(function () {
try {
// AQ-r2 (2026-06-09): respect the explicit-denial sentinel
// written by cookie-consent-harden.js writeATR() on any
// marketing-axis denial (payload.marketing === false; cycle-3 F1).
// Without this gate, the next page navigation re-creates
// gmx_first_touch from the current URL+referrer+utm_*+click_ids,
// silently undoing the reject-all deletion (sweep finding #1).
// The sentinel is cleared the moment the visitor grants
// marketing in the banner (analytics-only grant does NOT
// clear), restoring the writer path on the very next
// page load. Page-cache-safe: the sentinel is a
// browser-resident cookie checked in the inline script, so
// varnish/breeze-served HTML still hits this gate.
if (/(?:^|;\s*)gmx_consent_denied=1(?:;|$)/.test(document.cookie || '')) return;
var CLICK_IDS = ['gclid','fbclid','msclkid','ttclid','wbraid','gbraid','li_fat_id'];
var qs = new URLSearchParams(window.location.search);
var urlClickIdKey = null;
for (var i = 0; i < CLICK_IDS.length; i++) {
if (qs.get(CLICK_IDS[i])) { urlClickIdKey = CLICK_IDS[i]; break; }
}// Parse existing cookie.
var existing = null;
var match = document.cookie.match(/(?:^|;\s*)gmx_first_touch=([^;]+)/);
if (match) {
try { existing = JSON.parse(decodeURIComponent(match[1])); } catch (e) { existing = null; }
}// GWP-273 — referrer-enrichment branch.
// Keep existing unless either (a) URL carries a new click id
// the stored payload lacks (paid click is a higher-value
// signal and upgrades direct/organic), OR (b) the stored
// payload has empty referrer AND the current document.referrer
// is non-empty + external (Safari/ITP/policy-quirk catch:
// first-hit may have missed the referrer; later same-session
// page-loads can recover it).
var existingHasRef = !!(existing && existing.referrer && existing.referrer !== '');
var docRef = document.referrer || '';
var refHost = '';
if (docRef) {
try {
refHost = new URL(docRef).hostname.replace(/^www\./, '').toLowerCase();
} catch (e) { refHost = ''; }
}
var ownHost = (location.host || '').replace(/^www\./, '').toLowerCase();
var currentExternalRef = !!(refHost && refHost !== ownHost);
var canEnrichRef = !!existing && !existingHasRef && currentExternalRef;if (existing) {
if (!urlClickIdKey && !canEnrichRef) return;
if (urlClickIdKey && existing[urlClickIdKey] && !canEnrichRef) return;
}var utm_keys = [
'utm_source','utm_medium','utm_campaign','utm_content','utm_term',
'utm_adgroup','utm_matchtype','utm_network','utm_device','utm_placement'
];
// GWP-273 — merge-preserving base. When enriching an existing
// payload, retain its landing_url + ts + prior click ids /
// utms; only overlay referrer (and any click id appended below
// via the forEach). Branches with/without urlClickIdKey were
// collapsed — both produced the identical Object.assign — the
// click id is added uniformly later.
//
// GWP-273 design choice: "latest external referrer wins" —
// accepted edge case where a user opens a new external tab
// post-empty-first-touch and returns; low-volume, simple, no
// sentinel flag needed.
var data;
if (existing && canEnrichRef) {
data = Object.assign({}, existing, { referrer: docRef });
} else {
data = { landing_url: window.location.href, referrer: docRef, ts: Date.now() };
}
utm_keys.concat(CLICK_IDS).forEach(function (k) {
var v = qs.get(k);
if (v) data[k] = v;
});
// GWP-208 — carry Meta's first-party click-linker cookies (_fbc
// = fb.1.<ts>.<fbclid>, _fbp) into the captured payload so they
// ride the persistent gmx_first_touch cookie cross-page (LP X →
// LP Y) the same way the URL click-ids do. The CF7 hidden-field
// populator copies the whole payload verbatim, so fbc/fbp reach
// the lead even when the form lives on a page without ?fbclid.
