From e818cc3c8fec77dd717383c823bcef81f2b99228 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Fri, 19 Jun 2026 17:50:51 -0700
Subject: [PATCH 1/8] Prep 1.0.0 release

---
 CHANGELOG.md  | 4 ++++
 README.md     | 2 +-
 composer.json | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2da00ca..4041da6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file.
 
+## 1.0.0 - 2026-06-20
+
+- First official release of Consent Manager.
+
 ## 1.0.0-b1 - 2026-06-09
 
 ### Added
diff --git a/README.md b/README.md
index 778cf98..c19babb 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 # Consent Manager
 [![Build Status](https://github.com/phpbb-extensions/consent-manager/actions/workflows/tests.yml/badge.svg)](https://github.com/phpbb-extensions/consent-manager/actions)
 [![codecov](https://codecov.io/gh/phpbb-extensions/consent-manager/graph/badge.svg?token=IE2YWG6N9V)](https://codecov.io/gh/phpbb-extensions/consent-manager)
-![Stability](https://img.shields.io/badge/stability-beta-pink?logo=phpBB&logoColor=white)
+[![Latest Stable Version](https://poser.pugx.org/phpbb/consentmanager/v/stable)](https://www.phpbb.com/customise/db/extension/advanced_bbcode_box/)
 
 <p><i>Modern cookie consent for phpBB</i></p>
 <kbd><img src=".github/images/cm.png" width="566" height="208" alt="Consent Manager" style="width:566px; height:auto; max-width: 100%; display: block;"></kbd>
diff --git a/composer.json b/composer.json
index 0ebc91b..75eb347 100644
--- a/composer.json
+++ b/composer.json
@@ -3,7 +3,7 @@
 	"type": "phpbb-extension",
 	"description": "GDPR-ready consent manager for phpBB forums, providing category consent, deferred script and iframe loading, consent logging, and extension integration APIs.",
 	"homepage": "https://www.phpbb.com/",
-	"version": "1.0.0-b1",
+	"version": "1.0.0",
 	"keywords": ["phpbb", "extension", "gdpr", "consent", "cookies"],
 	"license": "GPL-2.0-only",
 	"authors": [

From 19e3530d7a4e9fe7cec99084a8d7116c985bc663 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:14:16 -0700
Subject: [PATCH 2/8] Fixed stored XSS

---
 adm/style/consentmanager_acp.html             |  2 +-
 .../event/overall_footer_body_after.html      |  2 +-
 tests/functional/acp_test.php                 | 24 +++++++++++++++++
 tests/functional/frontend_test.php            | 26 +++++++++++++++++++
 4 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/adm/style/consentmanager_acp.html b/adm/style/consentmanager_acp.html
index a95f685..795bb90 100644
--- a/adm/style/consentmanager_acp.html
+++ b/adm/style/consentmanager_acp.html
@@ -58,7 +58,7 @@ <h3>{{ lang('WARNING') }}</h3>
 									<strong>{{ category.label }}</strong>
 									<ul>
 								{% endif %}
-								<li style="font-size: 0.7rem">{{ service.label }} » <em>{{ service.id }}</em></li>
+								<li style="font-size: 0.7rem">{{ service.label|e('html') }} » <em>{{ service.id }}</em></li>
 							{% endif %}
 						{% endfor %}
 						{% if category_has_services %}
diff --git a/styles/all/template/event/overall_footer_body_after.html b/styles/all/template/event/overall_footer_body_after.html
index 9efdf01..b96f9b1 100644
--- a/styles/all/template/event/overall_footer_body_after.html
+++ b/styles/all/template/event/overall_footer_body_after.html
@@ -28,7 +28,7 @@ <h3 class="consent-manager-category-title">{{ cat.LABEL }}</h3>
 						<div class="consent-manager-category-services">
 							<ul>
 								{% for service in cat.CONSENTMANAGER_SERVICES %}
-								<li><strong>{{ service.LABEL }}</strong>{% if service.DESCRIPTION %}{{ lang('COLON')}} {{ service.DESCRIPTION }}{% endif %}</li>
+								<li><strong>{{ service.LABEL|e('html') }}</strong>{% if service.DESCRIPTION %}{{ lang('COLON')}} {{ service.DESCRIPTION|e('html') }}{% endif %}</li>
 								{% endfor %}
 							</ul>
 						</div>
diff --git a/tests/functional/acp_test.php b/tests/functional/acp_test.php
index 2194c2d..2fa6797 100644
--- a/tests/functional/acp_test.php
+++ b/tests/functional/acp_test.php
@@ -34,6 +34,30 @@ public function test_acp_page_renders_consent_manager_settings()
 		$this->assertContainsLang('ACP_CONSENTMANAGER_VERSION', $crawler->filter('#main')->text());
 	}
 
