[DEB] Consent Manager (IAB TCF 2.2) 2.0.1

GDPR & ePrivacy Compliant Cookie Consent Banner

DEB Consent Manager is a fully-featured IAB TCF 2.2 compliant Consent Management Platform (CMP) built directly into XenForo. No external service, no monthly fees, full control.

• TCF 2.2 Compliant - Full __tcfapi implementation with TC-String encoder/decoder
• Google Consent Mode v2 - Automatic integration with Google Ads, Analytics & Tag Manager
• 3-Layer Consent Banner -...

Click to expand...

[DEB] Consent Manager (IAB TCF 2.2) 1.0.2 Patch 4

Bug Fixes:

• Fixed "Function datetime is unknown" error on dashboard and logs (changed to date_time)
• Fixed banner not closing after Accept/Reject/Save when CMP JavaScript throws an error

Improvements:

• Banner buttons now hide wrapper before CMP call with try/catch error handling
• Banner always closes reliably regardless of JavaScript errors

---

[DEB] Consent Manager (IAB TCF...

Click to expand...

1.0.3 Changelog

Bug Fixes:

• Fixed vendor edit form not pre-selecting checkboxes for Consent Purposes, Legitimate Interest Purposes, and Special Features when editing existing vendors
• Fixed purpose labels showing generic "Purpose 1", "Purpose 2" etc. instead of proper TCF purpose names in vendor edit form
• Fixed vendor list table not using full available width in admin panel

Improvements:

• GVL import now uses privacy URL as...

Click to expand...

Version 2.0.1 — March 30, 2026

New Features

• IP Anonymization — New setting to control how visitor IP addresses are stored in consent logs. Options: Anonymized (last octet removed, default), Hashed (SHA-256, irreversible), Do not store, or Full IP. Recommended setting for GDPR compliance: Anonymized.
• Privacy Notice on /consent page — Automatic privacy notice explaining what data is collected, how the IP is handled (adapts to the selected setting), and...

Click to expand...

• Fixed: Public compliance export endpoint was accessible without authentication. The CSV export is now only available to admins with the debConsentAdmin permission.
• Fixed: CSRF protection is now enforced on the consent update endpoint. Previously disabled for all public POST actions, CSRF is now only skipped for fire-and-forget counters (impressions, adblock).
• Fixed: All public POST endpoints (consent update, impression, adblock) now require XMLHttpRequest headers, blocking direct form-based attacks.
• Fixed: XSS vulnerability in admin consent logs where the TC String was interpolated directly into a JavaScript onclick handler. Now uses a data attribute for safe clipboard copy.
• Fixed: OAuth2 authorization flow missing state parameter for CSRF protection (planned for next release).
• Fixed: Three admin JSON endpoints (validator, cookie scanner, cookie lookup) now use XenForo's response system instead of raw header/echo/exit, ensuring proper middleware and error handling.

• Fixed: Revenue forecast was completely non-functional due to wrong data keys (acceptRate vs accept_rate, revenue_30d vs monthly.earnings). The forecast section now renders correctly when Google API data is available.
• Fixed: Ad Blocker Rate displayed 898% because detections were counted on every pageview instead of once per session. Now uses a session cookie to count each visitor only once.
• Fixed: Ad Blocker Rate could exceed 100% in edge cases. Now capped at 100%.
• Fixed: IPv6 address anonymization was broken due to incorrect string manipulation. Now uses proper inet_pton/inet_ntop for reliable anonymization of both IPv4 and IPv6 addresses.
• Fixed: inet_pton() ValueError crash when receiving IPv6 addresses containing null bytes from proxies or CDNs. All IP parsing is now wrapped in try/catch with graceful fallback.
• Fixed: Referrer sorting used arsort() on nested arrays which produced incorrect results. Now uses uasort() with proper total-based comparison.
• Fixed: Re-consent reset did not store the last_reset timestamp, causing the automatic re-consent cron to trigger again immediately after a manual reset.