gitmedia/gruene-seele
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Warenwirtschaft: Bugfix — Produkt speichern warf MethodNotAllowed (DELETE)

Browse source 
Das Lösch-Formular für gespeicherte Rezeptur-Inhaltsstoffe war in das
Produkt-Formular verschachtelt; Browser verwerfen das innere <form>-Tag,
wodurch _method=DELETE ins Speichern-Formular leakte. Jetzt Button, der
per JS ein eigenes Formular außerhalb erzeugt und abschickt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-21 08:45:48 +00:00
parent 93d5afca13
commit 8b0a598ba6
2 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
resources/views/admin/product/edit.blade.php
View file

@ -228,6 +228,17 @@
updateRecipeTotal();
});
// Löschen gespeicherter Inhaltsstoffe: eigenes Formular außerhalb des
// Produkt-Formulars, damit _method=DELETE nicht ins Speichern leakt.
$(document).on('click', '.js-ingredient-delete', function () {
var $btn = $(this);
if (!confirm($btn.data('confirm'))) return;
$('<form>', { method: 'post', action: $btn.data('action') })
.append($('<input>', { type: 'hidden', name: '_token', value: $('meta[name="csrf-token"]').attr('content') }))
.append($('<input>', { type: 'hidden', name: '_method', value: 'DELETE' }))
.appendTo('body')[0].submit();
});
$(document).on('input change', '.pi-gram, .pi-factor', function () {
updateEffective($(this).closest('tr'));
updateRecipeTotal();

13
resources/views/admin/product/form.blade.php
View file

@ -637,12 +637,13 @@
<td class="align-middle pi-effective text-right small text-muted">—</td>
<td class="align-middle">
@if ($product->id)
<form method="post" action="{{ route('admin_product_delete', [$product->id, 'ingredient', $ingredient->id]) }}"
class="d-inline" onsubmit="return confirm('{{ __('Eintrag entfernen?') }}');">
@csrf
@method('DELETE')
<button type="submit" class="btn btn-link text-danger p-0 border-0 align-baseline"><i class="far fa-trash-alt"></i></button>
</form>
{{-- Kein <form> hier: der Button liegt im Produkt-Formular, verschachtelte
Formulare würden _method=DELETE ins Speichern-Formular leaken. --}}
<button type="button"
class="btn btn-link text-danger p-0 border-0 align-baseline js-ingredient-delete"
data-action="{{ route('admin_product_delete', [$product->id, 'ingredient', $ingredient->id]) }}"
data-confirm="{{ __('Eintrag entfernen?') }}"
title="{{ __('Entfernen') }}"><i class="far fa-trash-alt"></i></button>
@else
<a class="text-danger ingredient-row-remove" href="#"
title="{{ __('Entfernen') }}"><i class="far fa-trash-alt"></i></a>