+	public function test_acp_page_escapes_integration_label()
+	{
+		$label = '<script>alert(1)</script>';
+		$integrations = json_encode(array(array(
+			'id' => 'board.analytics',
+			'category' => 'analytics',
+			'label' => $label,
+			'src' => '/analytics.js',
+		)));
+
+		$this->db->sql_query('UPDATE ' . CONFIG_TEXT_TABLE . "
+			SET config_value = '" . $this->db->sql_escape($integrations) . "'
+			WHERE config_name = 'consentmanager_integrations'");
+		$this->purge_cache();
+
+		$this->login();
+		$this->admin_login();
+		self::request('GET', $this->get_module_url());
+		$content = self::get_content();
+
+		$this->assertStringNotContainsString($label, $content);
+		$this->assertStringContainsString('&lt;script&gt;alert(1)&lt;/script&gt;', $content);
+	}
+
 	public function test_acp_form_saves_settings_and_integrations()
 	{
 		$this->login();
diff --git a/tests/functional/frontend_test.php b/tests/functional/frontend_test.php
index bcdd482..cdb10e7 100644
--- a/tests/functional/frontend_test.php
+++ b/tests/functional/frontend_test.php
@@ -42,6 +42,32 @@ public function test_frontend_markup_is_injected_on_board_pages()
 		$this->assertStringContainsString('/consent/log', $payload['logEndpoint']);
 	}
 
+	public function test_frontend_escapes_integration_label_and_description()
+	{
+		$label = '<script>alert(1)</script>';
+		$description = '<img src=x onerror=alert(2)>';
+		$integrations = json_encode(array(array(
+			'id' => 'board.analytics',
+			'category' => 'analytics',
+			'label' => $label,
+			'description' => $description,
+			'src' => '/analytics.js',
+		)));
+
+		$this->db->sql_query('UPDATE ' . CONFIG_TEXT_TABLE . "
+			SET config_value = '" . $this->db->sql_escape($integrations) . "'
+			WHERE config_name = 'consentmanager_integrations'");
+		$this->purge_cache();
+
+		self::request('GET', 'index.php');
+		$content = self::get_content();
+
+		$this->assertStringNotContainsString($label, $content);
+		$this->assertStringNotContainsString($description, $content);
+		$this->assertStringContainsString('&lt;script&gt;alert(1)&lt;/script&gt;', $content);
+		$this->assertStringContainsString('&lt;img src=x onerror=alert(2)&gt;', $content);
+	}
+
 	public function test_log_endpoint_rejects_invalid_json_payload()
 	{
 		$payload = $this->fetch_frontend_payload();

From 15e66b5a69eceb7b7422d13af3cedd53f1e4b248 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:14:38 -0700
Subject: [PATCH 3/8] Use Symfony to handle response headers

---
 controller/acp_controller.php            | 34 +++++++++++-----
 tests/controller/acp_controller_test.php | 51 ++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 11 deletions(-)

diff --git a/controller/acp_controller.php b/controller/acp_controller.php
index 451e961..dd26c24 100644
--- a/controller/acp_controller.php
+++ b/controller/acp_controller.php
@@ -16,6 +16,8 @@
 use phpbb\request\request;
 use phpbb\request\request_interface;
 use phpbb\template\template;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpFoundation\StreamedResponse;
 
 class acp_controller
 {
@@ -296,21 +298,31 @@ protected function send_csv_download(array $filters)
 			ob_end_clean();
 		}
 