var fbcMatch = document.cookie.match(/(?:^|;\s*)_fbc=([^;]+)/);
if (fbcMatch && fbcMatch[1]) data.fbc = decodeURIComponent(fbcMatch[1]);
var fbpMatch = document.cookie.match(/(?:^|;\s*)_fbp=([^;]+)/);
if (fbpMatch && fbpMatch[1]) data.fbp = decodeURIComponent(fbpMatch[1]);
var encoded = encodeURIComponent(JSON.stringify(data));
if (encoded.length > 3800) return;
var expires = new Date(Date.now() + 90 * 864e5).toUTCString(); // GWP-143 C1: match Google Ads 90-day attribution window
var secure = window.location.protocol === 'https:' ? '; Secure' : '';
document.cookie = 'gmx_first_touch=' + encoded + '; Path=/; Expires=' + expires + '; SameSite=Lax' + secure;
} catch (e) {}
})();
/* Meta Pixel base — inline in wp_head so Breeze Delay-All-JS does not defer it; fbevents.js is async-injected (optimizer-invisible). */
!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script',
'https://connect.facebook.net/en_US/fbevents.js');/* Symmetric with server GMX_Consent: revoke BEFORE init; cookies/sends held until grant. */
fbq('consent', 'revoke');
fbq('init', '1857131551802431');
fbq('track', 'PageView'); /* queued; flushed to Meta only after consent grant *//* Grant bridge — reads the SAME ATR marketing signal as GMX_Consent.applyConsent(). */
(function () {
function read(name){var m=document.cookie.match('(?:^|; )'+name.replace(/([.*+?^${}()|[\]\\])/g,'\\$1')+'=([^;]*)');return m?decodeURIComponent(m[1]):'';}
function marketingGranted(){
try {
var given = read('atr_cookie_notice_consent_given');
if (!given) return false; // undecided -> stay revoked
var c = JSON.parse(read('atr_cookie_notice_consent') || '{}');
return !!(c.marketing || c.ad_storage === 'granted');
} catch (e) { return false; } // NO-SILENT-OK: parse/read failure degrades gracefully to revoked (consent stays held; no marketing send) — not an error to report.
}
function apply(){ if (marketingGranted()) fbq('consent', 'grant'); }
apply();
document.addEventListener('click', function(ev){
if (ev.target && ev.target.closest && ev.target.closest('[class*="atr-cookie"], #atr-cookie-notice')) setTimeout(apply, 50);
}, true);
window.addEventListener('storage', apply);
})();
var breeze_prefetch = {"local_url":"https://gomixapp.com","ignore_remote_prefetch":"1","ignore_list":["/cart/","/checkout/","/my-account/","https://gomixapp.co.il/(.)/u05d4u05d8u05d5u05e4u05e1-u05e0u05e9u05dcu05d7-u05d1u05d4u05e6u05dcu05d7u05d4/","wp-admin","wp-login.php"]};
//# sourceURL=breeze-prefetch-js-extra
Looking for a building cleaning schedule? Here is a ready-to-use weekly cleaning schedule in English for a shared residential building in Israel — area by area, day by day — to copy in one click, print for the notice board, or download as a Word file and adapt to your building and your cleaning contract.
