id, 'gdpr_consents' ); - } - - $key = array_search( $consent, $user_consent, true ); - if ( false !== $key ) { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - delete_user_attribute( $user_id, 'gdpr_consents', $consent ); - } else { - delete_user_meta( $user_id, 'gdpr_consents', $consent ); - } - unset( $user_consent[ $key ] ); - wp_send_json_success( $user_consent ); - } - } else { - wp_send_json_error( - array( - 'title' => esc_html__( 'Error!', 'gdpr' ), - 'content' => esc_html__( 'We could not find user.', 'gdpr' ), - ) - ); - } - } } diff --git a/src/js/public.js b/src/js/public.js index 30b72976..dab5d83a 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -40,7 +40,7 @@ function save_consent ( userid, consent ) { $.post( GDPR.ajaxurl, { - action: 'save_user_content', + action: 'save_user_consent', userid: userid, consent: consent }, @@ -59,7 +59,7 @@ function remove_consent( userid, consent ) { $.post( GDPR.ajaxurl, { - action: 'remove_user_content', + action: 'remove_user_consent', userid: userid, consent: consent }, From acd012929527cdc9557b1706a2f2f2a64688563f Mon Sep 17 00:00:00 2001 From: Moutushi Date: Wed, 12 Aug 2020 17:05:02 -0400 Subject: [PATCH 12/33] Removed setcookie() & update cookie name gdpr[privacy_bar] to gdpr_privacy_bar --- public/class-gdpr-public.php | 16 ---------------- src/js/public.js | 8 ++++---- 2 files changed, 4 insertions(+), 20 deletions(-) diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index 368df8a9..d6980b89 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -266,22 +266,6 @@ public function update_privacy_preferences() { $cookies_to_remove = array_diff( $all_cookies, $approved_cookies ); - $cookies_as_json = wp_json_encode( $approved_cookies ); - $consents_as_json = wp_json_encode( $consents ); - - setcookie( 'gdpr[allowed_cookies]', $cookies_as_json, time() + YEAR_IN_SECONDS, '/' ); - setcookie( 'gdpr[consent_types]', $consents_as_json, time() + YEAR_IN_SECONDS, '/' ); - - foreach ( $cookies_to_remove as $cookie ) { - if ( GDPR::similar_in_array( $cookie, array_keys( $_COOKIE ) ) ) { // phpcs:ignore - $domain = get_site_url(); - $domain = wp_parse_url( $domain, PHP_URL_HOST ); - unset( $_COOKIE[ $cookie ] ); // phpcs:ignore - setcookie( $cookie, null, -1, '/', $domain ); - setcookie( $cookie, null, -1, '/', '.' . $domain ); - } - } - if ( is_user_logged_in() ) { $user = wp_get_current_user(); GDPR_Audit_Log::log( $user->ID, esc_html__( 'User updated their privacy preferences. These are the new approved cookies and consent preferences:', 'gdpr' ) ); diff --git a/src/js/public.js b/src/js/public.js index dab5d83a..47ef788a 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -159,7 +159,7 @@ $( function() { formData, function( response ) { if ( response.success ) { - Cookies.set( 'gdpr[privacy_bar]', 1, { expires: 365 } ); + Cookies.set( 'gdpr_privacy_bar', 1, { expires: 365 } ); if ( response.data.cookies ) { Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( response.data.cookies ), { expires: 365 } ); @@ -213,7 +213,7 @@ $( function() { $( '[data-category="' + target + '"]' ).prop( 'checked', checked ); } ); - if ( ! Cookies.get( 'gdpr[privacy_bar]' ) ) { + if ( ! Cookies.get( 'gdpr[privacy_bar]' ) || ! Cookies.get( 'gdpr_privacy_bar' ) ) { if ( 0 == $( '.gdpr-reconsent-bar, .gdpr-reconsent' ).length ) { $( '.gdpr.gdpr-privacy-bar' ).delay( 1000 ).slideDown( 600 ); } @@ -257,7 +257,7 @@ $( function() { window.location.reload(); } else { $( '.gdpr-reconsent-bar' ).slideUp( 600 ); - if ( ! Cookies.get( 'gdpr[privacy_bar]' ) ) { + if ( ! Cookies.get( 'gdpr[privacy_bar]' ) || ! Cookies.get( 'gdpr_privacy_bar_' ) ) { $( '.gdpr.gdpr-privacy-bar' ).delay( 1000 ).slideDown( 600 ); }; } @@ -293,7 +293,7 @@ $( function() { $( 'body' ).removeClass( 'gdpr-noscroll' ); $( window ).scrollTop( Math.abs( parseInt( scrollDistance, 10 ) ) ); $( '.gdpr.gdpr-reconsent .gdpr-wrapper' ).fadeOut(); - if ( ! Cookies.get( 'gdpr[privacy_bar]' ) ) { + if ( ! Cookies.get( 'gdpr[privacy_bar]' ) || ! Cookies.get( 'gdpr_privacy_bar_' ) ) { $( '.gdpr.gdpr-privacy-bar' ).delay( 