-		header('Content-Type: text/csv; charset=UTF-8');
-		header('Content-Disposition: attachment; filename="consent_logs_' . gmdate('Y-m-d_His') . '.csv"');
-		header('Cache-Control: no-cache, no-store, must-revalidate');
-		header('Pragma: no-cache');
-		header('Expires: 0');
-
-		$handle = fopen('php://output', 'wb');
-		fwrite($handle, "\xEF\xBB\xBF"); // UTF-8 BOM for Excel compatibility
-		fputcsv($handle, ['anonymized_id', 'timestamp', 'consent_version', 'categories']);
-		$this->acp_manager->stream_logs_csv($handle, $filters);
-		fclose($handle);
+		$this->create_csv_response($filters)->send();
 
 		exit;
 	}
 
+	protected function create_csv_response(array $filters)
+	{
+		$filename = 'consent_logs_' . gmdate('Y-m-d_His') . '.csv';
+		$response = new StreamedResponse(function () use ($filters) {
+			$handle = fopen('php://output', 'wb');
+			fwrite($handle, "\xEF\xBB\xBF"); // UTF-8 BOM for Excel compatibility
+			fputcsv($handle, ['anonymized_id', 'timestamp', 'consent_version', 'categories']);
+			$this->acp_manager->stream_logs_csv($handle, $filters);
+			fclose($handle);
+		});
+
+		$response->headers->set('Content-Type', 'text/csv; charset=UTF-8');
+		$response->headers->set('Content-Disposition', $response->headers->makeDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, $filename));
+		$response->headers->set('Cache-Control', 'no-cache, no-store, must-revalidate');
+		$response->headers->set('Pragma', 'no-cache');
+		$response->headers->set('Expires', '0');
+
+		return $response;
+	}
+
 	protected function get_logs_form_data()
 	{
 		return [
diff --git a/tests/controller/acp_controller_test.php b/tests/controller/acp_controller_test.php
index 8be6f23..38a29a0 100644
--- a/tests/controller/acp_controller_test.php
+++ b/tests/controller/acp_controller_test.php
@@ -647,6 +647,52 @@ public function test_handle_logs_export_success_logs_and_passes_filters_to_downl
 		], $controller->captured_filters);
 	}
 
+	public function test_create_csv_response_streams_export_with_symfony_headers()
+	{
+		$filters = [
+			'user_id' => 42,
+			'consent_version' => 2,
+		];
+
+		$this->acp_manager->expects(self::once())
+			->method('stream_logs_csv')
+			->with(self::isType('resource'), $filters)
+			->willReturnCallback(static function ($handle) {
+				fputcsv($handle, ['anon-id', '2024-01-01T00:00:00Z', 2, 'necessary,analytics']);
+			});
+
+		$controller = new \phpbb\consentmanager\tests\controller\testable_acp_controller(
+			$this->language,
+			$this->acp_manager,
+			$this->translation_manager,
+			$this->create_request_mock(),
+			$this->template,
+			'',
+			'php'
+		);
+
+		$response = $controller->create_csv_response_for_test($filters);
+
+		self::assertInstanceOf('\Symfony\Component\HttpFoundation\StreamedResponse', $response);
+		self::assertSame('text/csv; charset=UTF-8', $response->headers->get('Content-Type'));
+		self::assertRegExp('/^attachment; filename="?consent_logs_\d{4}-\d{2}-\d{2}_\d{6}\.csv"?$/', $response->headers->get('Content-Disposition'));
+		self::assertTrue($response->headers->hasCacheControlDirective('no-cache'));
+		self::assertTrue($response->headers->hasCacheControlDirective('no-store'));
+		self::assertTrue($response->headers->hasCacheControlDirective('must-revalidate'));
+		self::assertSame('no-cache', $response->headers->get('Pragma'));
+		self::assertSame('0', $response->headers->get('Expires'));
+
+		ob_start();
+		$response->sendContent();
+		$content = ob_get_clean();
+
+		self::assertSame(
+			"\xEF\xBB\xBFanonymized_id,timestamp,consent_version,categories\n" .
+			"anon-id,2024-01-01T00:00:00Z,2,\"necessary,analytics\"\n",
+			$content
+		);
+	}
+
 	public function test_handle_logs_delete_confirmed_logs_and_triggers_success_notice()
 	{
 		self::$valid_form = true;
@@ -775,6 +821,11 @@ protected function send_csv_download(array $filters)
 		$this->captured_filters = $filters;
 		// Do not stream or exit — just record the filters for assertions
 	}
+
+	public function create_csv_response_for_test(array $filters)
+	{
+		return $this->create_csv_response($filters);
+	}
 }
 
 namespace phpbb\consentmanager\controller;

