tag, * which is what a consent manager does through script_loader_tag - is a * documented way for a site to withhold every media provider's SDK request, * so the name is part of the plugin's contract rather than an internal detail. * * Not every tracker: four of them fetch nothing (HTML5 media, Wistia, JW * Player, VideoPress), so they neither enqueue the gate nor depend on it, and * a site running only those never receives it at all - there would be no * vendor request for it to withhold (#143). * * NOT dequeuing: see the note in enqueue_media_tracker(). Each SDK-fetching * tracker declares this handle as a dependency, and WordPress re-adds a * registered dependency to the print queue whether or not it was dequeued, so * wp_dequeue_script() on this handle has no effect at all. The server-side * switch is the gtm4wp_media_sdk_blocked filter. */ public const GATE_HANDLE = 'gtm4wp-media-gate'; /** * Module id. * * @return string */ public function id(): string { return 'media-events'; } /** * Option defaults, 1.x compatible. * * @return array */ public function defaults(): array { return array( GTM4WP_OPTION_EVENTS_YOUTUBE => false, GTM4WP_OPTION_EVENTS_VIMEO => false, GTM4WP_OPTION_EVENTS_SOUNDCLOUD => false, GTM4WP_OPTION_EVENTS_HTML5MEDIA => false, GTM4WP_OPTION_EVENTS_DAILYMOTION => false, GTM4WP_OPTION_EVENTS_DAILYMOTION_PLAYERID => '', GTM4WP_OPTION_EVENTS_MIXCLOUD => false, GTM4WP_OPTION_EVENTS_CLOUDFLARESTREAM => false, GTM4WP_OPTION_EVENTS_WISTIA => false, GTM4WP_OPTION_EVENTS_JWPLAYER => false, GTM4WP_OPTION_EVENTS_VIDEOPRESS => false, GTM4WP_OPTION_EVENTS_SPOTIFY => false, GTM4WP_OPTION_EVENTS_TWITCH => false, GTM4WP_OPTION_EVENTS_MEDIA_DYNAMIC => false, ); } /** * Registers the frontend hooks. * * @return void */ protected function register_frontend_hooks(): void { if ( $this->opt( GTM4WP_OPTION_EVENTS_YOUTUBE ) ) { add_filter( 'oembed_result', array( $this, 'enable_youtube_js_api' ), 10, 3 ); } add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_scripts' ) ); } /** * Admin schema class name. * * @return string */ public function admin_schema(): string { return AdminSchema::class; } /** * Adds loading of the JS API of the YouTube player into the embed codes. * * @see https://developer.wordpress.org/reference/hooks/oembed_result/ * * @param string|false $return_value The returned oEmbed HTML (false if unsafe). * @param string $url URL of the content to be embedded. * @param string|array $data Additional arguments for retrieving embed HTML. * @return string|false */ public function enable_youtube_js_api( $return_value, $url, $data ) { if ( ! is_string( $return_value ) || false === strpos( $return_value, 'youtube.com' ) ) { return $return_value; } $site_url_parts = wp_parse_url( site_url() ); $site_url_parts = is_array( $site_url_parts ) ? $site_url_parts : array(); $scheme = (string) ( $site_url_parts['scheme'] ?? '' ); $host = (string) ( $site_url_parts['host'] ?? '' ); // A site URL WordPress cannot resolve into a scheme and a host cannot // produce a usable origin, and the YouTube JS API rejects a malformed one // anyway. Leave the embed exactly as the oEmbed handler returned it rather // than splicing in a half-built value (and rather than reading array keys // that are not there). if ( '' === $scheme || '' === $host ) { return $return_value; } // esc_url() AT the point of injection (RI-17). $return_value is markup the // oEmbed handler has already escaped, and this splice runs after that // escaping finished - so whatever is put back here is unescaped by // definition and the earlier escaping cannot defend the attribute. The // value is A4-set today (wp_parse_url over site_url()) and a hostname // cannot carry a quote, which is why nothing was exploitable; an escape // that is only correct because of where its value happens to come from is // not an escape. // // The separators stay as raw & rather than &: browsers parse both // identically here, and 1.x emits this byte-for-byte. $origin = esc_url( $scheme . '://' . $host ); // The scheme/host gate above runs BEFORE the escaper, so it cannot see the // escaper's own failure mode: esc_url() returns '' for a scheme outside // wp_allowed_protocols(), which the kses_allowed_protocols filter lets any // plugin narrow. Without this second check that would splice in the same // half-built `origin=` the first gate exists to prevent - a guard is only a // guard for the steps that come after it (RI-17, read backwards). if ( '' === $origin ) { return $return_value; } return str_replace( 'feature=oembed', 'feature=oembed&enablejsapi=1&origin=' . $origin, $return_value ); } /** * Enqueues a built media tracker script and, on the first call, publishes the * runtime-observer opt-in flag. * * The flag is a single boolean read by js/frontend/lib/native-video-params.js * (gtm4wpObserveMedia): when true, every enabled tracker also watches * document.body for players inserted after page load (popups/AJAX). It is off * unless the site enabled GTM4WP_OPTION_EVENTS_MEDIA_DYNAMIC, so the shared * MutationObserver is never created on sites that do not need it. * * On the first call it also enqueues the consent gate every tracker depends on * (see enqueue_gate()) and publishes the third-party SDK veto, when the site * has set one - see sdk_blocked(). * * @param string $handle Script handle. * @param string $file File name inside the build directory. * @param array $deps Script dependencies. * @param bool $in_footer Whether to print the script in the footer. * @param bool $fetches_sdk Whether this tracker requests a third-party player * SDK at runtime. False for the trackers that have * nothing to fetch (see enqueue_scripts()); they get * no consent gate, because there is no vendor request * for one to withhold. Flip this the moment such a * tracker gains an SDK. * @return void */ private function enqueue_media_tracker( string $handle, string $file, array $deps, bool $in_footer, bool $fetches_sdk = true ): void { // The gate only has a job where a vendor request exists to refuse. Four of // the twelve trackers fetch nothing at all, so on a site running only those // - self-hosted HTML5 video is the ordinary case - the gate would be an // extra