0fc8264927
* fix: comment scripts bypass cookie consent When GDPR cookie consent is enabled, the comments container is simply hidden with CSS. However, this still allows all third-party script tags within the container to be evaluated and downloaded by the browser. This PR uses the <template> tag which stops inner scripts from evaluating. Once consent is granted, the template content is cloned and inserted into the container, and the scripts are manually loaded in order. * refactor(comments): move consent-gated loader to TS asset * fix(comments): add integrity attribute to comments consent script * style: align comments consent docs and naming * refactor(comments): simplify script handling --------- Co-authored-by: Jimmy Cai <jimmy@cai.im>
29 lines
1.5 KiB
HTML
29 lines
1.5 KiB
HTML
{{/*
|
|
Comments include entry.
|
|
- If functional cookie consent is required, render a placeholder + template and load commentsConsent.ts.
|
|
- Otherwise, render provider partial directly.
|
|
*/}}
|
|
{{ if .Site.Params.comments.enabled }}
|
|
{{- $needsConsent := and .Site.Params.cookies.enabled .Site.Params.cookies.categories.functional -}}
|
|
{{- if $needsConsent -}}
|
|
{{/* Consent-gated comments - show placeholder until functional consent */}}
|
|
<div id="comments-consent-placeholder" class="consent-placeholder">
|
|
<p>{{ T "cookies.commentsDisabled" }}</p>
|
|
<button class="cookie-btn cookie-btn--primary" data-cookie-action="reopen">
|
|
{{ T "cookies.managePreferences" }}
|
|
</button>
|
|
</div>
|
|
<div id="comments-container" style="display: none;"></div>
|
|
<template id="comments-template">
|
|
{{ partial (printf "comments/provider/%s" .Site.Params.comments.provider) . }}
|
|
</template>
|
|
{{- $opts := dict "minify" hugo.IsProduction -}}
|
|
{{/* commentsConsent.ts is intentionally built and loaded here as an independent entry */}}
|
|
{{- $commentsScript := resources.Get "ts/commentsConsent.ts" | js.Build $opts | fingerprint -}}
|
|
<script type="text/javascript" src="{{ $commentsScript.RelPermalink }}" integrity="{{ $commentsScript.Data.Integrity }}" defer></script>
|
|
{{- else -}}
|
|
{{/* No consent required - load comments normally */}}
|
|
{{ partial (printf "comments/provider/%s" .Site.Params.comments.provider) . }}
|
|
{{- end -}}
|
|
{{ end }}
|