1000 ).slideDown( 600 ); }; } From 6d7018c4c076a466ccc07f54602dd7c5ce9c32e6 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Wed, 12 Aug 2020 17:23:27 -0400 Subject: [PATCH 13/33] Removed set_plugin_cookies() function --- includes/class-gdpr.php | 1 - public/class-gdpr-public.php | 62 ------------------------------------ 2 files changed, 63 deletions(-) diff --git a/includes/class-gdpr.php b/includes/class-gdpr.php index 8fc5904a..a1356894 100755 --- a/includes/class-gdpr.php +++ b/includes/class-gdpr.php @@ -253,7 +253,6 @@ private function define_public_hooks() { add_action( 'wp_enqueue_scripts', array( $plugin_public, 'enqueue_styles' ) ); add_action( 'wp_enqueue_scripts', array( $plugin_public, 'enqueue_scripts' ) ); - add_action( 'init', array( $plugin_public, 'set_plugin_cookies' ) ); add_action( 'wp_footer', array( $plugin_public, 'overlay' ) ); add_action( 'wp_footer', array( $plugin_public, 'privacy_bar' ) ); add_action( 'wp_footer', array( $plugin_public, 'is_consent_needed' ) ); diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index d6980b89..f9050fc3 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -362,68 +362,6 @@ protected function is_crawler() { return ( isset( $_SERVER['HTTP_USER_AGENT'] ) && preg_match( '/bot|crawl|slurp|spider|mediapartners/i', sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) ) ); } - public function set_plugin_cookies() { - - if ( wp_doing_cron() ) return; - - $user_id = get_current_user_id(); - - if ( ! isset( $_COOKIE['gdpr']['consent_types'] ) ) { // phpcs:ignore - if ( ! $user_id ) { - setcookie( 'gdpr[consent_types]', '[]', time() + YEAR_IN_SECONDS, '/' ); - } else { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - $user_consents = get_user_attribute( $user_id, 'gdpr_consents' ); - } else { - $user_consents = get_user_meta( $user_id, 'gdpr_consents' ); - } - setcookie( 'gdpr[consent_types]', wp_json_encode( $user_consents ), time() + YEAR_IN_SECONDS, '/' ); - } - } else { - if ( $user_id ) { - if ( defined( 'WPCOM_IS_VIP_ENV' ) && WPCOM_IS_VIP_ENV ) { - $user_consents = (array) get_user_attribute( $user_id, 'gdpr_consents' ); - } else { - $user_consents = (array) get_user_meta( $user_id, 'gdpr_consents' ); - } - $cookie_consents = (array) json_decode( wp_unslash( $_COOKIE['gdpr']['consent_types'] ) ); // phpcs:ignore - - $intersect = array_intersect( $user_consents, $cookie_consents ); - $diff = array_merge( array_diff( $user_consents, $intersect ), array_diff( $cookie_consents, $intersect ) ); - - if ( ! empty( $diff ) ) { - setcookie( 'gdpr[consent_types]', wp_json_encode( $user_consents ), time() + YEAR_IN_SECONDS, '/' ); - } - } - } - - if ( ! isset( $_COOKIE['gdpr']['allowed_cookies'] ) ) { // phpcs:ignore - $registered_cookies = get_option( 'gdpr_cookie_popup_content', array() ); - $cookies = array(); - if ( ! empty( $registered_cookies ) ) { - $required_cookies = array_filter( - $registered_cookies, function( $item ) { - return 'required' === $item['status'] || 'soft' === $item['status']; - } - ); - if ( ! empty( $required_cookies ) ) { - foreach ( $required_cookies as $category ) { - $cookies_used = explode( ',', $category['cookies_used'] ); - foreach ( $cookies_used as $cookie ) { - $cookies[] = trim( $cookie ); - } - } - } - } - - if ( ! empty( $cookies ) ) { - setcookie( 'gdpr[allowed_cookies]', wp_json_encode( $cookies ), time() + YEAR_IN_SECONDS, '/' ); - } else { - setcookie( 'gdpr[allowed_cookies]', '[]', time() + YEAR_IN_SECONDS, '/' ); - } - } - } - public function agree_with_new_policies() { if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['nonce'] ), 'gdpr-agree-with-new-policies' ) ) { // phpcs:ignore wp_send_json_error( From 47500c4c74d05dddec675c305bf84e5f1536ab85 Mon Sep 17 00:00:00 2001 From: Moutushi Date: Thu, 13 Aug 2020 13:23:02 -0400 Subject: [PATCH 14/33] Removed $_COOKIE & setcookie from privacy_preferences_modal --- public/class-gdpr-public.php | 6 ++---- src/js/public.js | 25 +++++++++++++++++++++++-- templates/privacy-preferences-modal.php | 18 +++--------------- 3 files changed, 28 insertions(+), 21 deletions(-) diff --git a/public/class-gdpr-public.php b/public/class-gdpr-public.php index f9050fc3..4c17977d 100755 --- a/public/class-gdpr-public.php +++ b/public/class-gdpr-public.php @@ -132,6 +132,7 @@ public function enqueue_scripts() { $user_consents = (array) get_user_meta( $user_id, 'gdpr_consents' ); } } + $consent_types = get_option( 'gdpr_consent_types', array() ); wp_enqueue_script( $this->plugin_name, plugin_dir_url( dirname( __FILE__ ) ) . 