From 259724bce6020015b0cdc7a6b53a7d8b238f209b Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:19:41 -0700
Subject: [PATCH 4/8] Fix double-escaping

---
 adm/style/consentmanager_acp_banner.html |  2 +-
 tests/functional/acp_test.php            | 43 ++++++++++++++++++++++--
 2 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/adm/style/consentmanager_acp_banner.html b/adm/style/consentmanager_acp_banner.html
index 6eabdf8..b7be09b 100644
--- a/adm/style/consentmanager_acp_banner.html
+++ b/adm/style/consentmanager_acp_banner.html
@@ -30,7 +30,7 @@ <h3>{{ lang('WARNING') }}</h3>
 					</td>
 					{% for translation in language.TRANSLATIONS %}
 						<td>
-							<textarea name="translations[{{ language.ISO }}][{{ translation.KEY }}]" rows="4" cols="36" style="width:80%">{{ translation.VALUE|e('html') }}</textarea>
+							<textarea name="translations[{{ language.ISO }}][{{ translation.KEY }}]" rows="4" cols="36" style="width:80%">{{ translation.VALUE }}</textarea>
 						</td>
 					{% endfor %}
 				</tr>
diff --git a/tests/functional/acp_test.php b/tests/functional/acp_test.php
index 2fa6797..b94d728 100644
--- a/tests/functional/acp_test.php
+++ b/tests/functional/acp_test.php
@@ -115,9 +115,35 @@ public function test_acp_force_reprompt_increments_version()
 		$this->assertSame($before + 1, $this->get_consent_version());
 	}
 
-	protected function get_module_url()
+	public function test_banner_translation_does_not_double_escape_on_resave()
 	{
-		return 'adm/index.php?i=%5Cphpbb%5Cconsentmanager%5Cacp%5Cconsentmanager_module&mode=settings&sid=' . $this->sid;
+		$banner_title = 'Cookies & Privacy';
+
+		$this->login();
+		$this->admin_login();
+
+		$crawler = self::request('GET', $this->get_module_url('banner'));
+		$form = $crawler->selectButton($this->lang('SUBMIT'))->form();
+		$form['translations[en][banner_title]']->setValue($banner_title);
+		$crawler = self::submit($form);
+
+		$this->assertStringContainsString($this->lang('ACP_CONSENTMANAGER_BANNER_UPDATED'), $crawler->text());
+		$this->assertSame('Cookies &amp; Privacy', $this->get_stored_translation('banner_title', 'en'));
+
+		$crawler = self::request('GET', $this->get_module_url('banner'));
+		$form = $crawler->selectButton($this->lang('SUBMIT'))->form();
+		$this->assertSame($banner_title, $form['translations[en][banner_title]']->getValue());
+		self::submit($form);
+
+		$this->assertSame('Cookies &amp; Privacy', $this->get_stored_translation('banner_title', 'en'));
+
+		$crawler = self::request('GET', 'index.php');
+		$this->assertSame($banner_title, $crawler->filter('#consent-manager-banner-title')->text());
+	}
+
+	protected function get_module_url($mode = 'settings')
+	{
+		return 'adm/index.php?i=%5Cphpbb%5Cconsentmanager%5Cacp%5Cconsentmanager_module&mode=' . $mode . '&sid=' . $this->sid;
 	}
 
 	protected function get_consent_version()
@@ -131,4 +157,17 @@ protected function get_consent_version()
 
 		return $value;
 	}
+
+	protected function get_stored_translation($translation_key, $lang_iso)
+	{
+		$sql = 'SELECT translation_text
+			FROM phpbb_consentmanager_translations
+			WHERE translation_key = \'' . $this->db->sql_escape($translation_key) . '\'
+				AND lang_iso = \'' . $this->db->sql_escape($lang_iso) . "'";
+		$result = $this->db->sql_query($sql);
+		$value = $this->db->sql_fetchfield('translation_text');
+		$this->db->sql_freeresult($result);
+
+		return $value;
+	}
 }

From 119cd939afc0b7bab0030e110195d2f16610fb61 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:27:28 -0700
Subject: [PATCH 5/8] Fix possible JS thrown error

