= 2) and the * script goes through the core ScriptTag sanitizer instead of a raw echo. Port * of integration/axeptio.php from the 1.x pull request. */ final class Axeptio { /** * Constructor. * * @param Options $options The plugin options service. */ public function __construct( private Options $options ) { } /** * Registers the frontend hooks. Nothing is registered unless the * integration is enabled and a project ID is configured. * * @return void */ public function register_hooks(): void { if ( ! $this->options->get( GTM4WP_OPTION_INTEGRATE_AXEPTIO ) || '' === (string) $this->options->get( GTM4WP_OPTION_INTEGRATE_AXEPTIO_PROJECTID ) ) { return; } add_filter( ContainerCode::FILTER_HEADER_TOP_JS, array( $this, 'add_head_js' ), 5, 2 ); // When Axeptio drives Consent Mode v2 it fires the consent default // itself, so GTM4WP must not output its own (would be sent twice). if ( $this->options->get( GTM4WP_OPTION_INTEGRATE_AXEPTIO_CONSENTMODE ) ) { add_filter( ConsentDefaults::FILTER_DEFAULT_ENABLED, array( $this, 'suppress_consent_default' ) ); } } /** * Appends the Axeptio settings object, SDK loader and the data layer * consent bridge to the GTM4WP head block. * * The settings object is JSON encoded with the full hex flag set so no * value can break out of the inline script; the ampersand hex flag also * keeps the block safe when the head block is printed without the * ampersand-restore that ScriptTag::print_script_block() applies. * * @param string $inline_js Inline JS collected so far. * @param string $datalayer_name Name of the data layer JS variable. * @return string */ public function add_head_js( $inline_js, $datalayer_name ) { // json_literal(), not a bare wp_json_encode(): the result is concatenated // into an assignment in the head