Weekly Building Cleaning Schedule — [Building address]
In effect from: [Date] | Cleaning company: [Cleaning company name] | Supervised by: [Management company name]
Sunday — Lobby and ground floor:
– Sweep and wash the lobby and entrance area
– Clean the glass doors and remove fingerprints
– Empty the bins in the common areas
Monday — Stairwell (all floors):
– Sweep and wash the stairs and landings
– Wipe the railings and handrails
– Check the lighting and report burnt-out bulbs
Tuesday — Elevator:
– Clean the elevator car: floor, walls and mirror
– Disinfect the buttons in the car and on every floor
– Clean the door tracks on the ground floor
Wednesday — Parking garage, trash room and storage areas:
– Sweep the garage and remove bulky waste
– Wash the trash room area and arrange the recycling bins
– Check the drainage openings in the garage
Thursday — Building front, garden and outdoor areas:
– Sweep the paths and the outdoor entrance area
– Clean the mailboxes and the notice board
– Garden care and watering [If applicable]
Friday — Final round before the weekend:
– Empty all the bins and replace the liners
– Quick wash of the lobby and entrance
– General check and a defect report to the management company
Monthly tasks (first week of every month):
– Wash walls, doors and windows in the common areas
– Deep wash / polish of the lobby floor [Per contract]
– Clean the high light fixtures
Notes, requests and reports: [Contact name], phone [Phone]
Fill in the details — the notice updates automatically:
How to build a cleaning schedule that actually works
Cleaning is the number one resident complaint in Israeli shared buildings — not because the cleaners do not work, but because nobody knows exactly what they are supposed to do and when. “The cleaner was here yesterday” means nothing when a resident sees a stain in the lobby. An orderly cleaning schedule solves this in both directions: residents know what to expect on each day, and the management company gets a checkable supervision tool — you can check on Tuesday whether the elevator is clean, instead of arguing in general terms about “the standard of cleaning”.
The core principle: divide the building into areas, and assign each area a fixed day — by traffic load. The lobby and the elevator absorb most of the traffic, so they open and close the week (Sunday, plus a catch-up round on Friday); the stairwell gets its own day, working from the top floor down; the parking garage, trash room and outdoor areas make do with a weekly round. The schedule runs Sunday to Friday — the Israeli working week — with Friday as a short round before Shabbat. That way each day is a focused one-to-two-hour task instead of “clean the building” — and nothing gets forgotten.
Building size sets the intensity: in a small walk-up you can consolidate the schedule into two concentrated weekly visits; in a tower with a staffed lobby, the public floors move to daily cleaning with a weekly round for the rest. The following table summarizes the recommended frequency per area — a good starting point for negotiating with the cleaning company:
Area
Recommended frequency
Notes
Lobby and entrance
2-3 times a week (daily in towers)
Glass doors, fingerprints, entrance mat
Stairwell
1-2 times a week
Railings and handrails, report burnt-out bulbs
Elevator
2-3 times a week
Mirror and buttons, ground-floor door tracks
Parking garage and storage
Once a week
Bulky waste removal, drainage openings before winter
Trash room
1-2 times a week
Wash and disinfect, arrange recycling bins, odors
Front, yard and garden
Once a week
Mailboxes, notice board, paths and falling leaves
Monthly tasks
First week of the month
Walls and doors, windows, floor polish, light fixtures
And finally — supervision and publication. A schedule without checks erodes within a month: have the cleaner sign off after every round (the supervision line at the bottom of the template), run a spot check every week or two, and give residents an orderly reporting channel instead of complaints in the group. Post the schedule in two places — the entrance notice board and the service room — and update it ahead of the Jewish holidays (an extra round before a chag) and in winter (entrance mopping on rainy days). A transparent, current schedule is the difference between “we pay and see nothing” and “we see exactly what we pay for”.
Frequently Asked Questions
How often should a shared building be cleaned?
It depends on the size and traffic: in a small building (up to 12 apartments, no elevator) 1-2 times a week for the stairwell and lobby is customary. In a medium building — 2-3 times a week. In a large building or tower with elevators and extensive public areas — daily cleaning of the lobby and elevators, and a full weekly round for the other areas. Fix the exact frequency in the contract with the cleaning company.
How much does cleaning a shared building cost in Israel?
The accepted range is roughly 25-60 NIS per apartment per month for cleaning alone, depending on the building’s size, the number of floors, the frequency and the scope of tasks (garage, trash room, yard). In a 20-apartment building this is usually the biggest item in the building fee after the elevator — which is exactly why the cleaning schedule should define precisely what you get for it.
Why do we need a schedule rather than just ‘the cleaner comes twice a week’?
Because ‘they came and cleaned nothing’ is the most common resident complaint. A schedule that maps day to area and tasks makes the service checkable: a resident knows the elevator should be clean on Tuesday, and the committee knows exactly what to inspect. It also protects the cleaning company from unfair complaints — what is not on the schedule was never promised.