---
 styles/all/template/js/consentmanager.js |  4 ++--
 tests/javascript/consentmanager.test.js  | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/styles/all/template/js/consentmanager.js b/styles/all/template/js/consentmanager.js
index 86c544d..a28730e 100644
--- a/styles/all/template/js/consentmanager.js
+++ b/styles/all/template/js/consentmanager.js
@@ -19,8 +19,6 @@
 	const categoriesById = {};
 	const deferredSelector = 'script[type="text/plain"][data-consent-category]';
 	const deferredEmbedSelector = '[data-consent-media-container][data-consent-category]';
-	const googleConsentMode = payload.googleConsentMode || {};
-	const googleConsentTypes = googleConsentMode.types || {};
 	let requiredCategories = [];
 	let enabledCategories = [];
 	let optionalCategories = [];
@@ -31,6 +29,8 @@
 		return;
 	}
 
+	const googleConsentMode = payload.googleConsentMode || {};
+	const googleConsentTypes = googleConsentMode.types || {};
 	const mediaPlaceholderLabel = typeof lang.mediaPlaceholderLabel === 'string' ? lang.mediaPlaceholderLabel : '';
 
 	function isArray(value)
diff --git a/tests/javascript/consentmanager.test.js b/tests/javascript/consentmanager.test.js
index b01e435..177cdcd 100644
--- a/tests/javascript/consentmanager.test.js
+++ b/tests/javascript/consentmanager.test.js
@@ -175,7 +175,9 @@ function setupConsentManager(options) {
 		window.document.cookie = payload.cookieName + '=' + encodeURIComponent(JSON.stringify(settings.cookieState));
 	}
 
-	window.phpbbConsentManagerPayload = payload;
+	if (!settings.withoutPayload) {
+		window.phpbbConsentManagerPayload = payload;
+	}
 	window.phpbbConsentManagerLang = createLang(settings.lang);
 	window.eval(scriptSource);
 
@@ -198,6 +200,15 @@ afterEach(() => {
 	jest.restoreAllMocks();
 });
 
+test('exits cleanly when payload is missing', () => {
+	const { window, jsdomErrors } = setupConsentManager({
+		withoutPayload: true
+	});
+
+	expect(window.consentManager).toBeUndefined();
+	expect(jsdomErrors).toEqual([]);
+});
+
 test('prefers the newest stored state and synchronizes cookie and local storage', () => {
 	const localState = createState([ 'necessary', 'marketing' ], '2026-04-27T00:00:00.000Z');
 	const cookieState = createState([ 'necessary', 'analytics' ], '2026-04-28T00:00:00.000Z');

From c9844df36f6b72957d29002fbf38778bc6419d15 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:33:05 -0700
Subject: [PATCH 6/8] Use secure cookies on https

---
 styles/all/template/js/consentmanager.js |  5 +++++
 tests/javascript/consentmanager.test.js  | 18 +++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/styles/all/template/js/consentmanager.js b/styles/all/template/js/consentmanager.js
index a28730e..e533934 100644
--- a/styles/all/template/js/consentmanager.js
+++ b/styles/all/template/js/consentmanager.js
@@ -102,6 +102,11 @@
 	{
 		let cookie = name + '=' + encodeURIComponent(value) + '; path=/; SameSite=Lax';
 
+		if (window.location.protocol === 'https:')
+		{
+			cookie += '; Secure';
+		}
+
 		if (typeof maxAge === 'number')
 		{
 			cookie += '; max-age=' + maxAge;
diff --git a/tests/javascript/consentmanager.test.js b/tests/javascript/consentmanager.test.js
index 177cdcd..3b52951 100644
--- a/tests/javascript/consentmanager.test.js
+++ b/tests/javascript/consentmanager.test.js
@@ -108,7 +108,7 @@ function setupConsentManager(options) {
 	});
 	const dom = new JSDOM(createMarkup(settings.extraMarkup), {
 		runScripts: 'dangerously',
-		url: 'https://example.com/',
+		url: settings.url || 'https://example.com/',
 		virtualConsole
 	});
 	const { window } = dom;
@@ -274,6 +274,22 @@ test('accept-all persists consent, logs the decision, and updates the UI state',
 	});
 });
 
