(e.g. consent tool * callbacks). * * @since 2.0.0 */ public const FILTER_HEADER_TOP_JS = 'gtm4wp_header_top_inline_js'; /** * Filter reporting whether an AMP page is being generated. The AMP * module makes this return true on AMP requests to suppress the * standard HTML container output. * * @since 2.0.0 */ public const FILTER_AMP_RUNNING = 'gtm4wp_amp_running'; /** * Constructor. * * @param Options $options The plugin options service. * @param DataLayer $datalayer The data layer service. * @param ScriptTag $script_tag The script tag helper. * @param ConsentDefaults $consent The consent mode default state service. */ public function __construct( private Options $options, private DataLayer $datalayer, private ScriptTag $script_tag, private ConsentDefaults $consent ) { } /** * Registers all frontend hooks of the container code output. * * @return void */ public function register_hooks(): void { $header_begin_priority = $this->options->get( GTM4WP_OPTION_LOADEARLY ) ? 2 : 10; add_action( 'wp_head', array( $this, 'header_begin' ), $header_begin_priority, 0 ); add_action( 'wp_head', array( $this, 'header_top' ), 1, 0 ); add_action( 'wp_footer', array( $this, 'footer' ) ); // To be able to easily migrate from other Google Tag Manager plugins. add_action( 'body_open', array( $this, 'body_open' ) ); // Compatibility with existing themes that natively support code injection after the opening body tag. add_action( 'genesis_before', array( $this, 'body_open' ) ); // Genesis theme. add_action( 'generate_before_header', array( $this, 'body_open' ), 0 ); // GeneratePress theme. add_action( 'elementor/page_templates/canvas/before_content', array( $this, 'body_open' ) ); // Elementor. add_action( 'ct_before_builder', array( $this, 'body_open' ), 0 ); // Oxygen Builder. add_action( 'fl_before_builder', array( $this, 'body_open' ), 0 ); // Beaver Builder Theme. // Standard WP theme support for body open tags. add_action( 'wp_body_open', array( $this, 'body_open' ) ); // Exclude the data layer variables from WP Rocket JS minification. add_filter( 'rocket_excluded_inline_js_content', array( $this, 'rocket_excluded_inline_js_content' ) ); } /** * Helper function to translate the GTM container code placement value into a readable string. * * @return string Readable form of a GTM container code placement option. */ public function placement_string(): string { switch ( $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) ) { case GTM4WP_PLACEMENT_FOOTER: return 'footer'; case GTM4WP_PLACEMENT_BODYOPEN: return 'manual'; case GTM4WP_PLACEMENT_BODYOPEN_AUTO: return 'automatic'; case GTM4WP_PLACEMENT_OFF: return 'off'; default: return 'unknown (' . $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) . ')'; } } /** * Function executed during wp_head with high priority. * Outputs some global JavaScript variables that need to be accessible by other parts of the plugin. * * @param boolean $echo_output If set to true and AMP is not generating the page content, the HTML is output immediately. * @return string|void Returns the HTML if the $echo_output parameter is set to false or when AMP page generation is running. */ public function header_top( $echo_output = true ) { $datalayer_name = $this->datalayer->name(); // The data layer initialization has to use 'var' instead of 'let' since 'let' can break related browser extensions and 3rd party scripts. // // Two different jobs on two adjacent lines, which is why the encoders differ // (RI-4's two piles). The first is a string VALUE, so it takes json_literal() // with the hex flags and supplies its own quotes - byte-identical output for // any real name. The second and third are the bare IDENTIFIER, which must not // be quoted or encoded at all; what makes those safe is not an escaper but // ContainerRows::datalayer_name(), which will not return anything that is not // a valid JavaScript identifier (esc_js() could not help here - see the // comment on the global-vars allow-list below, which makes the same point). $_gtm_top_content = ' ' . $this->script_tag->opening_tag() . ' var gtm4wp_datalayer_name = ' . ScriptTag::json_literal( $datalayer_name, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_QUOT | JSON_HEX_APOS ) . '; var ' . $datalayer_name . ' = ' . $datalayer_name . ' || [];'; // Load in the global variables from the gtm4wp_add_global_vars_array / GTM4WP_WPFILTER_ADDGLOBALVARS_ARRAY filter. $added_global_js_vars = (array) apply_filters( GTM4WP_WPFILTER_ADDGLOBALVARS_ARRAY, array() ); foreach ( $added_global_js_vars as $js_var_name => $js_var_value ) { // The name becomes a `const ` declaration, so anything that is not // a valid JavaScript identifier is a syntax error that would kill this // whole '; if ( ! apply_filters( self::FILTER_AMP_RUNNING, false ) ) { if ( $echo_output ) { // Emit through print_script_block() - the same sanitizer the // container code in header_begin() uses - so consent-tool JS added // via FILTER_HEADER_TOP_JS is sanitized identically and, crucially, // gets the ampersand restored. wp_kses() alone turns every bare & // into & with no restore step, which would silently break JS // operators like && and &-joined loader URLs in the head block. // See ScriptTag::print_script_block() (RI-3) for the contract. $this->script_tag->print_script_block( $_gtm_top_content ); } else { return $_gtm_top_content; } } } /** * Renders one GTM4WP_WPFILTER_ADDGLOBALVARS_ARRAY value as a JavaScript literal. * * Dispatches on the ACTUAL type, in order. The previous chain of independent * `if`s tested `empty( $value ) && 0 !