really-simple-plugins/complianz-gdpr

Complianz Privacy Suite (GDPR/CCPA)

This is the Complianz GitHub repository. The Only Privacy Suite for WordPress. We welcome everyone to work together creating a privacy-friendly website experience.

The Privacy Suite for WordPress

At Complianz we are working towards a full-featured privacy suite for all WordPress users to comply with the privacy guideliness for their targeted regions. And we try to make it as easy as possible, while respecting the different guidelines and variability. As privacy is not an easy subject we highly appreciate any feedback, pull requests and issues to further simplify this subject and improve our product, and therefore privacy-friendly websites world-wide and happy users.

Developers Guide and Contributions

If you're a developer and want to help out, please feel free to contribute anyway you can. We respond to any pull request or issue on Github. Start with reading the developers guide to get a head start.

Bug report: Please start an issue, and if you have a fix a pull request. Please explain your issue clearly, and use comments when adding a pull request. Your contribution will be acknowledges on WordPress.org.

New Features: New features can also be assigned to issues. If you want to add a new feature, please see if you can add it to our integrations hub.

Translations: Looking for your own language to be improved or added? Contact support if you want to be a premium contributor, or make your first changes on translate.wordpress.org.

Support

For support we kindly ask you to start at our support forum and our documentation at complianz.io/docs/. If you can't find a solution, do not hesitate to ask either on the forum or log a suppor ticket.

If you like Complianz - Please rate us on WordPress.org

complianz-gdpr's Issues

Cant use shortcode in HTML File

Hello Everyone,

so right now we are in the progress to migrate one of our wordpress elementor pages, which uses a complianz shortcode for legal matters to a html page. Is it possible to integrate the shortcode directly into a div for example?
Thanks in advance.

Legal information

Is there a Legal Document for the plugin that can be shown to a Legal Team to approve the use of this plugin?

In particular, the terms of use and privacy of the plugin itself? It should include details such as:

• does the plugin store personally identifiable information?
• does the plugin send any information to any external server?
• what are the privacy safeguards for any stored information?

and so on. Our legal team is wary of trusting an "open source" tool without these documents.

Accessible checkmarks

Hello,

Some accessibility things came up today:
The small revoke button and the preferences checkmarks are not accessible with keyboard navigation.

The accessibility testing tools are also giving warnings about the use of the labels with those checkmarks:

• There are labels inside labels.
• There are labels with just a svg inside, they need some text.

Thanks for the plugin (noticing more and more companies and semi-government in the Netherlands are changing to your plugin, must be doing something good :-)

Cookie banner layouts broken after upgrade to version 6.0.0

Hi team,
On two different pages, we had bigger layout issues with the cookie banner after upgrading to version 6.0.0 some hours ago.
In case 1), a huge full-size blue "X" was overlaying the whole page.
in case 2), the height of the cookie banner increased by factor 3

Many thanks in advance for dealing with this.
BR, Flo + team.

Screenshots:

Using anonymizeIP not working

complianz-gdpr/cookie/class-cookie-admin.php

Line 2116 in 196eec7

$anonymize_ip = $this->google_analytics_always_block_ip() ? "'anonymizeIp': true" : "";

using "anonymizeIP" doesn't set the aip param which indicates that the use of analytics is anonymized
it should be look like this.
/collect?v=1&_v=j96&aip=1&a=1133263442&t=pageview&

after changing the used anonymizeIP to anonymize_ip after looking
how to set anonymize ip

it was properly set.
can you someone confirm this?

Theme template file override not working

Greetings,

It looks cmplz_get_template has a bug when creating the $theme_file variable. I discovered this issue during local development on Windows but it looks like it would impact *nix as well.

https://github.com/rlankhorst/complianz-gdpr/blob/2d02a2add57499a7d68e95e940d45081323a974c/functions.php#L38-L40

Creating a PR

Admin whitescreen with those errors since uploaded to V6

Hi,
Since I installed the last version of Complianz, my admin is in white screen.

