- Sync

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7558 0d5edaf7-2b12-4e95-93f4-047927463d4b

8 files changed, 48 insertions, 14 deletions

diff --git a/views/admin/access.phtml b/views/admin/access.phtml
index 3cdf383..9eaa323 100644
--- a/views/admin/access.phtml
+++ b/views/admin/access.phtml
@@ -19,7 +19,7 @@
 <div class="wpsg_admin_content form-horizontal">

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction='.$_REQUEST['subaction'].'&noheader=1'); ?>">

 		

-		<?php \wp_nonce_field('wpsg-save-admin-access'); ?>

+		<?php \wp_nonce_field('wpsg-admin-access'); ?>

 		

 		<?php global $wpdb; $arRoles = get_option($wpdb->prefix."user_roles"); ?>

 		

diff --git a/views/admin/dataprotection.phtml b/views/admin/dataprotection.phtml
index 233e2df..8c7d6cf 100644
--- a/views/admin/dataprotection.phtml
+++ b/views/admin/dataprotection.phtml
@@ -17,8 +17,10 @@
 </div>

 

 <div class="wpsg_admin_content form-horizontal">

-	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=<?php echo $_REQUEST['subaction']; ?>&amp;noheader=1">

+	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=<?php echo $_REQUEST['subaction']; ?>&noheader=1">

 	

+		<?php echo wp_nonce_field('wpsg-admin-dataprotection'); ?>

+		

 		<div class="panel panel-default">

   			<div class="panel-heading clearfix">

           		<h3 class="panel-title"><?php echo __('Datenschutzbeauftragter', 'wpsg'); ?></h3>

diff --git a/views/admin/includes.phtml b/views/admin/includes.phtml
index f28e64a..2a87ab5 100644
--- a/views/admin/includes.phtml
+++ b/views/admin/includes.phtml
@@ -19,6 +19,8 @@
 <div class="wpsg_admin_content form-horizontal">

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=includes&noheader=1'; ?>">

 

+		<?php echo wp_nonce_field('wpsg-admin-includes'); ?>

+		

 		<?php echo wpsg_drawForm_AdminboxStart(__('Bibliotheken/Includes', 'wpsg')); ?>

 

 			<?php echo wpsg_drawForm_Checkbox('wpsg_load_css', __('Shop CSS styles nicht einbinden', 'wpsg'), $this->get_option('wpsg_load_css'), array('help' => 'wpsg_load_css')); ?>

diff --git a/views/admin/kalkulation.phtml b/views/admin/kalkulation.phtml
index fc2e5e1..6b49cb2 100644
--- a/views/admin/kalkulation.phtml
+++ b/views/admin/kalkulation.phtml
@@ -18,7 +18,9 @@
 

 <div class="wpsg_admin_content form-horizontal">

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=<?php echo $_REQUEST['subaction']; ?>&amp;noheader=1">

-	

+		

+		<?php echo wp_nonce_field('wpsg-admin-kalkulation'); ?>

+		

 		<div class="panel panel-default">

   			<div class="panel-heading clearfix">

           		<h3 class="panel-title"><?php echo __('Preiskalkulation', 'wpsg'); ?></h3>

diff --git a/views/admin/konfiguration.phtml b/views/admin/konfiguration.phtml
index 259b644..8d4a527 100644
--- a/views/admin/konfiguration.phtml
+++ b/views/admin/konfiguration.phtml
@@ -32,14 +32,26 @@
 						<span style="color:red;"><?php echo __("Update", "wpsg"); ?>:</span>

 					</div>

 					<div class="wpsg_form_right">

-						<p><?php echo __("Die Version der Datenbank stimmt nicht mit der installierten Version überein!<br />Bitte klicken Sie auf ", "wpsg").'<a href="'.WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&amp;subaction=allgemein&amp;do=update&amp;submit=1&amp;noheader=1">'.__("Aktualisieren", "wpsg").'</a>&nbsp;('.__("Produkte etc. werden dabei nicht gelöscht.", "wpsg"); ?>)</p>				

+						

+						<p>

+							<?php echo wpsg_translate(

+								__('Die Version der Datenbank stimmt nicht mit der installierten Version überein!<br />Bitte klicken Sie auf <a href="#1#">Aktualisieren</a> Produkte etc. werden dabei nicht gelöscht.', 'wpsg'),

+								wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=allgemein&do=update&submit=1&noheader=1', 'wpsg-admin-db-update')							

+							); ?>

+						</p>

+						

 						<a rel="?page=wpsg-Admin&subaction=loadHelp&noheader=1&field=DBUpdate" href="?page=wpsg-Admin&subaction=loadHelp&noheader=1&field=DBUpdate" class="wpsg_glyphicon_right glyphicon glyphicon-question-sign"></a>

+						

 					</div>

 					<div class="wpsg_clear"></div>

 				</div>

 				<?php } else { ?>

 				<?php wpsg_drawForm_TextStart(); ?>		

-				<?php echo WPSG_VERSION; ?>&nbsp;<a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=allgemein&amp;do=update&amp;submit=1&amp;noheader=1"><?php echo __("Aktualisieren", "wpsg"); ?></a>