Who is responsible for supervising the cleaning company?
The management company (or the building committee in a building without one). Effective supervision combines three things: the cleaner signing off after every round, occasional spot checks every week or two, and a simple reporting channel for residents — a maintenance request form or a message to the service center — when something was not done.
What do the monthly tasks include beyond the weekly round?
Jobs there is no point doing every week: washing walls and doors, cleaning the windows in the common areas, polishing or deep-washing the lobby floor, cleaning light fixtures and the inside of the mailboxes. It is customary to fix them for the first week of every month, and to state in the contract which are included in the price and which cost extra.
How should the schedule adapt to holidays and the weather?
Before the Jewish holidays, reinforce: an extra round on the eve of the chag when the building fills with guests, and special attention to the trash room, which fills up fast. In winter add entrance mopping and an anti-slip check on rainy days, and in leaf-fall season — more frequent yard sweeping. A building that posts these adjustments in advance on the notice board saves the post-holiday wave of complaints.
Key Takeaways
Divide the building into areas and give each a fixed day, by traffic load
Lobby and elevator 2-3 times a week; garage, trash and outdoors — weekly
Monthly tasks (polish, walls, windows) in the first week of the month
Supervision: cleaner sign-off, spot checks and a reporting channel for residents
The schedule here is free — copy, print or download as Word
A paper schedule wrinkles, tears and goes stale within a week. With a digital notice board in the lobby the cleaning schedule stays on screen permanently — updated remotely before a holiday or a provider change, alongside the building’s day-to-day notices, in every building you manage.
document.addEventListener('click', function(e) {
var el = e.target.closest('.gmx-lite-yt');
if (!el) return;
var vid = el.getAttribute('data-vid');
if (!vid) return;
var iframe = document.createElement('iframe');
iframe.src = 'https://www.youtube.com/embed/' + vid + '?autoplay=1';
iframe.style.cssText = 'position:absolute;top:0;left:0;width:100%;height:100%;border:0;';
iframe.allow = 'autoplay;encrypted-media';
iframe.allowFullscreen = true;
el.style.position = 'relative';
el.innerHTML = '';
el.appendChild(iframe);
});
(function () {
var c = document.body.className;
c = c.replace(/woocommerce-no-js/, 'woocommerce-js');
document.body.className = c;
})();
var gmxCf7LegacyUxI18n = {"errName":"Please enter a full name","errPhone":"Please enter a valid phone number","errEmail":"Please enter a valid email address","errRequired":"Required field"};
//# sourceURL=gmx-cf7-legacy-ux-js-extra
var gmxCf7UxI18n = {"progressTemplate":"{N} field(s) remaining","allSet":"All set to send!","sending":"Sending\u2026","successTitle":"Thank you! Your inquiry has been received","successBody":"A representative will get back to you within 24 hours with a tailored quote.","successCtaLabel":"See our areas of expertise","successCtaHref":"/expertise/","errorTitle":"Submission failed","errorBody":"Please try again, or call us directly"};
//# sourceURL=gmx-cf7-ux-js-extra
var atrCookieNoticeSettings = {"cookieName":"atr_cookie_notice_consent","decisionCookieName":"atr_cookie_notice_consent_given","expiryDays":"365","autoHideDelay":"0","enableDebug":"","siteName":"GoMixApp","isPrivacyPage":"","privacyPolicyUrl":"https://gomixapp.com/privacy-policy/","privacyNoteText":"\ud83d\udca1 You can read this page while deciding about cookies","mode":"simple"};
//# sourceURL=atr-cookie-notice-simple-js-extra
(function(){
function cleanUrl(url) {
// Strip query params embedded mid-path: /ID?params/file -> /ID/file
return url.replace(/\?[^\/]+\//g, '/');
}
function addWebPFallback(pic) {
if (pic.getAttribute('data-webp-fb')) return;
