[PATCH pmg-api/pmg-docs/pmg-gui 0/5] add optional consent-banner to be shown before login

[PATCH pmg-api/pmg-docs/pmg-gui 0/5] add optional consent-banner to be shown before login

[Stoiko Ivanov]

The idea is taken, and the code mostly copied from PVE, where this was
added to address:
https://bugzilla.proxmox.com/show_bug.cgi?id=5463

pmg-docs:

Stoiko Ivanov (1):
  pmgconfig: add short documentation of the consent banner

 pmgconfig.adoc | 7 +++++++
 1 file changed, 7 insertions(+)


pmg-api:

Stoiko Ivanov (2):
  config: add consent-text key
  pmgproxy: pass consent-text as template variable to index

 src/PMG/Config.pm           | 7 +++++++
 src/PMG/Service/pmgproxy.pm | 2 ++
 2 files changed, 9 insertions(+)


pmg-gui:

Stoiko Ivanov (2):
  login: show optional consent-banner before login
  system options: add online help link for consent banner

 js/LoginView.js     | 11 +++++++++++
 js/SystemOptions.js |  8 ++++++++
 pmg-index.html.tt   |  1 +
 3 files changed, 20 insertions(+)


Summary over all repositories:
  6 files changed, 36 insertions(+), 0 deletions(-)

-- 
Generated by murpp 0.12.0

[PATCH pmg-docs 1/5] pmgconfig: add short documentation of the consent banner

[Stoiko Ivanov]

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 pmgconfig.adoc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pmgconfig.adoc b/pmgconfig.adoc
index 2650069..dec7010 100644
--- a/pmgconfig.adoc
+++ b/pmgconfig.adoc
@@ -351,6 +351,13 @@ so they simply will not work if you use a public DNS server (because
 they are usually blocked). We recommend to use your own DNS server,
 which needs to be configured in 'recursive' mode.
 
+[[gui_consent_banner]]
+.Consent Banner
+
+A custom consent banner that has to be accepted before login can be configured
+in __Configuration -> Options -> Consent Text__. If there is no content, the
+consent banner will not be displayed. The text will be stored as a base64
+string in the `admin` section of `/etc/pmg/pmg.conf`.
 