== $value` before the array and null * branches, which swallowed three types and rewrote them all to `false`: * null (should be `null`), an empty array (should be `[]`) and the float 0.0 * (should be `0`, since `0 !== 0.0` is true under strict comparison). That * also made the trailing is_null() branch unreachable - it could never see a * null, because the empty() test had already turned it into the string * 'false'. Third-party integrators use this filter, so those were live bugs. * * @param mixed $value The filter-supplied value. * @return string A JavaScript literal, safe for an inline '; return $script_tag; } /** * Console warning shown when the container code placement is set to OFF but * the data layer is still active. * * @return string */ private function console_off_warning(): string { return ' ' . $this->script_tag->opening_tag() . ' console.warn && console.warn("[GTM4WP] Google Tag Manager container code placement set to OFF !!!"); console.warn && console.warn("[GTM4WP] Data layer codes are active but GTM container must be loaded using custom coding !!!"); '; } /** * Console warning shown when the container code is omitted because the * current user has an excluded role. * * @param string $user_role The excluded role that matched the current user. * @return string */ private function disabled_role_warning( string $user_role ): string { // json_literal(), not esc_js(): this is a string VALUE in a raw '; } /** * Console warning shown when the container code is suppressed by the * production-only option or the gtm4wp_output_container filter (the kill * switch) while the data layer stays active. * * @return string */ private function container_suppressed_warning(): string { return ' ' . $this->script_tag->opening_tag() . ' console.warn && console.warn("[GTM4WP] Google Tag Manager container code output has been suppressed on this environment !!!"); console.warn && console.warn("[GTM4WP] Data layer codes are active but GTM container code is omitted !!!"); '; } /** * Builds the GTM container loader snippet for one container row. The * domain, path and ID are validated/escaped by their helper methods. * * @param array $one_container One normalized container row. * @param string $datalayer_name Data layer JS variable name. * @return string */ private function container_loader( array $one_container, string $datalayer_name ): string { $one_gtm_id = (string) ( $one_container[ ContainerRows::COLUMN_ID ] ?? '' ); $_gtm_env = $this->container_environment( $one_container ); // Server side GTM containers can be configured to serve a // single container from the loader path itself; in that case the // container ID is omitted from the query string ("?" instead of // "?id=") so no ID leaks into the request. $_gtm_loader_query = $this->container_omit_id( $one_container ) ? '?\'+dl' : '?id=\'+i+dl'; /* * The four esc_js() calls below are string VALUES inside single-quoted JS * literals, so by RI-4's two-pile rule they belong in pile (b) - the pile * whose members normally get migrated to json_literal(). These four stay, * deliberately, and the reason is recorded here so the next re-derivation of * that ledger finds an answer rather than re-deciding: * * - json_literal() emits DOUBLE quotes. This block is Google's own container * snippet reproduced byte for byte (single quotes throughout, matching 1.x * and every copy of it Google publishes), and BE-1 keeps byte-exact tests * over it. Migrating would change the emitted snippet for every site to buy * nothing. * - Nothing is being reasoned about here on the basis of what the values * "happen to" contain - which is the filing #110 ruled out. Each of the four * passes an enforced allow-list on the way to this line, and none of those * allow-lists admits a quote: the container ID via ContainerRows::GTM_ID_PATTERN * in header_begin() before this method is called, the domain via * FILTER_VALIDATE_DOMAIN in container_domain(), the path via * ContainerRows::PATH_PATTERN in container_path(), and the data layer name via * ContainerRows::datalayer_name() at the reader. esc_js() is therefore a * provable no-op on all four, and the allow-lists are the actual control. * * If any of those four allow-lists is ever widened to admit a quote, this * block has to move to json_literal() and the byte-exact tests updated with it. */ return ' ' . $this->script_tag->opening_tag() . ' (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({\'gtm.start\': new Date().getTime(),event:\'gtm.js\'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!