Google Tag manager is loaded without consent

Thanks @J-Lee, could you prepare a MR to fix this eventually? I'm very busy currently.

After looking at the new behavior, I'm not quite sure which way to go.

The iframe is inserted via hook_page_top() (is now rendered via a template).
Via hook_page_attachments() the information about the Google tag manager (gtm) and Google tag (gtag) are inserted in drupalSettings. For both, a JS-library is also added there. In the JavaScripts the information is read from drupalSettings and the script tags are generated dynamically.

As far as I understood, so far (google_tag module v1) the script type="text/javascript" was changed to script type="text/plain". After the approval was successful, the text/plain was then removed again, which enabled the script.

In version 2 the script tags are no longer generated in PHP. Therefore, the only option I see right now is to use hook_page_attachments_alter() to remove the two libraries (gtm and gtag) and rebuild the two scripts in the cookies module and adjust them accordingly so that it matches the current behavior

Google tag manager script: https://git.drupalcode.org/project/google_tag/-/blob/2.0.x/js/gtm.js
Google tag script: https://git.drupalcode.org/project/google_tag/-/blob/2.0.x/js/gtag.js

@J-Lee short hint: Perhaps take a look into the COOKiES submodules and COOKiES contrib modules, perhaps there's already a solution for a similar case.

Thank you!

We'll come back here as soon as possible, but I think that may need at least some weeks, sorry. Of course, we'll be able to review MR's in the meantime.

The MR is not ready yet.

• The support for the google_tag module v1 still needs to be checked.
• There are errors when loading the Google Tag Manager: Failed to load resource: net::ERR_SOCKET_NOT_CONNECTED for www.googletagmanager.com/gtm.js?id=GTM-XXXXXX

Compatibility for google_tag module v1 restored.
The ERR_SOCKET_NOT_CONNECTED error was apparently only a local problem and cannot be reproduced at the moment.

The tests should be fine for the google_tag module v2. Since the functionality of JS is actually the same.

Thanks @J-Lee very awesome work!

Some thoughts:
1. Is the code simply for both versions, or are parts for v1 and others for v2? (If yes, please add comments to make it easier to remove the old parts one day)
2. "eval is evil", any way to solve that differently? https://dev.to/amitkhonde/eval-is-evil-why-we-should-not-use-eval-in-jav...
We're gaining security risks this way, so if possible it should be avoided.

Thank you very much, this already looks very promising!

1. I can add something like /** @group google_tag_v1 */ and /** @group google_tag_v2*/.
2. The scripts must be executed for the Tag Manager to load. However, the scripts are IIFEs. I can do something like this:

...
const script = document.querySelector('script#' + id);
const code = script.textContent || script.innerText;
const executeCode = Function(code);
executeCode();

But, is this more secure?

I addressed the points from #9 and fixed a few minor bugs.
With this the MR is ready to be reviewed further.

Hello, I encountered a problem with the patch for Google tag 2.0.2 and drupal 9.5.10. The Google tag module does not load on my site, regardless of the consent status.

@Asterovim I cannot confirm your problem. TagManager loads and is visible. I have also used Google's Chrome extension "Tag Assistant" to troubleshoot.
Are there any error messages?
Have you tried clearing the cache?

@Asterovim
if your composer is installing the patch correctly, you'll find it listed in a PATCHES.txt file inside the patched module

if not, then review your composer.json

are you using this patch?
https://git.drupalcode.org/project/cookies/-/merge_requests/94.patch

Thank you for the patch.
The cookies are now blocked, but when clicking on Accept all, they are not added to the website.

I'm using:
core 10.1.2
cookies (cookies_gtag) 1.2.3
google_tag 2.0.2

@joco_sp Can you confirm that the script has loaded? Maybe it can also help to include some console.log() for debugging.
In most cases, a caching mechanism is responsible for making it appear that it is not working. Clearing Drupal caches and possibly also the browser cache usually helps.

I see a flaw in the attachment logic inside the page_attachments alter. Note that all library attachments will go through this hook, so array_diff won't work in this case as there can be further libraries outside the gtag libraries.

Furthermore, as Drupal 8 has reached its EOL long ago and D9 will very soon be also EOL, we can kill the D8 compatibility, make the module's min requirement Drupal 9.5 and end support for the Google Tag 1.x module. This way, we don't need to have old v1 code lying around, which is obsolete anyway in modern Drupal projects.

I'll do some adjustments.

Yea, I think the MR is not the right approach, I guess we simply have to add our js library in hook_page_attachments and alter the script in hook_js_alter() instead of page_attachments or page_attachments_alter. Similar to cookies_instagram or cookies_facebook_pixel, I'll create a new branch.

Sorry @J-Lee, but I might be able to reuse some of your code! 🙂👍

Grevil → closed merge request !94

Ok, all done, please review!

6 failing tests

6 failing tests

Yea, that old problem where you are not able to log in for some reason... I forgot how we fixed that back then. I'll have a look.

Locally tests run just fine.

Tests should hopefully run now.

@all here: Could you please test, if the fix works for you? Code looks good, I'll merge it into dev so for easier testing.
With positive results we'll tag a new stable release!

Just tried in production and works GREAT! Thank you @Grevil and @J-Lee!

Waiting for feedback before we tag a new release.

I can confirm, that it works well. Thank you.

Thanks! I'll tag 1.2.4 release.

Automatically closed - issue fixed for 2 weeks with no activity.