I'm using PHP 8 and the latest version of WP.

Here are the errors I get:
/class-cookiebanner.php on line 1070
[11-Jan-2022 16:19:34 UTC] PHP Warning: fopen(/sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/uploads/complianz/css/banner-1-optin.css): Failed to open stream: No such file or directory in /sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/plugins/complianz-gdpr/cookiebanner/class-cookiebanner.php on line 1119
[11-Jan-2022 16:19:45 UTC] PHP Warning: mkdir(): No such file or directory in /sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/plugins/complianz-gdpr/cookiebanner/class-cookiebanner.php on line 1067
[11-Jan-2022 16:19:45 UTC] PHP Warning: mkdir(): No such file or directory in /sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/plugins/complianz-gdpr/cookiebanner/class-cookiebanner.php on line 1070
[11-Jan-2022 16:19:45 UTC] PHP Warning: fopen(/sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/uploads/complianz/css/banner-1-optin.css): Failed to open stream: No such file or directory in /sites/preprod.tennismajors.com/files/preprod/releases/e88c17ddb5ae7b8afad95d6d26797206a58c1d1f/web/app/plugins/complianz-gdpr/cookiebanner/class-cookiebanner.php on line 1119

What should I do to fix it.

document error?

Hi
I´ve updated to version 6.1 because to debug other issue need it.
The in "Cookie policy document" throws a translation error.
Changed cmplz_sprintf by sprintf solved the issue

complianz-gdpr/config/documents/cookie-policy-eu.php

Line 10 in 1869245

'content' => cmplz_sprintf(_x('Our website, %s (hereinafter: "the website") uses cookies and other related technologies (for convenience all technologies are referred to as "cookies"). Cookies are also placed by third parties we have engaged. In the document below we inform you about the use of cookies on our website.', 'Legal document cookie policy', 'complianz-gdpr'), '[domain]' ),

`<iframe>` are not detected when they stand on multiple lines

I've found this issue with a custom gutenberg block rendering something like:

<iframe
   style="position: absolute; left: 0; top: 0; width: 100%; height: 100%;"
  width="1680"
  height="945"
  src="https://www.youtube.com/embed/{{ block.youtube_video_id }}"
  frameborder="0"
  allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen>
</iframe>

In that case, the regular expression '/<(iframe)[^>]*src=[\'"](http:\/\/|https:\/\/|\/\/)' . $url_pattern . '[\'"].*?>.*?<\/iframe>/i' won't work until s modifier is set (dot all ; see class-cookie-blocker.php, line 257).

Is there any reason to limit the width?

Hi
In (assets/css/document.ss line 218) there is a cmplz-document.max-width: 600px;
This makes text output of the [cmplz-document type="cookie-statement" region="eu"] only show half screen in desktop devices , this maybe works in movile devices but not in desktop screen, it show the text using only half screen. When mixed in a page with other text is strange.

Any reason to make this max-width? Why don´t let the theme manage the width of text display?

Uncaught SyntaxError: missing { before function body

After installing Complianz 4.9.12 I've found a JavaScript error when I use WP Google maps plugin. The error appears on Firefox console as Uncaught SyntaxError: missing { before function body.

Checking ways to fix the error I've found some way to fix it, but i'll be good to have it on github for future updates. The file i've modified is complianz-gdpr/integrations/plugins/wp-google-maps.php

I've swtiched line 59 from:
wp_add_inline_script( 'jquery', "jQuery(document).ready(function($){$script});" );

To:
wp_add_inline_script( 'jquery', "jQuery(document).ready(function($){".$script."});" );

For more information I have Apache 2.4.41, PHP 7.4, WordPress 5.7, Complianz 4.9.12 and WP Google Maps 8.1.11.

