From 8b0a598ba618517179a26b4ffb43b1e1e1ef425c Mon Sep 17 00:00:00 2001
From: Kevin Adametz <kevin.adametz@me.com>
Date: Tue, 21 Jul 2026 08:45:48 +0000
Subject: [PATCH] =?UTF-8?q?Warenwirtschaft:=20Bugfix=20=E2=80=94=20Produkt?=
 =?UTF-8?q?=20speichern=20warf=20MethodNotAllowed=20(DELETE)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Das Lösch-Formular für gespeicherte Rezeptur-Inhaltsstoffe war in das
Produkt-Formular verschachtelt; Browser verwerfen das innere <form>-Tag,
wodurch _method=DELETE ins Speichern-Formular leakte. Jetzt Button, der
per JS ein eigenes Formular außerhalb erzeugt und abschickt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 resources/views/admin/product/edit.blade.php | 11 +++++++++++
 resources/views/admin/product/form.blade.php | 13 +++++++------
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/resources/views/admin/product/edit.blade.php b/resources/views/admin/product/edit.blade.php
index 885e57f..1ce5ad8 100755
--- a/resources/views/admin/product/edit.blade.php
+++ b/resources/views/admin/product/edit.blade.php
@@ -228,6 +228,17 @@
             updateRecipeTotal();
         });
 
+        // Löschen gespeicherter Inhaltsstoffe: eigenes Formular außerhalb des
+        // Produkt-Formulars, damit _method=DELETE nicht ins Speichern leakt.
+        $(document).on('click', '.js-ingredient-delete', function () {
+            var $btn = $(this);
+            if (!confirm($btn.data('confirm'))) return;
+            $('<form>', { method: 'post', action: $btn.data('action') })
+                .append($('<input>', { type: 'hidden', name: '_token', value: $('meta[name="csrf-token"]').attr('content') }))
+                .append($('<input>', { type: 'hidden', name: '_method', value: 'DELETE' }))
+                .appendTo('body')[0].submit();
+        });
+
         $(document).on('input change', '.pi-gram, .pi-factor', function () {
             updateEffective($(this).closest('tr'));
             updateRecipeTotal();
diff --git a/resources/views/admin/product/form.blade.php b/resources/views/admin/product/form.blade.php
index 2c02b08..4ae7509 100755
--- a/resources/views/admin/product/form.blade.php
+++ b/resources/views/admin/product/form.blade.php
@@ -637,12 +637,13 @@
                             <td class="align-middle pi-effective text-right small text-muted">—</td>
                             <td class="align-middle">
                                 @if ($product->id)
-                                    <form method="post" action="{{ route('admin_product_delete', [$product->id, 'ingredient', $ingredient->id]) }}"
-                                          class="d-inline" onsubmit="return confirm('{{ __('Eintrag entfernen?') }}');">
-                                        @csrf
-                                        @method('DELETE')
-                                        <button type="submit" class="btn btn-link text-danger p-0 border-0 align-baseline"><i class="far fa-trash-alt"></i></button>
-                                    </form>
+                                    {{-- Kein <form> hier: der Button liegt im Produkt-Formular, verschachtelte
+                                         Formulare würden _method=DELETE ins Speichern-Formular leaken. --}}
+                                    <button type="button"
+                                        class="btn btn-link text-danger p-0 border-0 align-baseline js-ingredient-delete"
+                                        data-action="{{ route('admin_product_delete', [$product->id, 'ingredient', $ingredient->id]) }}"
+                                        data-confirm="{{ __('Eintrag entfernen?') }}"
+                                        title="{{ __('Entfernen') }}"><i class="far fa-trash-alt"></i></button>
                                 @else
                                     <a class="text-danger ingredient-row-remove" href="#"
                                         title="{{ __('Entfernen') }}"><i class="far fa-trash-alt"></i></a>