added support for Osano's cookie consent script (for GDPR and CCPA), …

…see README for details
Erudika · Mar 3, 2020 · 7570326 · 7570326
1 parent 81c79ad
commit 7570326
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 14 deletions.
diff --git a/src/main/java/com/erudika/scoold/utils/ScooldRequestInterceptor.java b/src/main/java/com/erudika/scoold/utils/ScooldRequestInterceptor.java
@@ -204,6 +204,8 @@ public void postHandle(HttpServletRequest request, HttpServletResponse response,
 		modelAndView.addObject("externalScripts", utils.getExternalScripts());
 		// External styles
 		modelAndView.addObject("externalStyles", utils.getExternalStyles());
+		// GDPR
+		modelAndView.addObject("cookieConsentGiven", utils.cookieConsentGiven(request));
 		// CSP nonce
 		String cspNonce = utils.getCSPNonce();
 		modelAndView.addObject("cspNonce", cspNonce);

diff --git a/src/main/java/com/erudika/scoold/utils/ScooldUtils.java b/src/main/java/com/erudika/scoold/utils/ScooldUtils.java
@@ -62,6 +62,7 @@
 import java.util.Optional;
 import java.util.Scanner;
 import java.util.Set;
+import java.util.TreeMap;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
@@ -1159,13 +1160,28 @@ public void setSecurityHeaders(String nonce, HttpServletRequest request, HttpSer
 		}
 	}
 
+	public boolean cookieConsentGiven(HttpServletRequest request) {
+		return !Config.getConfigBoolean("cookie_consent_required", false) ||
+				"allow".equals(HttpUtils.getCookieValue(request, "cookieconsent_status"));
+	}
+
+	public String base64DecodeScript(String encodedScript) {
+		if (StringUtils.isBlank(encodedScript)) {
+			return "";
+		}
+		try {
+			String decodedScript = Utils.base64dec(encodedScript);
+			return StringUtils.isBlank(decodedScript) ? encodedScript : decodedScript;
+		} catch (Exception e) {
+			return encodedScript;
+		}
+	}
+
 	public Map<String, Object> getExternalScripts() {
 		if (Config.getConfig().hasPath("external_scripts")) {
 			ConfigObject extScripts = Config.getConfig().getObject("external_scripts");
 			if (extScripts != null && !extScripts.isEmpty()) {
-				return extScripts.unwrapped().entrySet().stream().
-						sorted((o1, o2) -> o1.getKey().compareTo(o2.getKey())).
-						collect(Collectors.toMap(e -> e.getKey(), e -> e.getValue()));
+				return new TreeMap<>(extScripts.unwrapped());
 			}
 		}
 		return Collections.emptyMap();

diff --git a/src/main/resources/templates/base.vm b/src/main/resources/templates/base.vm
@@ -365,7 +365,7 @@
 			#end
 		#end
 
-		#if ($GOOGLE_ANALYTICS_ID && !$GOOGLE_ANALYTICS_ID.isEmpty())
+		#if ($GOOGLE_ANALYTICS_ID && !$GOOGLE_ANALYTICS_ID.isEmpty() && $cookieConsentGiven)
 		<script nonce="$cspNonce" src="https://www.googletagmanager.com/gtag/js?id=$!{GOOGLE_ANALYTICS_ID}" async></script>
 		<script nonce="$cspNonce">
 			window.dataLayer = window.dataLayer || [];
@@ -375,16 +375,18 @@
 		</script>
 		#end
 		#foreach($externalScript in $externalScripts.entrySet())
-			<!-- External Script: $externalScript.key Begin -->
-			#if($externalScript.value.startsWith("http"))
-				<script nonce="$cspNonce" src="$externalScript.value"></script>
-			#else
-				#set($_extScript = $utils.base64dec($!externalScript.value) )
-				<script nonce="$cspNonce">
-					$!_extScript
-				</script>
+			#if($externalScript.getKey().startsWith("bypassconsent") || $cookieConsentGiven)
+				<!-- External Script: $externalScript.key Begin -->
+				#if($externalScript.value.startsWith("http"))
+					<script nonce="$cspNonce" src="$externalScript.value"></script>
+				#else
+					#set($_extScript = $scooldUtils.base64DecodeScript($!externalScript.value) )
+					<script nonce="$cspNonce">
+						$!_extScript
+					</script>
+				#end
+				<!-- External Script: $externalScript.key End -->
 			#end
-			<!-- External Script: $externalScript.key End -->
 		#end
 	</body>
-</html>
+</html>