[2.x] Compatibility with Content Security Policy

Good point. There's room for some refactoring once all the bug reports have been settled. Thanks for the focus on this.

@gapple: Thank you very much! You're absolutely right! As an expert creating wonderful modules like "ga" - could you perhaps help a bit here with a first implementation or some hints how or where to start?

I guess that would help a lot!

It looks like there is one place where inline JS and CSS is added to the page: https://git.drupalcode.org/project/eu-cookie-compliance/-/blob/8.x-1.x/e.... I'm unsure why this is done with inline script.

It looks like it should maybe either be converted to load a library and use hook_library_info_alter to update the the files that are included in the library based on the relevant configuration, or it should pass the necessary info via drupalSettings (as is done elsewhere).

We won't be doing inline css in 2.x.

I'm flagging this for 2.x, with possibility for backport to 1.x.

This patch create and attach JS file instead of using inline JS

Thanks for the patch, @caco_d25.

Do we have to do something similar for css?

Will take a better look at the patch later, but with the snippet being written out to a file I don't see any reason to keep using $variables['#attached']['html_head'][] instead of defining a library and using $variables['#attached']['library'][].

The library will most likely need {preprocess: false} on the file to ensure it's not aggregated.

I brushed up the patch a bit and fixed some coding style issues. Here's a revised patch.

It seems that my patch in #12 is for a different issue, possibly #3208780: Allow config settings to be saved independent of related modules, and got saved with the wrong file name.

I'll take a look at the patch from #8 tomorrow.

Here's an updated patch.

The EventSubscriber was mistakenly committed in #3236506: Fix PHP Coding Standards for EUCC.