From 8ee9bbe86a9dd6a4ea9bdb6e6d8ee983196460d7 Mon Sep 17 00:00:00 2001
From: Roger Rehnelt <noreply@maennchen1.de>
Date: Thu, 1 Oct 2026 20:42:59 +0200
Subject: Widerruf: Skript im Fuß gekapselt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kein console.log mehr, kein Abbruch bei doppelt ausgegebenem Fuß, Texte escapt (K49).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 views/mods/mod_revocation/wp_footer.phtml | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/views/mods/mod_revocation/wp_footer.phtml b/views/mods/mod_revocation/wp_footer.phtml
index 9b3eb05..f6946c5 100644
--- a/views/mods/mod_revocation/wp_footer.phtml
+++ b/views/mods/mod_revocation/wp_footer.phtml
@@ -17,7 +17,7 @@
 	
 	<div id="wpsg_revocation_button">
 		<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Vertrag widerrufen</title><path d="M13.5,8H12V13L16.28,15.54L17,14.33L13.5,12.25V8M13,3A9,9 0 0,0 4,12H1L4.96,16.03L9,12H6A7,7 0 0,1 13,5A7,7 0 0,1 20,12A7,7 0 0,1 13,19C11.07,19 9.32,18.21 8.06,16.94L6.64,18.36C8.27,20 10.5,21 13,21A9,9 0 0,0 22,12A9,9 0 0,0 13,3" /></svg>
-		<span id="wpsg_revocation_button_text"><?php echo __('Vertrag widerrufen', 'wpsg'); ?></span>
+		<span id="wpsg_revocation_button_text"><?php echo esc_html__('Vertrag widerrufen', 'wpsg'); ?></span>
 	</div>
 	
 <?php } else { ?>
@@ -30,25 +30,28 @@
 <div id="wpsg_revocation_dialog" class="">
 	<div class="inner">
 		<div class="header">
-			<span><?php echo __('Widerrufsformular', 'wpsg'); ?></span>
+			<span><?php echo esc_html__('Widerrufsformular', 'wpsg'); ?></span>
 			<a href="#" class="close">
 				<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19,6.41L17.59,5L12,10.59L6.41,5L5,6.41L10.59,12L5,17.59L6.41,19L12,13.41L17.59,19L19,17.59L13.41,12L19,6.41Z" /></svg>
 			</a>
 		</div>
 		<div class="content"></div>
 		<div class="footer">
-			<button class="button button-primary wpsg_revocation_button_submit"><?php echo __('Widerruf bestätigen', 'wpsg'); ?></button>
+			<button class="button button-primary wpsg_revocation_button_submit"><?php echo esc_html__('Widerruf bestätigen', 'wpsg'); ?></button>
 		</div>
 		<div class="loading">
-			<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />
+			<img src="<?php echo esc_url(WPSG_URL.'views/gfx/ajax-loader.gif'); ?>" alt="<?php echo esc_attr__('Bitte warten ...', 'wpsg'); ?>" />
 		</div>
 	</div>
 </div>
 
 <script>
+( function() {
+
+	// In einer Funktion: Ein doppelt ausgegebener Fuß bricht sonst an doppelt deklarierten Namen ab
+	if ( window.wpsgRevocationReady ) return;
+	window.wpsgRevocationReady = true;
 
-	console.log('ok');
-	 
 	const wpsg_revocation_nonce = '<?php echo wp_create_nonce('wpsg_mod_revocation_nonce'); ?>';
 	const el_dialog = document.getElementById('wpsg_revocation_dialog');
 	const el_dialog_content = document.getElementById('wpsg_revocation_dialog').querySelector('.inner > .content');
@@ -95,7 +98,7 @@
 		 const formData = new FormData(form);
 		 const form_data = formDataToObject(formData);
 
-		fetch('<?php echo admin_url('admin-ajax.php'); ?>?action=wpsg_mod_revocation&do=ajaxDialogSubmit', {
+		fetch(<?php echo wp_json_encode(admin_url('admin-ajax.php').'?action=wpsg_mod_revocation&do=ajaxDialogSubmit'); ?>, {
 			method: 'POST',
 			headers: {
 				'Content-Type': 'application/json'
@@ -120,7 +123,7 @@
 
 			 } else {
 					
-				alert('<?php echo __('Ihr Widerruf ist bei uns eingegangen und wird nun bearbeitet.', 'wpsg'); ?>');
+				alert(<?php echo wp_json_encode(__('Ihr Widerruf ist bei uns eingegangen und wird nun bearbeitet.', 'wpsg')); ?>);
 				close_dialog(event);
 				
 				document.querySelectorAll('.wpsg_revocation_order_product_checkbox:checked').forEach(el => {
@@ -186,7 +189,7 @@
 
 		});
 
-		fetch('<?php echo admin_url('admin-ajax.php'); ?>', {
+		fetch(<?php echo wp_json_encode(admin_url('admin-ajax.php')); ?>, {
 			method: 'POST',
 			body: new URLSearchParams({
 				nonce: wpsg_revocation_nonce,
@@ -343,5 +346,6 @@
 		}
 
 	});
-	
+
+} )();
 </script>
\ No newline at end of file
-- 
cgit v1.2.3