Adding support for 3rd party plugins

Hi,
According to the documentation, I should be able to make my plugin show up in Complianz -> Integrations -> Plugins. However, it does not show up. When looking into complianz-gdpr\integrations\fields.php it seems the plugin requires the plugin to be located within the Complianz plugin path - is this correct? (see code from fields.php below).
If yes, it seems a bit hacky to add my own .php files to the integrations/plugins/ directory?

		if ( file_exists( cmplz_path . "integrations/plugins/$plugin.php" ) ) {

*snip*
		}

Thanks in advance!

preg_match_all for iframe is not reliable

Hi,

I found a strange issue on iframe parsing (for replace iframe src for a youtube video for example) :

complianz-gdpr/class-cookie-blocker.php

Lines 231 to 232 in f5abe46

	$iframe_pattern = '/<(iframe)[^>].*?src=[\'"](http:\/\/|https:\/\/|\/\/)' . $url_pattern_iframes . '[\'"].*?>.*?<\/iframe>/is';
	if ( preg_match_all( $iframe_pattern, $output, $matches, PREG_PATTERN_ORDER ) ) {

On one of my website, the youtube placeholder didn't work. Indeed, the preg_match_all return false.

After investigation, it seems that preg_match_all is not reliable on long strings : https://stackoverflow.com/a/27868983/1659617

Maybe you would have to optimize the regex or get just the iframes in first time then in the loop parse the content of the iframe

Code to reproduce :

<?php
$iframe_pattern = '/<(iframe)[^>].*?src=[\'"](http:\/\/|https:\/\/|\/\/)([\w.,;@?^=%&:()\/~+#!\- *]*?)[\'"].*?>.*?<\/iframe>/is';
$html = 'html content'
if ( preg_match_all( $iframe_pattern, $html, $matches, PREG_PATTERN_ORDER ) ) {
  echo 'ok';
}else{
  echo 'ko';
}

If you have a private way, i can send you my html code to reproduce the issue in PHP 7.4.
I am on Wordpress slack, username => ajoah

`class_exists` should not autoload the class

complianz-gdpr/functions.php

Line 2121 in ff1e0dc

&& ! class_exists( 'Classic_Editor' )

When using class_exists to check if Complianz is using the Gutenberg editor, autoloading the class isn't necessary. Trying to autoload the class can lead to some unwanted side-effects with third party autoloaders. This can be avoided by passing false as the second argument to the function.

The Wizard: 1. General -> Security & Consent - not able to click main heading General

For instance when in the Wizard 1.General -> Security & Consent. I am not able to click 1.General and have it automatically select Visitors.

If one is active in a sub menu such as Security & Consent, the top heading menu such as 1.General as in the above case should be active. Main headings should be active independent if one clicks these from inside the same submenu or from another submenu.

Server throw a 520 error

Hi @rlankhorst
I have noticed that some times, when editing banner properties the server throws a 520 error in Cloudflare (unknow error).
In the server error log I have:
pread() read only 3575 of 3909 from ... in the banner-preview-2-optin.css file

Is possible that this file get changed/recreated on the fly at the same time the file get served?
I don´t know if this happen in Apache server, I use nginx.
The solution maybe is recreated the file with a temporary extension and whe the new file is ok, then change it.
Some like a mv command in linux.

Wrong Aria Label

Hi @rlankhorst

<input type="checkbox" aria-checked="true" id="cmplz-functional-optin" data-category="cmplz_functional" class="cmplz-consent-checkbox cmplz-functional" size="40" value="1">

Html validators says aria-checked="true" is not valid with input type="checkbox" .

In https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/Attributes/aria-checked is estated that when posible uses input type and this not need the aria-checked="true".

Here https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/checkbox#attr-checked say how to use <input type="checkbox" and have it marked by default:

<input type="checkbox" checked id="cmplz-functional-optin" data-category="cmplz_functional" class="cmplz-consent-checkbox cmplz-functional" size="40" value="1">

Forgot to tag v6.1.6?

Hi,

Did you forget to tag v6.1.6? I see in de admin an update, but can't update the plugin with composer.

Thanks.