 Options
 ~~~~~~~
-- 
2.47.3

[PATCH pmg-api 2/5] config: add consent-text key

[Stoiko Ivanov]

If set this text will be displayed to the user before login.
Limited to 64 kiB of base64 encoded data.

inspired by pve-cluster commit:
54db793 ("add consent-text parameter to datacenter config file")

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/Config.pm | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm
index a2ddbb3a..2c085614 100644
--- a/src/PMG/Config.pm
+++ b/src/PMG/Config.pm
@@ -155,6 +155,12 @@ EODESC
             pattern => '^\p{PosixPrint}{1,998}$',
             default => 'Proxmox Mail Gateway <postmaster>',
         },
+        'consent-text' => {
+            description => "Consent text that is displayed before logging in.",
+            type => 'string',
+            maxLength => 64*1024,
+            default => '',
+        },
     };
 }
 
@@ -175,6 +181,7 @@ sub options {
         dkim_selector => { optional => 1 },
         'dkim-use-domain' => { optional => 1 },
         'admin-mail-from' => { optional => 1 },
+        'consent-text' => { optional => 1 },
     };
 }
 
-- 
2.47.3

[PATCH pmg-api 3/5] pmgproxy: pass consent-text as template variable to index

[Stoiko Ivanov]

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/Service/pmgproxy.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/PMG/Service/pmgproxy.pm b/src/PMG/Service/pmgproxy.pm
index de7a6c58..7bcadd53 100644
--- a/src/PMG/Service/pmgproxy.pm
+++ b/src/PMG/Service/pmgproxy.pm
@@ -267,6 +267,7 @@ sub get_index {
 
     my $cfg = PMG::Config->new();
     my $quarantinelink = $cfg->get('spamquar', 'quarantinelink');
+    my $consent_text = $cfg->get('admin', 'consent-text');
 
     $username = '' if !$username;
 
@@ -292,6 +293,7 @@ sub get_index {
         i18n_yew_mobile_mtime => $i18n_yew_mtime,
         yew_mobile_mtime => $ui_yew_mtime,
         yew_mobile_base_path => '/mobile',
+        consenttext => $consent_text,
     };
 
     my $template_name;
-- 
2.47.3

[PATCH pmg-gui 4/5] login: show optional consent-banner before login

[Stoiko Ivanov]

adapted from pve-manager commit:
2e42468a ("show optional consent-banner before login")

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 js/LoginView.js     | 11 +++++++++++
 js/SystemOptions.js |  7 +++++++
 pmg-index.html.tt   |  1 +
 3 files changed, 19 insertions(+)

diff --git a/js/LoginView.js b/js/LoginView.js
index e897683..4651423 100644
--- a/js/LoginView.js
+++ b/js/LoginView.js
@@ -31,6 +31,17 @@ Ext.define('PMG.LoginView', {
             me.lookup('quarantineButton').setVisible(!!Proxmox.QuarantineLink);
 
             if (view.targetview !== 'quarantineview') {
+                if (Proxmox.ConsentText) {
+                    let oidc_auth_redirect = Proxmox.Utils.getOpenIDRedirectionAuthorization();
+                    if (oidc_auth_redirect === undefined) {
+                        Ext.create('Proxmox.window.ConsentModal', {
+                            autoShow: true,
+                            consent: Proxmox.Markdown.parse(
+                                Proxmox.Utils.base64ToUtf8(Proxmox.ConsentText),
+                            ),
+                        });
+                    }
+                }
                 return;
             }
 
diff --git a/js/SystemOptions.js b/js/SystemOptions.js
index 517eb71..5bf7127 100644
--- a/js/SystemOptions.js
+++ b/js/SystemOptions.js
@@ -93,6 +93,13 @@ Ext.define('PMG.SystemOptions', {
 
         me.add_proxy_row('http_proxy', gettext('HTTP proxy'));
 
+        me.add_textareafield_row('consent-text', gettext('Consent Text'), {
+            deleteEmpty: true,
+            fieldOpts: {
+                maxLength: 64 * 1024,
+            },
+        });
+
         me.callParent();
 
         me.on('activate', me.rstore.startUpdate);
diff --git a/pmg-index.html.tt b/pmg-index.html.tt
index 10f9a2d..3e3c4b6 100644
--- a/pmg-index.html.tt
+++ b/pmg-index.html.tt
@@ -45,6 +45,7 @@
         UserName: '[% username %]',
         CSRFPreventionToken: '[% token %]',
         QuarantineLink: [% IF quarantinelink %] true [% ELSE %] false [% END %],
+        ConsentText: '[% consenttext %]',
       };
     </script>
     <script type="text/javascript" src="/proxmoxlib.js?ver=[% wtversion %]"></script>
-- 
2.47.3

[PATCH pmg-gui 5/5] system options: add online help link for consent banner

[Stoiko Ivanov]

this needs a versioned build-depends on pmg-docs in a version that has
the anchor defined.

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 js/SystemOptions.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/SystemOptions.js b/js/SystemOptions.js
index 5bf7127..92dc5d0 100644
--- a/js/SystemOptions.js
+++ b/js/SystemOptions.js
@@ -98,6 +98,7 @@ Ext.define('PMG.SystemOptions', {
             fieldOpts: {
                 maxLength: 64 * 1024,
             },
+            onlineHelp: 'gui_consent_banner',
         });
 
         me.callParent();
-- 
2.47.3

Re: [PATCH pmg-api/pmg-docs/pmg-gui 0/5] add optional consent-banner to be shown before login

[Dominik Csapak]

had a look over the code and tested a bit.

a few high level points:

* not sure if we would benefit from refactoring the 'consent-text'
   schema/format into pve-common (this was recently also done for the
   'location', but since we only have it in two places currently
   i'd tend not to, so this looks currently fine to me

