escopecz / grav-ganalytics

Google Analytics plugin for Grav CMS
MIT License
20 stars 9 forks source link

Confirmation on opt out message string should be escaped #25

Closed marknokes closed 1 year ago

marknokes commented 4 years ago

When adding a single quote to the Confirmation on opt out message, the string is not escaped when output in the DOM causing a javascript error.

marknokes commented 4 years ago

This should take care of it, although, you may have a better solution!

/**
     * Return the Google Analytics Opt Out Code
     * @param string $trackingId Google Analytics Tracking ID
     * @param array $config Out Out settings
     * @return string
     */
    private function getOptOutCode($trackingId, $config)
    {
        $msg = json_encode($config['optoutMessage']);
        $code = <<<JSCODE

            var disableStr = 'ga-disable-$trackingId'; 
            if (document.cookie.indexOf(disableStr + '=true') > -1) { 
                window[disableStr] = true;
            } 
            function gaOptout() { 
                document.cookie = disableStr + '=true; expires={$config['cookieExpires']}; path=/'; 
                window[disableStr] = true; 
                alert($msg); 
            } 

JSCODE;
        return $code;
    }
ViliusS commented 1 year ago

Fixed via https://github.com/escopecz/grav-ganalytics/pull/35