fix(debug): Restrict debug sidebar to backend users only

[Copilot]

The DEBUG sidebar was visible to all frontend visitors when debug mode was enabled, exposing sensitive debugging information (cookies, localStorage, consent status) to unauthenticated users.

Changes

• fragments/ConsentManager/box_cssjs.php: Added backend session check before loading debug script
  • Calls rex_backend_login::createUser() to initialize user context
  • Checks rex_backend_login::hasSession() && null !== rex::getUser() before output
  • Mirrors existing security pattern in boot.php OUTPUT_FILTER extension

Before/After

Before:

// Debug-Script laden wenn Debug-Modus aktiviert
if (isset($consent_manager->domainInfo['google_consent_mode_debug'])
    && 1 === $consent_manager->domainInfo['google_consent_mode_debug']) {
    $googleConsentModeOutput .= '<script src="' . $debugScriptUrl . '"></script>';
    // Debug config and script loaded for EVERYONE
}

After:

// Debug-Script laden wenn Debug-Modus aktiviert UND User im Backend eingeloggt
if (isset($consent_manager->domainInfo['google_consent_mode_debug'])
    && 1 === $consent_manager->domainInfo['google_consent_mode_debug']) {
    rex_backend_login::createUser();
    if (rex_backend_login::hasSession() && null !== rex::getUser()) {
        $googleConsentModeOutput .= '<script src="' . $debugScriptUrl . '"></script>';
        // Debug config and script loaded ONLY for backend users
    }
}

Debug sidebar now only appears for authenticated backend administrators, preventing information disclosure to public visitors.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>DEBUG-Seitenlasche im Frontend IMMER sichtbar</issue_title>
<issue_description>Rex 5.20.1 / CM Version 5.1.0

Wenn der CM auf "Debug" Mode steht, dann sollte die Seitenlasche die DEBUG-Infos nur für eingeloggte Backend-Nutzer sichtbar sein.

Das tut es nicht. Die Lasche wird IMMER eingeblendet, sobald der DEBUG-Modus aktiviert ist. Vermutlich ein kleiner Bug, da fehlt doch am Ende nur die Prüfung auf die Backend-Session vor der Ausgabe oder?

Gruß
Stefan</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes DEBUG-Seitenlasche im Frontend IMMER sichtbar #432

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR fixes a security vulnerability where the debug sidebar with sensitive information (cookies, localStorage, consent status) was visible to all frontend visitors when debug mode was enabled. The fix restricts debug script loading to authenticated backend users only.

Key Changes:

• Added backend session validation before loading debug scripts in the fragment that renders consent box CSS/JS
• Implemented the same security pattern already used in boot.php OUTPUT_FILTER extension