From 520d8ea12b8f97bc847131e0abd752e4bf94891a Mon Sep 17 00:00:00 2001 From: Roger Rehnelt Date: Thu, 1 Oct 2026 20:49:47 +0200 Subject: Widerruf: Nonce nicht mehr im gecachten HTML MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Der Dialog holt die Nonce beim Öffnen; eine abgelaufene ersetzt der Server, Dialog und Formularseite senden einmal neu (K48). Co-Authored-By: Claude Opus 5.5 --- views/mods/mod_revocation/page_form.phtml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) (limited to 'views/mods/mod_revocation/page_form.phtml') diff --git a/views/mods/mod_revocation/page_form.phtml b/views/mods/mod_revocation/page_form.phtml index 6dda801..f7849ff 100644 --- a/views/mods/mod_revocation/page_form.phtml +++ b/views/mods/mod_revocation/page_form.phtml @@ -112,7 +112,8 @@ const form = document.getElementById('wpsg_revocation_page_form'); if (form === null) return; - const nonce = ''; + // Kann aus dem Seiten-Cache kommen; ist sie abgelaufen, schickt der Server eine frische mit (K48) + let nonce = ; const endpoint = '?action=wpsg_mod_revocation&do=ajaxDialogSubmit'; const msg = document.getElementById('wpsg_revocation_page_msg'); const button = form.querySelector('.wpsg_revocation_page_submit'); @@ -155,11 +156,27 @@ const form_data = formDataToObject(new FormData(form)); - fetch(endpoint, { + const post = retry => fetch(endpoint, { method: 'POST', + credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nonce: nonce, form_data: form_data }) - }).then(res => res.json()).then(res => { + }).then(res => res.json().then(json => { + + if (res.status === 403 && retry && (json?.data?.code ?? '') === 'wpsg_nonce') { + + nonce = json.data.nonce; + return post(false); + + } + + if (!res.ok) throw new Error(res.status); + + return json; + + })); + + post(true).then(res => { button.disabled = false; -- cgit v1.2.3