* the consent text will not be shown in the quarantine view.
   my guess is that users who need the consent text also need it in the
   quarantine (maybe even before automatically logging in?)
   should we add a separate consent text? we could always add this later
   too though. If we add this, we'd also have to add it in the mobile
   quarantine of course.


Aside from these, consider the patches:

Reviewed-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-by: Dominik Csapak <d.csapak@proxmox.com>


On 6/8/26 8:57 AM, Stoiko Ivanov wrote:
> The idea is taken, and the code mostly copied from PVE, where this was
> added to address:
> https://bugzilla.proxmox.com/show_bug.cgi?id=5463
> 
> pmg-docs:
> 
> Stoiko Ivanov (1):
>    pmgconfig: add short documentation of the consent banner
> 
>   pmgconfig.adoc | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> 
> pmg-api:
> 
> Stoiko Ivanov (2):
>    config: add consent-text key
>    pmgproxy: pass consent-text as template variable to index
> 
>   src/PMG/Config.pm           | 7 +++++++
>   src/PMG/Service/pmgproxy.pm | 2 ++
>   2 files changed, 9 insertions(+)
> 
> 
> pmg-gui:
> 
> Stoiko Ivanov (2):
>    login: show optional consent-banner before login
>    system options: add online help link for consent banner
> 
>   js/LoginView.js     | 11 +++++++++++
>   js/SystemOptions.js |  8 ++++++++
>   pmg-index.html.tt   |  1 +
>   3 files changed, 20 insertions(+)
> 
> 
> Summary over all repositories:
>    6 files changed, 36 insertions(+), 0 deletions(-)
> 

Re: [PATCH pmg-api/pmg-docs/pmg-gui 0/5] add optional consent-banner to be shown before login

[Stoiko Ivanov]

Thanks for checking the patches!

On Mon, 8 Jun 2026 09:19:32 +0200
Dominik Csapak <d.csapak@proxmox.com> wrote:

> had a look over the code and tested a bit.
> 
> a few high level points:
> 
> * not sure if we would benefit from refactoring the 'consent-text'
>    schema/format into pve-common (this was recently also done for the
>    'location', but since we only have it in two places currently
>    i'd tend not to, so this looks currently fine to me
As it's 2 places I'd also tend to keep it in pve-cluster/pmg-api for now.

> 
> * the consent text will not be shown in the quarantine view.
>    my guess is that users who need the consent text also need it in the
>    quarantine (maybe even before automatically logging in?)
>    should we add a separate consent text? we could always add this later
>    too though. If we add this, we'd also have to add it in the mobile
>    quarantine of course.
Hm - did not consider that - and if there's demand for it and we implement
it I'd definitely say it needs to be 2 separate texts, or to have the
option to enable it for the admin-interface only.
The UX of clicking on an action in your report mail and then having to
click on the consent banner before it gets done seems like it might make
sense to not send the action links in those cases (but users who enable
the consent-banner for the quarantine interface can adapt their
report-templates).
For me this can be done at a later point.


> 
> 
> Aside from these, consider the patches:
> 
> Reviewed-by: Dominik Csapak <d.csapak@proxmox.com>
> Tested-by: Dominik Csapak <d.csapak@proxmox.com>
> 
> 
> On 6/8/26 8:57 AM, Stoiko Ivanov wrote:
> > The idea is taken, and the code mostly copied from PVE, where this was
> > added to address:
> > https://bugzilla.proxmox.com/show_bug.cgi?id=5463
> > 
> > pmg-docs:
> > 
> > Stoiko Ivanov (1):
> >    pmgconfig: add short documentation of the consent banner
> > 
> >   pmgconfig.adoc | 7 +++++++
> >   1 file changed, 7 insertions(+)
> > 
> > 
> > pmg-api:
> > 
> > Stoiko Ivanov (2):
> >    config: add consent-text key
> >    pmgproxy: pass consent-text as template variable to index
> > 
> >   src/PMG/Config.pm           | 7 +++++++
> >   src/PMG/Service/pmgproxy.pm | 2 ++
> >   2 files changed, 9 insertions(+)
> > 
> > 
> > pmg-gui:
> > 
> > Stoiko Ivanov (2):
> >    login: show optional consent-banner before login
> >    system options: add online help link for consent banner
> > 
> >   js/LoginView.js     | 11 +++++++++++
> >   js/SystemOptions.js |  8 ++++++++
> >   pmg-index.html.tt   |  1 +
> >   3 files changed, 20 insertions(+)
> > 
> > 
> > Summary over all repositories:
> >    6 files changed, 36 insertions(+), 0 deletions(-)
> >   
> 

applied: [PATCH pmg-api/pmg-docs/pmg-gui 0/5] add optional consent-banner to be shown before login

[Thomas Lamprecht]

On Mon, 08 Jun 2026 08:56:18 +0200, Stoiko Ivanov wrote:
> The idea is taken, and the code mostly copied from PVE, where this was
> added to address:
> https://bugzilla.proxmox.com/show_bug.cgi?id=5463
> 
> pmg-docs:
> 
> Stoiko Ivanov (1):
>   pmgconfig: add short documentation of the consent banner
> 
> [...]

Applied, thanks!

[pmg-api]

[1/2] config: add consent-text key
      commit: 084d9a86b3eb14849fd1602c6c2c70309928a8ae
[2/2] pmgproxy: pass consent-text as template variable to index
      commit: 3fb2a1ce02f28e3304fac4019b50b97b0c5c3188

[pmg-docs]

[1/1] pmgconfig: add short documentation of the consent banner
      commit: 322d1c9063acf0a8ab80b85416e89a2ca167198b

[pmg-gui]:

[1/2] login: show optional consent-banner before login
      commit: 0778d75e889b8b33f57530a7723b037d5d55a9e7
[2/2] system options: add online help link for consent banner
      commit: 6eaeebce52bf42b3356dc6bee8844c1c6759112c