From 520d8ea12b8f97bc847131e0abd752e4bf94891a Mon Sep 17 00:00:00 2001
From: Roger Rehnelt <noreply@maennchen1.de>
Date: Thu, 1 Oct 2026 20:49:47 +0200
Subject: Widerruf: Nonce nicht mehr im gecachten HTML
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Der Dialog holt die Nonce beim Öffnen; eine abgelaufene ersetzt der Server, Dialog und Formularseite senden einmal neu (K48).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 views/mods/mod_revocation/page_form.phtml | 23 ++++++++++--
 views/mods/mod_revocation/wp_footer.phtml | 61 ++++++++++++++++++++++++++-----
 2 files changed, 72 insertions(+), 12 deletions(-)

diff --git a/views/mods/mod_revocation/page_form.phtml b/views/mods/mod_revocation/page_form.phtml
index 6dda801..f7849ff 100644
--- a/views/mods/mod_revocation/page_form.phtml
+++ b/views/mods/mod_revocation/page_form.phtml
@@ -112,7 +112,8 @@
 	const form = document.getElementById('wpsg_revocation_page_form');
 	if (form === null) return;
 
-	const nonce    = '<?php echo \wp_create_nonce('wpsg_mod_revocation_nonce'); ?>';
+	// Kann aus dem Seiten-Cache kommen; ist sie abgelaufen, schickt der Server eine frische mit (K48)
+	let nonce      = <?php echo \wp_json_encode(\wp_create_nonce('wpsg_mod_revocation_nonce')); ?>;
 	const endpoint = '<?php echo \admin_url('admin-ajax.php'); ?>?action=wpsg_mod_revocation&do=ajaxDialogSubmit';
 	const msg      = document.getElementById('wpsg_revocation_page_msg');
 	const button   = form.querySelector('.wpsg_revocation_page_submit');
@@ -155,11 +156,27 @@
 
 		const form_data = formDataToObject(new FormData(form));
 
-		fetch(endpoint, {
+		const post = retry => fetch(endpoint, {
 			method: 'POST',
+			credentials: 'same-origin',
 			headers: { 'Content-Type': 'application/json' },
 			body: JSON.stringify({ nonce: nonce, form_data: form_data })
-		}).then(res => res.json()).then(res => {
+		}).then(res => res.json().then(json => {
+
+			if (res.status === 403 && retry && (json?.data?.code ?? '') === 'wpsg_nonce') {
+
+				nonce = json.data.nonce;
+				return post(false);
+
+			}
+
+			if (!res.ok) throw new Error(res.status);
+
+			return json;
+
+		}));
+
+		post(true).then(res => {
 
 			button.disabled = false;
 
diff --git a/views/mods/mod_revocation/wp_footer.phtml b/views/mods/mod_revocation/wp_footer.phtml
index f6946c5..767a264 100644
--- a/views/mods/mod_revocation/wp_footer.phtml
+++ b/views/mods/mod_revocation/wp_footer.phtml
@@ -52,7 +52,48 @@
 	if ( window.wpsgRevocationReady ) return;
 	window.wpsgRevocationReady = true;
 
-	const wpsg_revocation_nonce = '<?php echo wp_create_nonce('wpsg_mod_revocation_nonce'); ?>';
+	const ajax_url = <?php echo wp_json_encode(admin_url('admin-ajax.php')); ?>;
+	const error_text = <?php echo wp_json_encode(__('Es ist ein Fehler aufgetreten. Bitte versuchen Sie es später erneut.', 'wpsg')); ?>;
+
+	// Keine Nonce im HTML: Die Seite kann aus dem Seiten-Cache kommen. Sie kommt beim ersten Öffnen frisch vom Server (K48)
+	let nonce = null;
+
+	const get_nonce = () => {
+
+		if (nonce !== null) return Promise.resolve(nonce);
+
+		return fetch(ajax_url + '?action=wpsg_mod_revocation&do=nonce&wpsg_frontend_ajax=1', { credentials: 'same-origin', cache: 'no-store' })
+			.then(res => res.json())
+			.then(res => { nonce = res.data.nonce; return nonce; });
+
+	};
+
+	// Sendet mit Nonce; ist sie abgelaufen, schickt der Server eine frische mit und es wird einmal neu gesendet
+	const send = (request, retry = true) => get_nonce().then(n => fetch(...request(n))).then(res => {
+
+		if (res.status !== 403 || !retry) return res;
+
+		return res.clone().json().then(json => {
+
+			if ((json?.data?.code ?? '') !== 'wpsg_nonce') return res;
+
+			nonce = json.data.nonce;
+
+			return send(request, false);
+
+		}, () => res);
+
+	});
+
+	const show_error = () => {
+
+		const target = el_dialog_content.querySelector('#msg_target') || el_dialog_content;
+
+		target.innerHTML = '<ul id="wpsg_error" class="wpsg_error"><li></li></ul>';
+		target.querySelector('#wpsg_error li').textContent = error_text;
+		el_dialog.classList.remove('loading');
+
+	};
 	const el_dialog = document.getElementById('wpsg_revocation_dialog');
 	const el_dialog_content = document.getElementById('wpsg_revocation_dialog').querySelector('.inner > .content');
 
@@ -98,16 +139,17 @@
 		 const formData = new FormData(form);
 		 const form_data = formDataToObject(formData);
 
-		fetch(<?php echo wp_json_encode(admin_url('admin-ajax.php').'?action=wpsg_mod_revocation&do=ajaxDialogSubmit'); ?>, {
+		send(n => [ ajax_url + '?action=wpsg_mod_revocation&do=ajaxDialogSubmit', {
 			method: 'POST',
+			credentials: 'same-origin',
 			headers: {
 				'Content-Type': 'application/json'
 			},
 			body: JSON.stringify({
-				nonce: wpsg_revocation_nonce,
+				nonce: n,
 				form_data: form_data,
 			})
-		}).then(res => res.json()).then(res => {
+		} ]).then(res => { if (!res.ok) throw new Error(res.status); return res.json(); }).then(res => {
 
 			let html = '';
   
@@ -134,7 +176,7 @@
 				
 			}
 
-		});
+		}).catch(show_error);
 
 	}
 	const close_dialog = event => {
@@ -189,20 +231,21 @@
 
 		});
 
-		fetch(<?php echo wp_json_encode(admin_url('admin-ajax.php')); ?>, {
+		send(n => [ ajax_url, {
 			method: 'POST',
+			credentials: 'same-origin',
 			body: new URLSearchParams({
-				nonce: wpsg_revocation_nonce,
+				nonce: n,
 				action: 'wpsg_mod_revocation',
 				do: 'ajaxDialogContent',
 				dialog_config: JSON.stringify(dialog_config),
 			})
-		}).then(res => res.text()).then(html => {
+		} ]).then(res => { if (!res.ok) throw new Error(res.status); return res.text(); }).then(html => {
 
 			el_dialog_content.innerHTML = html;
 			el_dialog.classList.remove('loading');
 
-		});
+		}).catch(show_error);
 
         setTimeout(() => {document.querySelector('[name="wpsg_revocation_reason[row][0][product_nr]"]')?.focus();}, 1000)
 
-- 
cgit v1.2.3