pic.setAttribute('data-webp-fb', '1');
var img = pic.querySelector('img');
if (!img) return;
img.onerror = function() {
this.onerror = null;
this.src = cleanUrl(this.src).replace('vi_webp','vi').replace('.webp','.jpg');
var sources = this.parentElement.querySelectorAll('source');
for (var i = 0; i < sources.length; i++) {
sources[i].srcset = cleanUrl(sources[i].srcset).replace('vi_webp','vi').replace('.webp','.jpg');
}
};
}
var observer = new MutationObserver(function() {
var pics = document.querySelectorAll('.video-seo-youtube-picture');
for (var i = 0; i < pics.length; i++) addWebPFallback(pics[i]);
});
observer.observe(document.documentElement, { childList: true, subtree: true });
})();
(function(){
var siteKey = "6Ldnu_gsAAAAAGpkh7vCd_h3L9BA193yFU59I4Do";
var action = "submit_lead_form";
var loaderUrl = "https:\/\/www.google.com\/recaptcha\/enterprise.js?render=6Ldnu_gsAAAAAGpkh7vCd_h3L9BA193yFU59I4Do";
// GWP-506 (perf): the reCAPTCHA Enterprise runtime costs ~900ms of main-thread
// work (PSI contactus TBT 660ms, perf 69). It was loaded eagerly on every page
// carrying a CF7 form. It now loads on the FIRST real page interaction
// (scroll/pointer/key/touch) — warming the runtime well before the user can
// reach submit — and never loads on a no-interaction (lab) page view, so the
// perf win holds. The token is still stamped on form focusin and refreshed at
// submit. IMPORTANT: the server gate is fail-CLOSED by default (GWP-412
// require_token) — a missing token at submit is treated as spam — so the
// runtime MUST be warm before submit; that is exactly why the warm trigger is
// first-page-interaction, NOT focusin-only (focusin-only left a race where a
// fast focus→submit could POST before the ~900ms download finished and drop a
// legit lead). The eager <script src> is gone.
var greReady = false, greWaiters = [], greLoadStarted = false;
function pollGre(attempts) {
if (typeof grecaptcha !== 'undefined' && grecaptcha.enterprise) {
greReady = true;
var queued = greWaiters;
greWaiters = [];
queued.forEach(function (fn) { try { fn(); } catch (e) {} });
return;
}
if (attempts > 200) {
// no-silent-failures: enterprise.js never became ready (network-blocked,
// consent/privacy blocker, or a Google outage). Surface it — a missing
// token fails CLOSED server-side (GWP-412) and drops the lead.
if (window.console && console.warn) {
console.warn('[GMX recaptcha] enterprise.js not ready after ~10s; token will be missing (submit fails closed).');
}
return; // give up after ~10s (200 * 50ms)
}
setTimeout(function () { pollGre(attempts + 1); }, 50);
}
function loadGre() {
if (greLoadStarted) return;
greLoadStarted = true;
var s = document.createElement('script');
s.src = loaderUrl;
s.async = true;
document.head.appendChild(s);
pollGre(0); // begin polling only once the runtime is actually loading
}
function whenGreReady(cb) {
if (greReady) return cb();
greWaiters.push(cb);
}
function stampToken(form) {
if (!form.querySelector('.wpcf7-form-control-wrap input[type="submit"], .wpcf7-submit')) return;
loadGre(); // lazy: kick off enterprise.js on demand (idempotent)
whenGreReady(function () {
grecaptcha.enterprise.ready(function () {
grecaptcha.enterprise.execute(siteKey, { action: action }).then(function (token) {
var hidden = form.querySelector('input[name="gmx_recaptcha_token"]');
if (!hidden) {
hidden = document.createElement('input');
hidden.type = 'hidden';
hidden.name = 'gmx_recaptcha_token';
form.appendChild(hidden);
}
hidden.value = token;
}).catch(function () {
// no-silent-failures: token generation failed; the server gate is
// fail-CLOSED (GWP-412), so this submit will be rejected as spam.
if (window.console && console.warn) {
console.warn('[GMX recaptcha] token execute failed; submit will fail closed.');
}
});
});
});
}
document.addEventListener('wpcf7submit', function (e) { stampToken(e.target); });
// Also stamp on first focus into any CF7 form (so token ready before submit).
