OFFLINE-GmbH / oc-gdpr-plugin

October CMS plugin to make websites GDPR and ePrivacy compliant
https://octobercms.com/plugin/offline-gdpr
MIT License
36 stars 20 forks source link

Clicking 'Accept' won't trigger code, advanced settings page works #65

Closed pixelpanik closed 4 years ago

pixelpanik commented 4 years ago

While I'm on the advanced settings page and give consent to my cookie provider and hit save, the gdpr cookie ist set and the code in my gpdr.htm partial is triggered and shown (I used some simple HTML output to test). So this works.

But when I click the 'Accept' Button on the banner, the code in the partial is not outputted.

Looking at the network request I see a POST request and the JSON Answer is gdpr: with content {"gdpr":""}, which somehow looks empty? Is this this some kind of misconfiguration?

Any help is greatly appreciated!

tobias-kuendig commented 4 years ago

This looks like your updatePartial and updateSelector values are wrong. Check what is in those variables:

https://github.com/OFFLINE-GmbH/oc-gdpr-plugin/blob/develop/components/cookiebanner/optin.htm#L8

Defaults:

[cookieBanner]
include_css = 1
update_partial = "gdpr"
update_selector = "#gdpr-reload"
pixelpanik commented 4 years ago

Thanks for the quick reply.

updatePartial and updateSelector should be ok.

When I activate the flag "Required for the Website to Function and Work" in my cookie group, the code in the conditional in the gdpr partial is shown (which is odd as we do not want a required cookieGroup here, that can't be revoked on the cookies page) .

gdpr:

{% if gdprCookieAllowed('matomo') %}
    <h1>Allow Matomo Cookies // add js <h1>
{% endif %}

Refer to https://github.com/OFFLINE-GmbH/oc-gdpr-plugin/blob/560169e099f2af8df7957758718c999834e2f12a/classes/cookies/ConsentCookie.php#L104 where the cookieGroup must be required.

Any advise on this? Is it a misconfiguration or am I just blind to see the problem?

tobias-kuendig commented 4 years ago

Setting a cookie as required means that it will always be enabled, even without a user's consent. This is for things like October's session cookie. These cookies are allowed to be included without consent if they are absolutely required for the page to work correctly.

Your Matomo cookie is not a required cookie. It should only be added if the user accepts it.

Might this be the missunderstanding or do I not understand your question correctly?

pixelpanik commented 4 years ago

The differences between the cookies required for the page to work correctly and additional cookies is clear to me.

The problem still persists that for those not mandatory cookies the conditional {% if gdprCookieAllowed('matomo') %} somehow returns false and the soft reload is not happening and no cookie code is applied.

Do you mind to check this on our dev site [url removed]?

The plugin is awesome, we only need to get it working :) Thank you very much!

tobias-kuendig commented 4 years ago

It looks like you currently only have one cookie registered:

http://hella-bulbs.trustpb.de/en/cookies

Do you have its initial state set to active?

image

pixelpanik commented 4 years ago

Ahhh. No, didn't set this to active. Thought this would mean that the cookie is always active (even without giving consent). Maybe I was misleaded by the copy "Have turned on at Start-up. This cookie is enabled by default".

So now it's working as excepted. Solution only one click ;) Thank you very much Tobias. Really appreciated and keep up the good work.