WP Manifestindependent plugin directory

Helick GTM WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Plugin for Google Tag Manager integration

★ 1stars
169composer installs
v1.2.0latest · 7 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/helick/gtm/archive/refs/heads/master.zip

On Packagist as helick/gtm:

composer require helick/gtm
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Helick Google Tag Manager

Latest Version on Packagist Total Downloads Software License Quality Score

Google Tag Manager integration.

Requirements

Make sure all dependencies have been installed before moving on:

Install

Install via Composer:

$ composer require helick/gtm

Update your application config by declaring the following:

Config::define('GTM_CONTAINER_ID', env('GTM_CONTAINER_ID'));

Update your env variables by declaring the following:

GTM_CONTAINER_ID=GTM-XXXX

Usage

To support the fallback iframe for devices without javascript add the following code just after the opening <body> tag in your theme:

<?php wp_body_open(); ?>

Data layer

Google Tag Manager offers a data layer which allows you pass arbitrary data that can be used to modify which tags are added to your site.

This plugin adds some default information such as post, tags and categories and provides a simple filter for adding in your own custom data.

add_filter('helick_gtm_data_layer', function (array $dataLayer) {
    $dataLayer['foo'] = 'bar';

    return $dataLayer;
});

Event tracking

To deactivate the event tracking you may declare the following:

add_filter('helick_gtm_enable_event_tracking', '__return_false');

By default the event listener script will look for the elements on the page with special data attributes in your markup and listen for the specified event to push to the data layer.

The data attributes are:

  • data-gtm-variable string Optionally override the default data layer variable name for this event.
  • data-gtm-on enum [click|submit|keyup|focus|blur] The JS event to listen for, defaults to 'click'.
  • data-gtm-event string The event name.
  • data-gtm-category string Optional group the event belongs to.
  • data-gtm-label string Optional human readable label for the event.
  • data-gtm-value number Optional numeric value associated with the event.
  • data-gtm-fields string Optional extra data provided as encoded JSON.

Example:

<button
    data-gtm-on="click"
    data-gtm-event="play"
    data-gtm-category="videos"
    data-gtm-label="Featured Promotional Video"
>
  Play video
</button>

Contributing

Please see CONTRIBUTING and CODE_OF_CONDUCT for details.

Security

If you discover any security related issues, please email evgenii@helick.io instead of using the issue tracker.

Credits

License

The MIT License (MIT). Please see License File for more information.

Releases

4 releases.

Tag
Published
v1.2.0 latest
Aug 23, 2019 7 years ago
Jul 31, 2019 7 years ago
Jul 31, 2019 7 years ago
Jul 31, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Helick GTM v1.2.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
v1.2.0
Findings
1
Worst severity
low
Content hash
5be67f510862662dfaaf6d50…

Findings

  • low dataLayer includes user capabilities for logged-in visitors

    information_disclosure

    data_layer() embeds user id, nicename, display name, and capability keys into the frontend GTM dataLayer, leaking privilege metadata to GTM and page-source readers.

    src/helpers.php:168-178

    Recommendation

    Expose only anonymous id or coarse role; never dump capability keys.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.