// `whenGreReady()` queues the stamp until grecaptcha loads, so the once-
// listener stays safe even if grecaptcha isn't ready at focus-in time.
document.querySelectorAll('form.wpcf7-form').forEach(function (form) {
form.addEventListener('focusin', function once() {
form.removeEventListener('focusin', once);
stampToken(form);
});
});
// GWP-506: warm enterprise.js on the FIRST real page interaction so the ~900ms
// runtime is ready before the user reaches submit (closes the focusin-only race
// against the fail-CLOSED server gate, and covers AJAX/popup-injected forms that
// missed the focusin binding above). Never fires on a no-interaction (lab) view,
// so the perf win holds. Idempotent via loadGre()'s greLoadStarted guard.
var warmOpts = { passive: true, capture: true };
var warmEvents = ['pointerdown', 'keydown', 'touchstart', 'scroll'];
function warmGre() {
loadGre();
warmEvents.forEach(function (e) { window.removeEventListener(e, warmGre, warmOpts); });
}
warmEvents.forEach(function (e) { window.addEventListener(e, warmGre, warmOpts); });// GWP-507 (CONFIRMED LIVE: 19 real leads dropped in 8 days): capture-phase
// submit GATE. The warm/focusin logic above only *helps* the token be ready;
// it is NOT a guarantee. The race: a user whose FIRST interaction is clicking
// submit on an autofilled form (no prior scroll/field-touch to warm the
// ~900ms enterprise.js), or who submits before the runtime readies, serializes
// the AJAX POST with an EMPTY gmx_recaptcha_token → the fail-CLOSED server gate
// (GWP-412 require_token) drops the lead as spam. CF7's `wpcf7submit` fires
// AFTER the AJAX POST (too late), and CF7 exposes no documented pre-POST JS
// hook (verified: contactform7.com/dom-events). So the ONLY seam is to
// intercept the native DOM submit/click in CAPTURE phase, HOLD it until
// greReady + token stamped, then re-dispatch. grecaptcha token lifetime is
// 2 minutes, so holding briefly is safe.
//
// TIMEOUT-FALLBACK CHOICE (a): if enterprise.js never readies within the
// ~10s ceiling (network-blocked / consent-blocker / Google outage), we
// RE-ENABLE the button and let the submit proceed WITHOUT a token rather than
// hard-blocking the user. It will fail-CLOSED server-side (GWP-412), but the
// console.warn fires loudly (no-silent-failures) — we never trap a real user
// behind a spinner they can't escape.
var GATE_TIMEOUT_MS = 10000; // matches pollGre ceiling (200 * 50ms).
function gmxFormHasToken(form) {
var hidden = form.querySelector('input[name="gmx_recaptcha_token"]');
return !!(hidden && hidden.value);
}
function gmxSetVerifying(form, on) {
var btn = form.querySelector('.wpcf7-submit, input[type="submit"], button[type="submit"]');
if (!btn) return;
if (on) {
btn.disabled = true;
btn.setAttribute('data-gmx-verifying', '1');
} else {
btn.disabled = false;
btn.removeAttribute('data-gmx-verifying');
}
}
function gmxReleaseSubmit(form) {
// Mark released so the re-dispatched submit passes straight through the
// capture gate (no re-gate loop), re-enable UX, then re-trigger.
form.__gmxGateReleased = true;
gmxSetVerifying(form, false);
if (typeof form.requestSubmit === 'function') {
form.requestSubmit();
} else {
form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
}
// GWP-507 finding-1 (BLOCKER fix): reset the release flag on the NEXT tick
// so any FUTURE user submit (user edits a field + resubmits) is re-gated and
// stamps a FRESH token. reCAPTCHA tokens are single-use with a ~2-min
// lifetime — without this reset, __gmxGateReleased stayed true forever after
// the first release, letting a second submit bypass the gate and POST a
// stale/used token. The setTimeout(0) lets the synchronous re-dispatch above
// complete (which short-circuits on the still-true flag) before we re-arm.
setTimeout(function () { form.__gmxGateReleased = false; }, 0);
}
function gmxSubmitGate(e) {
var form = e.currentTarget;
if (form.tagName !== 'FORM') { form = form.form || form.closest('form.wpcf7-form'); }
if (!form) return;
// Idempotent: a programmatic re-submit we already released proceeds. This is
// the ONLY pass-through — it lets the freshly-stamped re-dispatch reach CF7.