=\'dataLayer\'?\'&l=\'+l:\'\';j.async=true;j.src= \'//' . esc_js( $this->container_domain( $one_container ) ) . '/' . esc_js( $this->container_path( $one_container ) ) . $_gtm_loader_query . ( '' !== $_gtm_env ? "+'" . $_gtm_env . "'" : '' ) . ';f.parentNode.insertBefore(j,f); })(window,document,\'script\',\'' . esc_js( $datalayer_name ) . '\',\'' . esc_js( $one_gtm_id ) . '\'); '; } /** * Returns a HTML code that includes the noscript/iframe part of the Google Tag Manager container. * Can be used to manually place the snippet next to the opening body tag if the installed template * does not support the wp_body_open hook. * * @return string The HTML code that includes the noscript/iframe part of the GTM container code. */ public function get_tag(): string { $no_console_log = (bool) $this->options->get( GTM4WP_OPTION_NOCONSOLELOG ); $containers = $this->containers(); $excluded_role = $this->excluded_user_role(); $_gtm_tag = ' '; if ( GTM4WP_PLACEMENT_OFF === $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) ) { // Placement OFF means the container code (both the head loader and // this noscript iframe) is never auto-emitted; only the data layer // stays active. Mark the code as "written" regardless of the // console-log setting so the iframe block below is always skipped - // otherwise, with console logging disabled, the iframe would still // be output despite the OFF placement. $GLOBALS['gtm4wp_container_code_written'] = true; if ( ! $no_console_log ) { $_gtm_tag .= ' ' . $this->script_tag->opening_tag() . ' console.warn && console.warn("[GTM4WP] Google Tag Manager container code placement set to OFF !!!"); console.warn && console.warn("[GTM4WP] Data layer codes are active but GTM container must be loaded using custom coding !!!"); '; } } elseif ( ! $this->should_output_container() ) { // Kill switch (production-only option / gtm4wp_output_container // filter): suppress the noscript iframe exactly like placement OFF - // mark the code as "written" so the iframe block below is skipped // while the data layer stays active. $GLOBALS['gtm4wp_container_code_written'] = true; if ( ! $no_console_log ) { $_gtm_tag .= $this->container_suppressed_warning(); } } elseif ( '' !== $excluded_role ) { // The user-role exclusion suppresses the container loader in // header_begin(); this iframe is the same container by another route, // so it has to go with it. It used to be emitted regardless, which // meant an excluded user still loaded the container (and was counted // in the reports) whenever JavaScript was unavailable - the exact // case the noscript iframe exists for. Mark the code as "written" so // the iframe block below is skipped, exactly like placement OFF and // the kill switch above; the data layer stays active. $GLOBALS['gtm4wp_container_code_written'] = true; if ( ! $no_console_log ) { $_gtm_tag .= $this->disabled_role_warning( $excluded_role ); } } if ( ( array() !== $containers ) && ( ! ( $GLOBALS['gtm4wp_container_code_written'] ?? false ) ) ) { foreach ( $containers as $one_container ) { $one_gtm_id = (string) ( $one_container[ ContainerRows::COLUMN_ID ] ?? '' ); if ( preg_match( ContainerRows::GTM_ID_PATTERN, $one_gtm_id ) ) { $_gtm_tag .= ' '; } } $_gtm_tag .= ' '; $GLOBALS['gtm4wp_container_code_written'] = true; } return $_gtm_tag; } /** * Outputs a HTML code that includes the noscript/iframe part of the Google Tag Manager container. * * @return void */ public function the_tag(): void { // The iframe's inline style needs `display` and `visibility`. Whether // safecss_filter_attr() strips those depends on the WordPress version: // core added `display` to the safe_style_css default list in 7.0 and // `visibility` in 7.1, so on 6.3-6.9 both are stripped and on 7.0 // `visibility` still is. While the floor is 6.3 this filter is // load-bearing, not belt-and-braces - drop it only in the change that // raises the floor past 7.1, never as a "core allows it now" cleanup. // // Widen the CSS allow-list around THIS wp_kses() call only, then put it back: // safe_style_css is a global WordPress control, so a filter left // registered would relax it for every other wp_kses()/wp_kses_post() call // in the same request - including wp_filter_post_kses on content saved by // users without unfiltered_html, and a REST save is not is_admin(). One // line of our own markup is not a reason to loosen the rule site-wide. add_filter( 'safe_style_css', array( self::class, 'allow_iframe_hiding_styles' ) ); try { // print_markup_block(), not a bare wp_kses(): this block mixes the noscript // iframe (whose src must keep its & entity form) with the console // warning