Cookie links don´t have backslash

Hi
In the cookie doc generated by the shortcode [cmplz-document type="cookie-statement" region="eu"] there are some mistakes:

File /functions.php:

line 1909 $cookie->slug -> $cookie->slug .'/'
line 1937 http://complianz -> https://complianz

This make links to be redirected

`cookieFunction` and `collectedPersonalData` sync across different languages

I think that it is an error because multilanguages feature should be enable only on PRO version, but on FREE version (since 4.3.6), I got the select box for languages above the list of cookies.

I'm using WordPress 5.3.2, Complianz GDPR 4.4.1 and Polylang 2.6.10.

Also, the select box is not functionnal (probably because it's the FREE version) and leads to a logic where all cookies with the same name are updated at the same time.

Thanks

The "Google Ads/DoubleClick" setting is ignored

Greeting,

The integrations/services/advertising.php file is included regardless of whether the "Google Ads/DoubleClick" setting is enabled or disabled.

Likely, this line:

complianz-gdpr/integrations/integrations.php

Line 328 in cbd937b

if ( cmplz_get_value( 'uses_ad_cookies' ) ) {

needs to be replaced with:

if ( 'yes' === cmplz_get_value( 'uses_ad_cookies' ) ) { 

Thanks a lot

Make Privacy Policy visible

Hi!

The Privacy Policy must be readable without the cookie banner.
To aply this you can setup following this instructions:
https://complianz.io/excluding-pages-from-the-cookie-banner/
This works fine.
But after this, when a new visitor visit the site:

(1) See the banner
(2) Click on Privacy Link : banner is gone.
(3) Click on any other link:
see this page and banner appears again.

The ideal behaviour is:

(1) See the banner
(2) Click on Privacy Link :
Open in a new window and banner is gone.
Disable all the links in this page: header menu and footer.
This can be done with jQuery checking if the technical cookis are not allowed.

So if we use "cmplz_edit_cookie_settings" in functions, how can we add the "target='_new' attribute in Privacy Policy link?

Regards,
Jordi Pujol
JOINSO

Changes are not stored in database

This branchs show correctly the values from the database, but any change made in the frontend is not stored.
We have to update the database directly to make changes.
Regards,
Jordi Pujol
JOINSO

Integrating FacetWP Maps to be compliant with GDPR

Hi

We're currently using Complianz Privacy Suite (GDPR/CCPA) premium version 6.0.14 with FacetWP version 3.9.5 and FacetWP Map version 0.9.3.

We're facing an issue in turning our standard FacetWP Map implementation into a GDPR compliant one. We would like to put a placeholder instead of the actual map and let FacetWP fire only when the user has given its consent, as documented here.

The problem is that cmplz_custom_googlemaps_script function and cmplz_dependencies filter documented in the previous link seem to target a function name as a dependency, and FacetWP Map seem to use an anonymous function as a jQuery event listener callback to initialize Google custom map:

$().on('facetwp-loaded', function() {
            FWP_MAP.map = new google.maps.Map(document.getElementById('facetwp-map'), FWP.settings.map.init);
            // more script
}

So I'm not sure what kind of dependency I could pass to cmplz_dependencies filter

function cmplz_custom_maps_dependencies( $tags ) {
	$tags['maps.googleapis.com'] = 'script-that-should-wait';
	return $tags;
}
add_filter( 'cmplz_dependencies', 'cmplz_custom_maps_dependencies' );

Maybe that is not an issue and I do not see how to make it work, but is there a way to use Complianz hooks or other kind of implementation to make FacetWP Map initialize on user consent?

Forces my website to become "full width"

Hi,
Great plugin overall, although I have one small issue:
Once I enable the plugin my site becomes full width.
When I disable the plugin it becomes boxed again.

For reference: www.depantyshop.nl
Maybe I am doing something wrong... maybe it is a bug.

Create releases

Thank you for the great plugin!