+test('marks the consent cookie secure only on HTTPS', () => {
+	const https = setupConsentManager();
+	click(https.window, '[data-consent-action="accept-all"]');
+	const httpsCookie = https.dom.cookieJar.getCookiesSync('https://example.com/')
+		.find((cookie) => cookie.key === https.payload.cookieName);
+
+	expect(httpsCookie.secure).toBe(true);
+
+	const http = setupConsentManager({ url: 'http://example.com/' });
+	click(http.window, '[data-consent-action="accept-all"]');
+	const httpCookie = http.dom.cookieJar.getCookiesSync('http://example.com/')
+		.find((cookie) => cookie.key === http.payload.cookieName);
+
+	expect(httpCookie.secure).toBe(false);
+});
+
 test('updates Google consent mode before activating newly consented marketing scripts', () => {
 	const { window, gtagCalls } = setupConsentManager({
 		withGtag: true,

From b281c2afaa88225fc03d8a62d511120d534d4548 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:47:59 -0700
Subject: [PATCH 7/8] Use garbage collection

---
 controller/acp_controller.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/controller/acp_controller.php b/controller/acp_controller.php
index dd26c24..0d91e5a 100644
--- a/controller/acp_controller.php
+++ b/controller/acp_controller.php
@@ -300,7 +300,8 @@ protected function send_csv_download(array $filters)
 
 		$this->create_csv_response($filters)->send();
 
-		exit;
+		garbage_collection();
+		exit_handler();
 	}
 
 	protected function create_csv_response(array $filters)

From 0a13afaea383d13f14a8a1916f4b3a1932200c0b Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Sun, 2 Aug 2026 11:53:57 -0700
Subject: [PATCH 8/8] Strenghten consent logging against abuse

---
 service/log_manager.php            | 70 ++++++++++++++++++++++++++++--
 tests/service/acp_manager_test.php |  4 +-
 tests/service/log_manager_test.php | 52 ++++++++++++++++++++++
 3 files changed, 120 insertions(+), 6 deletions(-)

diff --git a/service/log_manager.php b/service/log_manager.php
index a73f31b..665907a 100644
--- a/service/log_manager.php
+++ b/service/log_manager.php
@@ -16,6 +16,15 @@
 
 class log_manager
 {
+	/** Seconds during which an unchanged decision is considered a duplicate. */
+	public const DUPLICATE_WINDOW = 300;
+
+	/** Maximum accepted decisions per anonymized subject during the rate-limit window. */
+	public const RATE_LIMIT_MAX = 20;
+
+	/** Rate-limit window in seconds. */
+	public const RATE_LIMIT_WINDOW = 3600;
+
 	/** @var config */
 	protected $config;
 
@@ -50,19 +59,72 @@ public function __construct(config $config, driver_interface $db, user $user, $c
 	 * @param array $categories Accepted category ids
 	 * @param int   $version Consent version
 	 *
-	 * @return void
+	 * @return bool True when a row was inserted, false when suppressed
 	 */
 	public function log_consent(array $categories, $version)
 	{
+		$anonymized_id = $this->get_anonymized_subject();
+		$accepted_categories = json_encode(array_values($categories));
+		$now = time();
+
+		if ($this->should_suppress_submission($anonymized_id, (int) $version, $accepted_categories, $now))
+		{
+			return false;
+		}
+
 		$record = [
-			'anonymized_id' => $this->get_anonymized_subject(),
+			'anonymized_id' => $anonymized_id,
 			'consent_version' => (int) $version,
-			'accepted_categories' => json_encode(array_values($categories)),
-			'consent_time' => time(),
+			'accepted_categories' => $accepted_categories,
+			'consent_time' => $now,
 		];
 
 		$sql = 'INSERT INTO ' . $this->consent_logs_table . ' ' . $this->db->sql_build_array('INSERT', $record);
 		$this->db->sql_query($sql);
+
+		return true;
+	}
+
+	/**
+	 * Suppress rapid duplicates and excessive submissions from one subject.
+	 *
+	 * @param string $anonymized_id Anonymized user or guest-session identifier
+	 * @param int    $version Consent version
+	 * @param string $accepted_categories JSON-encoded normalized categories
+	 * @param int    $now Current Unix timestamp
+	 *
+	 * @return bool
+	 */
+	protected function should_suppress_submission($anonymized_id, $version, $accepted_categories, $now)
+	{
+		$sql = 'SELECT consent_version, accepted_categories, consent_time
+			FROM ' . $this->consent_logs_table . "
+			WHERE anonymized_id = '" . $this->db->sql_escape($anonymized_id) . "'
+				AND consent_time >= " . ((int) $now - self::RATE_LIMIT_WINDOW) . '
+			ORDER BY consent_log_id DESC';
+		$result = $this->db->sql_query_limit($sql, self::RATE_LIMIT_MAX);
+		$count = 0;
+		$latest = null;
+
+		while ($row = $this->db->sql_fetchrow($result))
+		{
+			if ($latest === null)
+			{
+				$latest = $row;
+			}
+			$count++;
+		}
+		$this->db->sql_freeresult($result);
+
+		if ($latest !== null
+			&& (int) $latest['consent_time'] >= (int) $now - self::DUPLICATE_WINDOW
+			&& (int) $latest['consent_version'] === (int) $version
+			&& $latest['accepted_categories'] === $accepted_categories)
+		{
+			return true;
+		}
+
+		return $count >= self::RATE_LIMIT_MAX;
 	}
 
