From 24481a9557d656cc69c75eda9f598f993db5b728 Mon Sep 17 00:00:00 2001
From: Roger Rehnelt <noreply@maennchen1.de>
Date: Sat, 3 Oct 2026 15:21:11 +0200
Subject: Widerrufsformular: Dialog zeigt nur eigene Bestellungen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bestellpositionen erscheinen nur für den angemeldeten Kunden, dem die Bestellung gehört, und nur, wenn die Position zur Bestellung gehört. Fehlende Angaben führen nicht mehr zum Abbruch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 views/mods/mod_revocation/ajaxDialogContent.phtml | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/views/mods/mod_revocation/ajaxDialogContent.phtml b/views/mods/mod_revocation/ajaxDialogContent.phtml
index fd160f0..163d004 100644
--- a/views/mods/mod_revocation/ajaxDialogContent.phtml
+++ b/views/mods/mod_revocation/ajaxDialogContent.phtml
@@ -18,7 +18,8 @@
 $arReason = \wpsgRevocation\Revocation::getReasons();
 
 	// Produkte
-	$dialog_config = json_decode((wp_kses_stripslashes($_REQUEST['dialog_config']??'[]')), true);
+	$dialog_config = json_decode((wp_kses_stripslashes((string)($_REQUEST['dialog_config']??'[]'))), true);
+	if (!is_array($dialog_config)) $dialog_config = [];
 
 	$contact_email = "";
 
@@ -38,20 +39,14 @@ $arReason = \wpsgRevocation\Revocation::getReasons();
 
 	<div id="msg_target"></div>
 
-	<?php if (sizeof($dialog_config['arOrderProductID']) > 0) { ?>
+	<?php /* Nur eigene Bestellungen des angemeldeten Kunden (Revocation::dialogRows) */ $arRows = Revocation::dialogRows((is_array($dialog_config)?($dialog_config['arOrderProductID']??null):null), $customer_login_id); ?>
+	<?php if (sizeof($arRows) > 0) { ?>
 
-		<?php foreach ($dialog_config['arOrderProductID'] as $row) {
+		<?php foreach ($arRows as $key => $row) {
 
-			$order_id = intval($row['order_id']);
-			$order_product_id = intval($row['order_product_id']);
-			$amount = intval($row['amount']);
-
-			$oOrder = \wpsg_order::getInstance($order_id);
-			$oOrderProduct = \wpsg_order_product::getInstance($order_product_id);
-
-			if (!$oOrder->isLoaded() || !$oOrderProduct->isLoaded()) continue;
-
-			$key = $order_id.'_'.$order_product_id;
+			$oOrder = $row['oOrder'];
+			$oOrderProduct = $row['oOrderProduct'];
+			$amount = $row['amount'];
 			$id = 'wpsg_rvd_'.$key; // eindeutige ids für die Beschriftungen (W5)
 
 		?>
-- 
cgit v1.2.3