Today I came across this repository and I'm wondering if you can create releases tags in de repository? We use composer with Wordpress and that way we can easy install the complainz plugin, but now we install the dev-master with all the latest commits. To insure a stable wordpress installation we need release versions of the plugin.

Cookie Policy: No document option?

I see this Documents screen.

Thinking basic I would likely not create a Cookie Policy page but instead have a Privacy Statement. (For my case a GDPR page to use in Norway.)

Perhaps I am mixing Cookie Policy with Privacy Statement. Currently we just have a GDPR page telling the user how we use cookies and how their privacy is taken care of.

Bottom line is that I become a bit confused. As I do not want to create a Cookie Policy but instead create a Privacy Statement that will cover the various needs.

HTML entities in rendered cookies scripts

I've found a issue when I set up a custom script under Integrations > Scripts center.

The code I try to input is like:

var __sf_config = {
    customer_id: 00000,
    host: 'mails.anonymous.com',
    ip_privacy: 0,
    subsite: 'xwflsd-89kjgl-6789fjjgf',
    __img_path: "/web-next.gif?"
};
var e, t;
var n = 10;
var r = 0;
e = document.createElement("script");
e.type = "text/javascript";
e.async = true;
e.src = "//" + __sf_config.host + "/js/frs-next.js";
t = document.getElementsByTagName("script")[0];
t.parentNode.insertBefore(e, t);
var i = function() {
    if (r < n) {
        r++;
        if (typeof frt !== "undefined") {
            frt(__sf_config);
        } else {
            setTimeout(function() {
                i();
            }, 500);
        }
    }
};
i();

When I save settings, the script is HTML encoded in database (option: complianz_options_wizard), like so:

(...)
s:14:"cookie_scripts";s:...:"var __sf_config = { customer_id: 00000, host: 'mails.anonymous.com', ip_privacy: 0, subsite: 'xwflsd-89kjgl-6789fjjgf', __img_path: "/web-next.gif?" }; var e, t; var n = 10; var r = 0; e = document.createElement("script"); e.type = "text/javascript"; e.async = true; e.src = "//" + __sf_config.host + "/js/frs-next.js"; t = document.getElementsByTagName("script")[0]; t.parentNode.insertBefore(e, t); var i = function() { if (r < n) { r++; if (typeof frt !== "undefined") { frt(__sf_config); } else { setTimeout(function() { i(); }, 500); } } }; i();";
(...)

As we can see, after the < character is HTML protected, and everything after it is also HTML protected, and when it's displayed in the <script> tag, it does not work and leads to a Javascript Error:

<script class="cmplz-native">
				function complianz_enable_cookies() {
					console.log("enabling cookies");
					var __sf_config = { customer_id: 00000, host: 'mails.anonymous.com', ip_privacy: 0, subsite: 'xwflsd-89kjgl-6789fjjgf', __img_path: "/web-next.gif?" }; var e, t; var n = 10; var r = 0; e = document.createElement("script"); e.type = "text/javascript"; e.async = true; e.src = "//" + __sf_config.host + "/js/frs-next.js"; t = document.getElementsByTagName("script")[0]; t.parentNode.insertBefore(e, t); var i = function() { if (r &lt; n) { r++; if (typeof frt !== &quot;undefined&quot;) { frt(__sf_config); } else { setTimeout(function() { i(); }, 500); } } }; i();				}
			</script>

I've changed the script to work around this issue, but it could be solved.

jQuery compatibility

As mentionned here: https://stackoverflow.com/questions/5788499/jquery-iframe-load-event, we're supposed to use $('selector').on('load',function(){}); instead of $('selector').load( function(){} );

Issue stands at line 228 of assets/js/cookieconfig.js

Bad French Translation for Statistics Consent Preferences

I'm using Polylang to translate Complianz strings to French. Everything works fine except for the translation of the term "Statistics" displayed in the consent preferences. For some reason the cookie stat consent is translated incorrectly to "Fonctionnel" instead of "Statistiques" as translated in Polylang. It may be a Polylang bug, but it doesn't look like since other cookie consent options (Functional, Marketing) are correctly translated.