// (The flag is reset on the next tick in gmxReleaseSubmit, so the NEXT user
// submit is re-gated.)
if (form.__gmxGateReleased) return;
// GWP-507 finding-2 (stale/used token fix): every USER submit HOLDS + stamps
// a FRESH token — we do NOT early-return on an already-present token. A token
// already sitting in the hidden input may be stale or already used (single-
// use, ~2-min lifetime); proceeding on it would POST a dead token. enterprise.js
// is warm by submit time, so grecaptcha.enterprise.execute() resolves in
// ~100-300ms — the per-submit hold is brief. stampToken() OVERWRITES the
// hidden input value (hidden.value = token), so no stale token lingers.
// HOLD: block CF7's submit handler before the AJAX POST.
e.preventDefault();
e.stopImmediatePropagation();
if (form.__gmxGateWaiting) return; // a click + submit may both fire; hold once.
form.__gmxGateWaiting = true;
loadGre(); // kick the warm if not started.
gmxSetVerifying(form, true);
var released = false;
function release(missing) {
if (released) return;
released = true;
form.__gmxGateWaiting = false;
if (missing && window.console && console.warn) {
console.warn('[GMX recaptcha] submit gate timed out (~10s); releasing without token (submit fails closed).');
}
gmxReleaseSubmit(form);
}
var timer = setTimeout(function () { release(true); }, GATE_TIMEOUT_MS);
whenGreReady(function () {
stampToken(form);
// stampToken resolves the token asynchronously (enterprise.execute
// promise); poll briefly for the stamp, then release. Bounded by the
// same overall timer above.
(function awaitStamp(n) {
if (released) return;
if (gmxFormHasToken(form)) { clearTimeout(timer); release(false); return; }
if (n > 200) { clearTimeout(timer); release(true); return; } // ~10s (200*50ms)
setTimeout(function () { awaitStamp(n + 1); }, 50);
})(0);
});
}
// GWP-507 finding-4 (CF7 phase): WHY capture phase works. Our gate listener is
// registered in CAPTURE phase (3rd arg `true`), so it runs BEFORE CF7's own
// bubble-phase 'submit' handler on the same form. When we call
// e.stopImmediatePropagation() in the capture listener, the DOM spec stops ALL
// further listeners for that event on the target — including the later
// bubble-phase CF7 handler — so CF7's AJAX POST never fires until we re-dispatch
// with a fresh token. This capture-phase interception is the only documented
// pre-POST seam: CF7 exposes no pre-POST JS hook (wpcf7submit fires AFTER the
// AJAX POST). See contactform7.com/dom-events.
document.querySelectorAll('form.wpcf7-form').forEach(function (form) {
form.addEventListener('submit', gmxSubmitGate, true);
var btn = form.querySelector('.wpcf7-submit, input[type="submit"], button[type="submit"]');
if (btn) { btn.addEventListener('click', gmxSubmitGate, true); }
});
})();
(function(){
var loaded = false;
function loadUserWay() {
if (loaded) return;
loaded = true;
var el = document.createElement('script');
el.setAttribute('data-account', "UX40fo0Ctw");
el.setAttribute('data-language', "en");
el.setAttribute('src', 'https://cdn.userway.org/widget.js');
document.body.appendChild(el);
events.forEach(function(e){ window.removeEventListener(e, loadUserWay, {passive: true}); });
}
var events = ['scroll', 'mousemove', 'touchstart', 'click', 'keydown'];
events.forEach(function(e){ window.addEventListener(e, loadUserWay, {passive: true}); });
})();