kantarciandClaude Fable 5.1
0bdcc7f90e
The back-to-top button was hidden as long as the consent question was open, on every device - and on a phone the question tends to stay open. Instead of `display:none` it now anchors itself 12px above the bar wherever the bar covers its corner: below 800px for the centred card, at every width for the full-width bar and the corner card. Browsers without anchor positioning keep hiding it there. The bar renders before the button so it can be an anchor, and the reserved bottom padding grows to 320px below 620px, where the bar with its default text is up to 299px tall. The notice itself gets a face. Settings → Einwilligung now carries layout (card, bar, corner), shape (soft, round, square - one setting for the box and its buttons), a heading and four colours, each as #hex or @palette key. `Theme::cssColor()` resolves both, replacing the copy inside the back-to-top code; `Consent::styles()` writes the values as `--kant-consent-*` into the hashed style block. The base layout changes with it: an accent stripe and shield icon, equal-width buttons, a disclosure with a chevron, underlined legal links, a two-column bar on wide screens. Declining stays an outlined button of the same size next to accepting. The archive and the consent page carry the same variables - the archive had no palette at all until now. In the editor, rows with an own value are labelled in orange rather than bold with a dot; the device chips sit 6px apart with the focus ring inside the gap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
83 lines
3.6 KiB
PHP
83 lines
3.6 KiB
PHP
<?php
|
|
|
|
namespace App\Controller;
|
|
|
|
use App\Content\Consent;
|
|
use App\Content\SiteSettings;
|
|
use App\Content\Theme;
|
|
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\Routing\Attribute\Route;
|
|
|
|
/**
|
|
* Recording and changing the consent decision.
|
|
*
|
|
* **No CSRF token here, deliberately.** The request changes nothing on the server: it sets a
|
|
* cookie that only affects the browser that sent it. A token would need a session, and starting a
|
|
* session for every visitor is exactly what a consent banner exists to avoid. What is checked is
|
|
* the target of the redirect, so the form cannot be used to bounce someone to another site.
|
|
*/
|
|
final class ConsentController extends AbstractController
|
|
{
|
|
public function __construct(private Consent $consent, private SiteSettings $settings, private Theme $theme)
|
|
{
|
|
}
|
|
|
|
#[Route('/einwilligung', name: 'consent_save', methods: ['POST'])]
|
|
public function save(Request $request): Response
|
|
{
|
|
$choice = $request->request->getString('choice');
|
|
$groups = match ($choice) {
|
|
'all' => array_keys(Consent::GROUPS),
|
|
'none' => [],
|
|
default => array_map(static fn (mixed $group): string => (string) $group, (array) $request->request->all('groups')),
|
|
};
|
|
$response = $this->redirect($this->backTo($request));
|
|
$this->consent->remember($request, $response, $groups);
|
|
|
|
return $response;
|
|
}
|
|
|
|
#[Route('/einwilligung', name: 'consent_page', methods: ['GET'])]
|
|
public function page(Request $request): Response
|
|
{
|
|
if ([] === $this->consent->askedGroups()) {
|
|
throw $this->createNotFoundException('Diese Website fragt nichts ab.');
|
|
}
|
|
// Deliberately without header and footer: this is a page about a decision, not a page of
|
|
// the website, and it must work even when an area is broken.
|
|
// Palette und Hinweisfarben wie auf den Seiten, damit die Entscheidung hier aussieht wie
|
|
// die Frage dort. Das Stylesheet ist ueber seinen Hash erlaubt, nichts weiter.
|
|
$theme = $this->theme->load();
|
|
$styles = $this->theme->css($theme).$this->consent->styles($theme);
|
|
$response = $this->render('consent.html.twig', [
|
|
'consent' => $this->consent->state($request),
|
|
'settings' => $this->settings->load(),
|
|
'pageStyles' => $styles,
|
|
]);
|
|
$response->headers->set('Cache-Control', 'no-store');
|
|
$response->headers->set('X-Robots-Tag', 'noindex, follow');
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff');
|
|
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
|
|
// The page carries no embeds, so it keeps the strictest policy - plus the one hashed style block.
|
|
$response->headers->set('Content-Security-Policy', sprintf("default-src 'self'; script-src 'none'; style-src 'self' 'sha256-%s'; img-src 'self' https: data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'", base64_encode(hash('sha256', $styles, true))));
|
|
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* Back to where the form was submitted from, but only within this site: an open redirect
|
|
* would turn a consent button into a way to send people anywhere.
|
|
*/
|
|
private function backTo(Request $request): string
|
|
{
|
|
$target = $request->request->getString('back');
|
|
if ('' === $target || !str_starts_with($target, '/') || str_starts_with($target, '//')) {
|
|
return '/';
|
|
}
|
|
|
|
return $target;
|
|
}
|
|
}
|