An invalid form control with name='cmplz_uses_ad_cookies_personalized' is not focusable.

In the Wizard, Cookies step, that belongs to this url: admin.php?page=cmplz-wizard:
The "Next" doest not work.
This is the error in the browser console:
An invalid form control with name='cmplz_uses_ad_cookies_personalized' is not focusable.

Regards,
Jordi Pujol
JOINSO

Documentation link 404

On /wp-admin/admin.php?page=cmplz-script-center > Script Centre > Whitelist a script, iframe or plugin

URLs that should be whitelisted. For more information, please read this article.

"article" links to https://complianz.io/script-center#whitelist but I think should link to https://complianz.io/whitelisting-inline-script/

Social Media and Google Fonts

Hi,
I have two things (little issues) that I noticed.

1. If a website is not using google fonts and host the fonts direct on the server, the assistent find a non existing google fonts service.

2. There is only the option to say yes or no to the social media point. If you choose no, it is not correct and if you choose yes, it does not fit for a shariff solution.

Thank you so far for offering this good, but not perfect solution.

Cheers,
Heiko

Missing checkout eCommerce events from Woocommerce Google Analytics Integration

Hello,
thanks a lot for this plugin!

I have just one problem after starting using it. There are no tracked sessions with transactions anymore.

We weren't made any changes in the configuration of https://github.com/woocommerce/woocommerce-google-analytics-integration everything worked fine before activating Complianz.

Could you check that, pls?
Thank you!

Undesired page reload when denying / dismissing cookie banner

Good afternoon.

Today, I updated a wordpress installation to Complianz 6, updated my custom CSS to work as before and stumbled on a very small issue.

After denying cookies, the page is reloaded without an apparent reason. This does not happen when accepting, however.
I tried to disable all integrations and activate the safe mode, but it did not change anything.

In case it helps: I use Complianz to display an Info box about our privacy practices (a consent is not needed for us) and hide all but the "deny" button.

I can work around the problem myself, so this issue is more of an information for you. Thank you very much for creating this useful plugin.

Create documents screen

I went through the Wizard and I am now on the Create documents screen.

"You can update the page titles here if you want, then click the "Update pages" button." ----> What does this do?

"You haven't selected any legal documents to create. You can skip this step" ---> add punctuation and have skip as an active link. I assume this would be the same as clicking "Save and Continue"

When cookies are accepted, events with DOMContentLoaded are executed twice

Hi,

In a website, we're using some scripts written in Vanilla JavaScript.

We noticed that scripts loaded with a window.addEventListener('DOMContentLoaded', function(event) {} are executed twice only if cookies are accepted.

As an example, this code will create two paragraph at the bottom of the page:

window.addEventListener('DOMContentLoaded', function(event) {
	var p = document.createElement('p');

	p.innerHTML = 'a paragraph';

	document.body.appendChild(p);
});

If the cookies are not accepted, there is no problem.

find_wordpress_base_path() returns incorrect WP base directory

Hello,

This script causes a 500 error when executed in my WP environment. I have placed WP core into its own directory, but have kept wp-config in public_html.

The problem arises as a result of find_wordpress_base_path() traversing the directory structure until it finds wp-config - but when it finds that file it assumes that wp-load will be in the same directory, which it isn't.

The code in question that is causing the issue is on line 87. The path that this function returns is then used (starting on line 11) to require wp-load and a few other key scripts from WP core, which causes a fatal error in my case as these scripts are not found.

My suggestion would be to modify the script to use the path specified in ABSPATH and remove the find_wordpress_base_path function entirely as it makes unfounded assumptions about the environment.

Hope this helps!

script defer in integrations

Hi @rlankhorst

In /integraion/plugins/lazyloader.php line 21 is this code:
wp_add_inline_script( 'cmplz-cookiebanner', $script);
So inline the script with the cmplz-cookiebanne handler.