 	/**
diff --git a/tests/service/acp_manager_test.php b/tests/service/acp_manager_test.php
index f84dfc5..9859cc8 100644
--- a/tests/service/acp_manager_test.php
+++ b/tests/service/acp_manager_test.php
@@ -527,9 +527,9 @@ public function test_stream_logs_csv_batch_pagination_retrieves_all_rows()
 	{
 		$log_manager = $this->create_log_manager(10, 'session');
 
-		for ($i = 0; $i < 5; $i++)
+		for ($i = 1; $i <= 5; $i++)
 		{
-			$log_manager->log_consent(array('necessary'), 1);
+			$log_manager->log_consent(array('necessary'), $i);
 		}
 
 		$handle = fopen('php://memory', 'wb+');
diff --git a/tests/service/log_manager_test.php b/tests/service/log_manager_test.php
index 71fd43d..ab00aab 100644
--- a/tests/service/log_manager_test.php
+++ b/tests/service/log_manager_test.php
@@ -71,6 +71,58 @@ public function test_log_consent_uses_session_identifier_for_guests()
 			FROM phpbb_consentmanager_logs');
 	}
 
+	public function test_log_consent_suppresses_recent_duplicate()
+	{
+		$manager = $this->create_manager(ANONYMOUS, 'guest-session');
+
+		self::assertTrue($manager->log_consent(array('necessary'), 1));
+		self::assertFalse($manager->log_consent(array('necessary'), 1));
+		$this->assertLogCount(1);
+	}
+
+	public function test_log_consent_preserves_changed_decision()
+	{
+		$manager = $this->create_manager(ANONYMOUS, 'guest-session');
+
+		self::assertTrue($manager->log_consent(array('necessary'), 1));
+		self::assertTrue($manager->log_consent(array('necessary', 'analytics'), 1));
+		$this->assertLogCount(2);
+	}
+
+	public function test_log_consent_allows_duplicate_after_deduplication_window()
+	{
+		$manager = $this->create_manager(ANONYMOUS, 'guest-session');
+		$manager->log_consent(array('necessary'), 1);
+		$this->db->sql_query('UPDATE phpbb_consentmanager_logs
+			SET consent_time = ' . (time() - \phpbb\consentmanager\service\log_manager::DUPLICATE_WINDOW - 1));
+
+		self::assertTrue($manager->log_consent(array('necessary'), 1));
+		$this->assertLogCount(2);
+	}
+
+	public function test_log_consent_limits_submissions_per_subject()
+	{
+		$manager = $this->create_manager(ANONYMOUS, 'guest-session');
+
+		for ($version = 1; $version <= \phpbb\consentmanager\service\log_manager::RATE_LIMIT_MAX; $version++)
+		{
+			self::assertTrue($manager->log_consent(array('necessary'), $version));
+		}
+
+		self::assertFalse($manager->log_consent(array('necessary', 'analytics'), 999));
+		$this->assertLogCount(\phpbb\consentmanager\service\log_manager::RATE_LIMIT_MAX);
+	}
+
+	protected function assertLogCount($expected)
+	{
+		$result = $this->db->sql_query('SELECT COUNT(*) AS log_count
+			FROM phpbb_consentmanager_logs');
+		$count = (int) $this->db->sql_fetchfield('log_count');
+		$this->db->sql_freeresult($result);
+
+		self::assertSame($expected, $count);
+	}
+
 	protected function create_manager($user_id, $session_id)
 	{
 		$config = new \phpbb\config\config(array(