Closed Setting cookies requires manual consent checks

K

Kirby

Well-known member
Licensed customer
Affected version
2.2.12
Steps to reproduce
  1. Enable advanced cookie consent
  2. View a frontend page with a fresh browser
  3. Configure consent to not allow optional cookies
  4. Create an ad on position Container header with the following code
  5. PHP: 
    <xf:if>
XF.Cookie.set('from_search', 'unconsented-cookie-value');
</xf:if>
  6. View another frontend page
  7. Check cookies
Expected Result
No cookie xf_from_search is present

Actual Result
Cookie xf_from_search is present nad has value unconsented-cookie-value

Suggested Fix
Cookie consent control should be mandatory on both client and server (for every cookie that is set/read via XF framework methods), not an Opt-In (for 3rd party code).
To keep backwards compatibility it might make sense to add an option to still allow unclassified cookies.
 
Automated triage: As designed

Thank you for reporting this issue. Cookie consent is checked by the code that sets a cookie, not by the cookie functions themselves. Cookies not registered with the consent system are treated as allowed. Custom code added to the page, such as an advertisement, is responsible for checking consent before it sets a cookie.

This is an automated assessment. A member of staff may review and update it.
 
Back
Top Bottom