In /cookie/class-cookie-admin.php line 1756 is this:

public function add_asyncdefer_attribute($tag, $handle) {
                        if ( $handle === 'cmplz-cookiebanner' || $handle === 'cmplz-tcf' ) {
                                return str_replace( '<script ', '<script defer ', $tag );
                        }
                        return $tag;
                }

So the defer is added to a inlined snippet withour src attribute.

How can this be solved?

Website information section.

The Wizard - Website information.

Owner of the website?
What is your address?
... and other fields.

The above fields will show up independent of selecting to have Complianz create a document or not.
Website information is really just about adding information to a possible created document which Complianz will create if the user added the option to do so.

Bottom line is if user selects to have Complianz create a document then the Website information screen is needed. As have a GDPR page already created I would like to skip this page.

I do not see a way to skip page. I will instead need to click the next link in the left Wizard menu.

Youtube iframe and lazyload with lazysizes

Hi
We use the 6.0.1 version of this pligin and a plugin based on aFarcas lbrary for lazyload images and iframes (https://github.com/aFarkas/lazysizes).
This libray put a class "lazyload" to the iframe and changes src with data-src for the video url.
When cookies are not acepted all works as spected, image placeholder and button to accept marketing cookies is present, but when cookies are accepted no video is showed, only the image placeholder, and js throw a error in complianz.min.js file.
If lazyload for iframes is disabled all works, but if cookies are acepted the iframe resources are loaded at page start.
As a workaround I have done some changes to plugin files and it works now, when cookies are not accepted the iframe don´t load and when accepted the iframe is lazyloaded.
The changes I have done are:
comment the line 377 in the file class-cookie-blocker.php
change src to data-src in lines 543 and 561 in the file complianz.js

Can these changes be included in the plugin in some way?
Some like:
In php file:

$aFarcas = str_contains($new,'lazyload'); . . if (!$aFarcas) $new = $this->replace_src( $new, apply_filters( 'cmplz_source_placeholder', 'about:blank' ) );

In js file:

let origin ='src'; if (obj.classlist.contains('lazyload')) { let origin = 'data-src';} obj.setAttribute('origin', src);

Thanks in advance

Initial feedback

Hi

I searched Github and discovered this repo with the purpose of testing the newest beta version.
It would be helpful to list the beta version in this list: https://github.com/Really-Simple-Plugins/complianz-gdpr/branches making it easier to download and test.

I have downloaded and will test the main version here on Github. NB! EDIT: Ahh so I downloaded version 6.0. That was not easy to know before having installed the plugin.

I opened the readme and noticed this:

"At Complianz we are working towards a full-featured privacy suite for all WordPress users to comply with the privacy guideliness for their targeted regions. And we try to make it as easy as possible, while respecting the different guidelines and variability. As privacy is not an easy subject we highly appreciate any feedback, pull requests and issues to further simplify this subject and improve our product, and therefore privacy-friendly websites world-wide and happy users."

First of all I would perhaps do a more step by step procedure. (The following just shows my own basic understanding of privacy.)

1. A very basic privacy overview. User selects type of privacy region - GDPR etc. Selects to either create a new privacy page or use an existing page. Here there could for instance be a link to suggestions for various privacy pages. User sees the following buttons: Accept and Dismiss, and a text link to a privacy page.

2. A more intermediate privacy overview adding in additional areas.

3. Advanced privacy adding in additional areas.

The reason why I write the above is that going through the steps in the wizard to select various options are for some areas more of a guessing game then an educated selection knowing why one selects the options one does. Having a simple approach to get it working would be helpful. One could of course be advised to continue with step 2 when ready to do so. The basic approach should be good enough for basic privacy. (Basic privacy might not cover all aspects that are needed. Which means having information on why to continue with step 2 would be helpful.)

