From 80d73cc05b976f51831ccc79c84240e2035da312 Mon Sep 17 00:00:00 2001
From: Pablo Lara <larabjj@gmail.com>
Date: Fri, 20 Jun 2025 12:47:17 +0200
Subject: [PATCH] feat: integrate Google Tag Manager manually to avoid ORB
 blocking (#8070)

---
 .env              |  2 +-
 ui/next.config.js | 38 +++++++++++++++++++-------------------
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.env b/.env
index 00b58cbde6..447fd3c1b4 100644
--- a/.env
+++ b/.env
@@ -12,7 +12,7 @@ UI_PORT=3000
 # openssl rand -base64 32
 AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8="
 # Google Tag Manager ID
-NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID="GTM-XXX"
+NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=""
 
 
 #### Prowler API Configuration ####
diff --git a/ui/next.config.js b/ui/next.config.js
index 2f71bd229c..af64900d4c 100644
--- a/ui/next.config.js
+++ b/ui/next.config.js
@@ -3,38 +3,38 @@
 // HTTP Security Headers
 // 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode
 const cspHeader = `
-    img-src 'self';
-    font-src 'self';
-    style-src 'self' 'unsafe-inline';
-    script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com;
-    connect-src 'self' https://api.iconify.design https://api.simplesvg.com https://api.unisvg.com https://js.stripe.com;
-    frame-src 'self' https://js.stripe.com/;
-    frame-ancestors 'none';
-    default-src 'self'
-`
+  default-src 'self';
+  script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://www.googletagmanager.com;
+  connect-src 'self' https://api.iconify.design https://api.simplesvg.com https://api.unisvg.com https://js.stripe.com https://www.googletagmanager.com;
+  img-src 'self' https://www.google-analytics.com https://www.googletagmanager.com;
+  font-src 'self';
+  style-src 'self' 'unsafe-inline';
+  frame-src 'self' https://js.stripe.com https://www.googletagmanager.com;
+  frame-ancestors 'none';
+`;
 
 module.exports = {
-  poweredByHeader: false,  
+  poweredByHeader: false,
   output: "standalone",
   async headers() {
     return [
       {
-        source: '/(.*)',
+        source: "/(.*)",
         headers: [
           {
-            key: 'Content-Security-Policy',
-            value: cspHeader.replace(/\n/g, ''),
+            key: "Content-Security-Policy",
+            value: cspHeader.replace(/\n/g, ""),
           },
           {
-            key: 'X-Content-Type-Options',
-            value: 'nosniff',
+            key: "X-Content-Type-Options",
+            value: "nosniff",
           },
           {
-            key: 'Referrer-Policy',
-            value: 'strict-origin-when-cross-origin',
+            key: "Referrer-Policy",
+            value: "strict-origin-when-cross-origin",
           },
         ],
       },
-    ]
-  }
+    ];
+  },
 };