diff options
| author | Roger Rehnelt <noreply@maennchen1.de> | 2026-10-05 21:19:34 +0200 |
|---|---|---|
| committer | Roger Rehnelt <noreply@maennchen1.de> | 2026-10-05 21:19:34 +0200 |
| commit | 9ff6bcb3e267ed136a2dcfac6279342a83431429 (patch) | |
| tree | 7ff23d53b8fa2c1d41f828372e48ffa20e36ee09 | |
| parent | ca7620bbc817dd9ed1ef7e380e5158025066a286 (diff) | |
Statistik: Käuferliste nur mit Berechtigung
Anzeige und Export der Produktstatistik liefen über eine Frontend-Adresse ohne Prüfung; sie verlangen jetzt die Berechtigung der Produktverwaltung und eine Nonce.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| -rw-r--r-- | views/mods/mod_statistics/produkt_edit_sidebar.phtml | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/views/mods/mod_statistics/produkt_edit_sidebar.phtml b/views/mods/mod_statistics/produkt_edit_sidebar.phtml index b41d240..e7c7d7c 100644 --- a/views/mods/mod_statistics/produkt_edit_sidebar.phtml +++ b/views/mods/mod_statistics/produkt_edit_sidebar.phtml @@ -99,7 +99,8 @@ jQuery.ajax( {
url: '<?php echo $this->getUrl(wpsg_ShopController::URL_BASKET, 'wpsg_mod_statistics', 'aktualisieren'); ?>',
data: {
- 'edit_id': <?php echo $_REQUEST['edit_id']?>,
+ 'edit_id': <?php echo intval($_REQUEST['edit_id']); ?>,
+ 'wpsg_nonce': '<?php echo esc_js(wp_create_nonce('wpsg-mod-statistics')); ?>',
'von': jQuery('#st_von').val(),
'bis': jQuery('#st_bis').val(),
},
@@ -114,7 +115,8 @@ jQuery('#st_export').bind('click', function(){
location.href = '<?php echo $this->getUrl(wpsg_ShopController::URL_BASKET, 'wpsg_mod_statistics', 'export', array(
- 'edit_id' => $_REQUEST['edit_id']
+ 'edit_id' => intval($_REQUEST['edit_id']),
+ 'wpsg_nonce' => wp_create_nonce('wpsg-mod-statistics')
)); ?>&von=' + jQuery('#st_von').val() + '&bis=' + jQuery('#st_bis').val();
});
|