Area that is covered by all steps. Such as customizing the banner. Btw add an option to always show the banner on the frontend of the site. Clicking always show banner on frontend one could see the preview in the backend and also see what it looks like on the frontend. (At the moment I am having a difficult time seeing it on the frontend.)

I will likely edit the above to add in additional information and/or just post additional comments.

`<iframe data-src-cmplz` replacement failure

I've found this issue with a custom gutenberg block rendering something like (like #244):

<iframe
   style="position: absolute; left: 0; top: 0; width: 100%; height: 100%;"
  width="1680"
  height="945"
  src="https://www.youtube.com/embed/{{ block.youtube_video_id }}"
  frameborder="0"
  allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen>
</iframe>

In that case, the replacement of "<iframe " won't work because there is no space after the opening <iframe> tag (it is a new line ; see class-cookie-blocker.php, line 265).

.cmplz-manage-consent::before => Only works in theme css not in Plugin css

Hi:

Following the tutorial to add an icon in revoke consent, i realize that if you put the css in the plugin css editor not run, only works if you put that css in theme css or external css plugin

Is normal behaivour? what is the reason?

.cmplz-manage-consent::before {
font-family: “Font Awesome 5 Free”;
font-weight: 900;
content: “\f564”;
display: inline-block;
padding-right: 10px;
vertical-align: middle;
color: white;
}

I report that last week and a support aggent says me in the next plugin version should be solved but in the new 6.0.3 version it still hapening

Thxs for supporting

1 task open - Clicking Continue Wizard starts out at the beginning.

I went through the Wizard and end up having 1 remaining task (perhaps because I did not fill out the website information fields).

This means I have to click the Continue Wizard button. It starts out from the first page. I see a check next to various screens I have already gone through. As there is no check next to the Website information it seems that this is the only page I need to fill out to be finished with all the tasks. It would be helpful if the wizard continued on the remaining task instead of at the beginning.

Sometimes the banner does not refresh with the actual consent settings

I try to describe this little bug for steps
-) After the first consent (an Accept all), reopen the banner to manage cookie consent and click on "View preferences".
-) Disable (deny) Statistics and Marketing cookies clicking on the two checkboxes.
At this point, if you click on "Accept all" (instead of "Save preferences") and you reopen the banner without a page refresh, you'll see the checkboxes unsetted, but consents are present and active (because of "Accept all").

Thank you!

BURP Report SQL Injection

Hello,

I'm not good in security so I want to share with you the BURP report of my site with the extension Complianz | GDPR/CCPA Cookie Consent 5.4.0.

Issue detail

The cmplz_statistics-anonymous parameter appears to be vulnerable to SQL injection attacks. The payloads 75931905' or 3537=3537-- and 15309448' or 8285=8289-- were each submitted in the cmplz_statistics-anonymous parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

I don't know if it is a security fail?

Ver 6.0 - Preview cutoff in backend.

Hi

I am testing version 6.0 and hope that this is the place where you want feedback in regards to the new version.

The cutoff here of the preview looks like a bug.

I noticed when hovering over the preview that the preview moved to the left so one can fully view the banner. Having it peak out halfway when not being hovered just feels like a bug. It just feels wrong and out of place. Like a painting hanging almost straight but not straight enough so that one has to just adjust it.

Please have the banner show fully. Yes it will cover options. One could of course just add a circle with a X at the top left corner of the banner so one can click the X and hide the banner. Which will automatically switch on the Hide preview toggle.

Btw do also include a test option to always show on frontend, so one can also go to the frontend and view what it looks like there as well.

do not show cookie banner to googlecrawler

is there a way that the google crawler ignores the cookie banner? This would make sense for SEO reasons. Unfortunately I can't find anything in the settings.
many greetings
Iloivar

Suggestion: overlay option for cookie modal

It would be great if you add an option to add a overlay and block scroll whit the cookie modal/banner until they accept the cookies, i mean, the thing that shadows the rest of the page and do not let you interact whit the rest of the page.
That would be better for compliance whit the GDPR