From 29ee06e8fd5bb519f61d7347d0aa5146aab5f895 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oskar=20Sch=C3=B6ldstr=C3=B6m?= <m@oxy.fi>
Date: Tue, 20 Jan 2026 09:19:26 -0300
Subject: [PATCH 1/2] replace hardcoded script tags with core api

---
 .../scripts/cb_frame/cookiebot-js.php         | 68 ++++++++++---------
 .../scripts/common/google-consent-mode-js.php | 12 +++-
 .../scripts/common/google-tag-manager-js.php  | 14 +++-
 3 files changed, 57 insertions(+), 37 deletions(-)

diff --git a/src/view/frontend/scripts/cb_frame/cookiebot-js.php b/src/view/frontend/scripts/cb_frame/cookiebot-js.php
index a42cd3d0..9a4b91e6 100644
--- a/src/view/frontend/scripts/cb_frame/cookiebot-js.php
+++ b/src/view/frontend/scripts/cb_frame/cookiebot-js.php
@@ -7,37 +7,39 @@
  * @var array $data_regions
  * @var string|bool $tcf
  */
-?>
-<script type="text/javascript"
-		id="Cookiebot"
-		src="https://consent.cookiebot.com/uc.js"
-		data-implementation="wp"
-		data-cbid="<?php echo esc_attr( $cbid ); ?>"
-	<?php if ( $tcf ) : ?>
-		data-framework="<?php echo esc_attr( $tcf ); ?>"
-	<?php endif; ?>
-	<?php
-	if ( $data_regions ) {
-		echo 'data-georegions="';
-		foreach ( $data_regions as $cbid => $regions ) {
-			echo '{\'region\':\'' . esc_attr( $regions ) . '\',\'cbid\':\'' . esc_attr( $cbid ) . '\'}';
-			end( $data_regions );
-			if ( $cbid !== key( $data_regions ) ) {
-				echo ',';
-			}
-		}
-		echo '"';
+
+$script_attributes = array(
+	'type'                 => 'text/javascript',
+	'id'                   => 'Cookiebot',
+	'src'                  => 'https://consent.cookiebot.com/uc.js',
+	'data-implementation' => 'wp',
+	'data-cbid'            => $cbid,
+);
+
+if ( $tcf ) {
+	$script_attributes['data-framework'] = $tcf;
+}
+
+if ( $data_regions ) {
+	$georegions = array();
+	foreach ( $data_regions as $cbid => $regions ) {
+		$georegions[] = '{\'region\':\'' . esc_attr( $regions ) . '\',\'cbid\':\'' . esc_attr( $cbid ) . '\'}';
 	}
-	?>
-	<?php if ( (bool) get_option( 'cookiebot-gtm' ) !== false && ! empty( get_option( 'cookiebot-data-layer' ) ) ) : ?>
-		data-layer-name="<?php echo esc_attr( get_option( 'cookiebot-data-layer' ) ); ?>"
-	<?php endif; ?>
-	<?php if ( ! empty( $lang ) ) : ?>
-		data-culture="<?php echo esc_attr( strtoupper( $lang ) ); ?>"
-	<?php endif; ?>
-	<?php if ( $cookie_blocking_mode === 'auto' ) : ?>
-		data-blockingmode="auto"
-	<?php else : ?>
-		<?php echo esc_attr( $tag_attr ); ?>
-	<?php endif; ?>
-></script>
+	$script_attributes['data-georegions'] = implode( ',', $georegions );
+}
+
+if ( (bool) get_option( 'cookiebot-gtm' ) !== false && ! empty( get_option( 'cookiebot-data-layer' ) ) ) {
+	$script_attributes['data-layer-name'] = get_option( 'cookiebot-data-layer' );
+}
+
+if ( ! empty( $lang ) ) {
+	$script_attributes['data-culture'] = strtoupper( $lang );
+}
+
+if ( $cookie_blocking_mode === 'auto' ) {
+	$script_attributes['data-blockingmode'] = 'auto';
+} elseif ( ! empty( $tag_attr ) ) {
+	$script_attributes[ $tag_attr ] = true;
+}
+
+wp_print_script_tag( $script_attributes );
diff --git a/src/view/frontend/scripts/common/google-consent-mode-js.php b/src/view/frontend/scripts/common/google-consent-mode-js.php
index abb2f845..f646449b 100644
--- a/src/view/frontend/scripts/common/google-consent-mode-js.php
+++ b/src/view/frontend/scripts/common/google-consent-mode-js.php
@@ -6,8 +6,15 @@
  * @var string $script_type
  */
 
+$script_attributes = array(
+    'type' => $script_type,
+);
+if ($consent_attribute) {
+    $script_attributes['data-cookieconsent'] = $consent_attribute;
+}
+
+ob_start();
 ?>
-<script type="<?php echo esc_attr( $script_type ); ?>"<?php echo ! $consent_attribute ? '' : ' data-cookieconsent="' . esc_attr( $consent_attribute ) . '"'; ?>>
 	window.<?php echo esc_js( $data_layer ); ?> = window.<?php echo esc_js( $data_layer ); ?> || [];
 
 	function gtag() {
@@ -31,4 +38,5 @@ functionality_storage: "denied",
 			'gtag("set", "url_passthrough", true);' . PHP_EOL;
 	}
 	?>
-</script>
+
+<?php wp_print_inline_script_tag( ob_get_clean(), $script_attributes ); ?>
\ No newline at end of file
diff --git a/src/view/frontend/scripts/common/google-tag-manager-js.php b/src/view/frontend/scripts/common/google-tag-manager-js.php
index 671c1869..c73346e5 100644
--- a/src/view/frontend/scripts/common/google-tag-manager-js.php
+++ b/src/view/frontend/scripts/common/google-tag-manager-js.php
@@ -6,8 +6,16 @@
  * @var string $script_type
  * @var bool $iab
  */
+
+$script_attributes = array(
+    'type' => $script_type,
+);
+if ($consent_attribute) {
+    $attributes['data-cookieconsent'] = $consent_attribute;
+}
+
+ob_start();
 ?>
-<script type="<?php echo esc_attr( $script_type ); ?>"<?php echo ! $consent_attribute ? '' : ' data-cookieconsent="' . esc_attr( $consent_attribute ) . '"'; ?>>
 	<?php if ( $iab ) : ?>
 	window ["gtag_enable_tcf_support"] = true;
 	<?php endif; ?>
@@ -25,4 +33,6 @@
 		'<?php echo esc_js( $data_layer ); ?>',
 		'<?php echo esc_js( $gtm_id ); ?>'
 	);
-</script>
+
+<?php
+wp_print_inline_script_tag( ob_get_clean(), $script_attributes ); ?>

From 94ef5cf8834e627e547a670fb6d259579a429b6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oskar=20Sch=C3=B6ldstr=C3=B6m?= <m@oxy.fi>
Date: Tue, 20 Jan 2026 10:41:48 -0300
Subject: [PATCH 2/2] fix invalid variable reference

---
 src/view/frontend/scripts/common/google-tag-manager-js.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/view/frontend/scripts/common/google-tag-manager-js.php b/src/view/frontend/scripts/common/google-tag-manager-js.php
index c73346e5..88ea1604 100644
--- a/src/view/frontend/scripts/common/google-tag-manager-js.php
+++ b/src/view/frontend/scripts/common/google-tag-manager-js.php
@@ -11,7 +11,7 @@
     'type' => $script_type,
 );
 if ($consent_attribute) {
-    $attributes['data-cookieconsent'] = $consent_attribute;
+    $script_attributes['data-cookieconsent'] = $consent_attribute;
 }
 
 ob_start();