'dist/js/public.js', array( 'jquery' ), $this->version, false ); wp_localize_script( @@ -153,6 +154,7 @@ public function enqueue_scripts() { 'refresh' => get_option( 'gdpr_refresh_after_preferences_update', true ), 'registered_cookies' => get_option( 'gdpr_cookie_popup_content', array() ), 'user_consent' => $user_consent, + 'consent_types' => $consent_types, ) ); } @@ -195,8 +197,6 @@ public function privacy_bar() { public function privacy_preferences_modal() { $cookie_privacy_excerpt = get_option( 'gdpr_cookie_privacy_excerpt', '' ); $consent_types = get_option( 'gdpr_consent_types', array() ); - $approved_cookies = isset( $_COOKIE['gdpr']['allowed_cookies'] ) ? json_decode( wp_unslash( $_COOKIE['gdpr']['allowed_cookies'] ) ) : array(); // phpcs:ignore - $user_consents = isset( $_COOKIE['gdpr']['consent_types'] ) ? json_decode( wp_unslash( $_COOKIE['gdpr']['consent_types'] ) ) : array(); // phpcs:ignore $tabs = get_option( 'gdpr_cookie_popup_content', array() ); $hide_from_bots = get_option( 'gdpr_hide_from_bots', true ); @@ -208,8 +208,6 @@ public function privacy_preferences_modal() { 'privacy-preferences-modal.php', array( 'cookie_privacy_excerpt' => $cookie_privacy_excerpt, 'consent_types' => $consent_types, - 'approved_cookies' => $approved_cookies, - 'user_consents' => $user_consents, 'tabs' => $tabs, 'allowed_html' => $this->allowed_html, ) diff --git a/src/js/public.js b/src/js/public.js index 47ef788a..b335b0f9 100644 --- a/src/js/public.js +++ b/src/js/public.js @@ -101,23 +101,39 @@ function set_plugin_cookies() { if ( difference ) { Cookies.set( 'gdpr_consent_types', JSON.stringify( GDPR.user_consent ), { expires: 365 } ); } + + $.each( GDPR.consent_types, function( consent_key, consent_data ) { + if ( $.inArray( consent_key, consentArray ) ) { + $( '#' + consent_key ).attr( 'checked', true ); + } else { + $( '#' + consent_key ).attr( 'checked', false ); + } + }); } else { if ( 0 < GDPR.user_consent.length ) { Cookies.set( 'gdpr_consent_types', JSON.stringify( GDPR.user_consent ), { expires: 365 } ); } else { Cookies.set( 'gdpr_consent_types', '[]', { expires: 365 } ); } + $.each( GDPR.consent_types, function( consent_key, consent_data ) { + $( '#' + consent_key ).attr( 'checked', true ); + }); } // Cookie let allowed_cookies = []; let cookies = []; + let privacy_bar = true; if ( Cookies.get( 'gdpr_allowed_cookies' ) ) { allowed_cookies = JSON.parse( Cookies.get( 'gdpr_allowed_cookies' ) ); } else if ( Cookies.get( 'gdpr[allowed_cookies]' ) ) { allowed_cookies = JSON.parse( Cookies.get( 'gdpr[allowed_cookies]' ) ); } + if ( Cookies.get( 'gdpr_privacy_bar' ) ) { + privacy_bar = false; + } + if ( GDPR.registered_cookies ) { $.each( GDPR.registered_cookies, function( key, value ) { if ( 'required' === value.status || 'soft' === value.status ) { @@ -126,15 +142,20 @@ function set_plugin_cookies() { cookies.push( cookie_value ); }); } + + if ( $.inArray( key, allowed_cookies ) && privacy_bar || ( 0 === allowed_cookies.length ) ) { + $( '#' + key ).attr( 'checked', true ); + } else { + $( '#' + key ).attr( 'checked', false ); + } }); } - + if ( 0 < cookies.length ) { Cookies.set( 'gdpr_allowed_cookies', JSON.stringify( cookies ), { expires: 365 } ); } else { Cookies.set( 'gdpr_allowed_cookies', '[]', { expires: 365 } ); } - } $( function() { diff --git a/templates/privacy-preferences-modal.php b/templates/privacy-preferences-modal.php index 287fd757..08bc9dcb 100755 --- a/templates/privacy-preferences-modal.php +++ b/templates/privacy-preferences-modal.php @@ -73,10 +73,10 @@

- +