+				<?php echo WPSG_VERSION; ?>&nbsp;<a href="<?php 

+				

+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=allgemein&do=update&submit=1&noheader=1', 'wpsg-admin-db-update');

+					

+				?>"><?php echo __("Aktualisieren", "wpsg"); ?></a>

 				<?php echo wpsg_drawForm_TextEnd(__('Installierte DB Version', 'wpsg'), array('help' => 'DBUpdate')); ?>	

 				<?php } ?>

 				

diff --git a/views/admin/kundendaten.phtml b/views/admin/kundendaten.phtml
index d40b0c4..04d4e72 100644
--- a/views/admin/kundendaten.phtml
+++ b/views/admin/kundendaten.phtml
@@ -39,6 +39,8 @@
 

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=<?php echo $_REQUEST['subaction']; ?>&noheader=1">

 	

+		<?php echo wp_nonce_field('wpsg-admin-kundendaten'); ?>

+		

 		<div class="panel panel-default">

 			<div class="panel-heading clearfix">

 	       		<h3 class="panel-title"><?php echo __('Kundendaten', 'wpsg'); ?></h3>

@@ -77,7 +79,7 @@
 		

 	</form>

 	

-	<script type="text/javascript">/* <![CDATA[ */

+	<script>

 

 		/**

 		 * Fügt ein neues Feld in die Liste der Kundenvariablen ein und lädt die Liste neu

@@ -88,7 +90,7 @@
 			jQuery('#wpsg_kv_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');

 			

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1',

+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1', 'wpsg-admin-kundendaten-add')); ?>',

 				success: function(data) {

 					jQuery('#wpsg_kv_list').html(data);

 				}

@@ -109,7 +111,7 @@
 			jQuery('.wpsg_customervar_row_' + kv_index).hide(250, function() { jQuery(this).remove(); } );

 

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1',

+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1', 'wpsg-admin-kundendaten-delete')); ?>',

 				data: {

 					'kv_index': kv_index

 				},

@@ -132,10 +134,10 @@
 

 			jQuery('#wpsg_code_dialog .modal-body').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');

 			

-			jQuery('#wpsg_code_dialog').modal( { } )

+			jQuery('#wpsg_code_dialog').modal( { } );

 			

 			jQuery.ajax( {

-    			url: 'admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code',

+    			url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code', 'wpsg-admin-kundendaten-code')); ?>',

     			data: { 'kv_id': kv_index },

     			success: function(data) { jQuery('#wpsg_code_dialog .modal-body').html(data); }

         	} );

@@ -153,6 +155,6 @@
 			

 		} );

 	    

-	/* ]]> */</script>

+	</script>

 

 </div>
\ No newline at end of file
diff --git a/views/admin/seiten.phtml b/views/admin/seiten.phtml
index 72bda97..cb7bc23 100644
--- a/views/admin/seiten.phtml
+++ b/views/admin/seiten.phtml
@@ -19,6 +19,8 @@
 <div class="wpsg_admin_content form-horizontal">

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=seiten&noheader=1'); ?>">	

 

+		<?php wp_nonce_field('wpsg-admin-seiten'); ?>

+		

 		<?php echo wpsg_drawForm_AdminboxStart(__('Seitenkonfiguration', 'wpsg')); ?>

 			

 			<?php if ($this->hasMod('wpsg_mod_request') == '1') { ?>

diff --git a/views/admin/widerrufsbelehrung.phtml b/views/admin/widerrufsbelehrung.phtml
index b7765d4..ac1c355 100644
--- a/views/admin/widerrufsbelehrung.phtml
+++ b/views/admin/widerrufsbelehrung.phtml
@@ -31,8 +31,16 @@
 			<?php echo wpsg_drawForm_TextStart(); ?>

 			<?php if (wpsg_isSizedString($this->view['revocationform'])) { ?>

 			

-				<a target="_blank" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php/?page=wpsg-Admin&subaction=widerrufsbelehrung&download&noheader=1"><?php echo $this->view['revocationform']; ?></a>

-				<a onclick="if (!confirm('<?php echo __('Sind Sie sich sicher, dass Sie das Widerrufsformular löschen möchten?', 'wpsg'); ?>')) return false;" style="float:right;" href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=removeWiderrufsformular'; ?>"><?php echo __('Widerrufsformular löschen', 'wpsg'); ?></a>

+				<a target="_blank" href="<?php 

+					

+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php/?page=wpsg-Admin&subaction=widerrufsbelehrung&download&noheader=1', 'wpsg-admin-widerrufsbelehrung-download');

+

+				?>"><?php echo $this->view['revocationform']; ?></a>

+				<a onclick="if (!confirm('<?php echo __('Sind Sie sich sicher, dass Sie das Widerrufsformular löschen möchten?', 'wpsg'); ?>')) return false;" style="float:right;" href="<?php 

+					

+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=removeWiderrufsformular', 'wpsg-admin-widerrufsbelehrung-delete'); 

+					

+				?>"><?php echo __('Widerrufsformular löschen', 'wpsg'); ?></a>

 			

 			<?php } else { ?>

 			

@@ -41,7 +49,11 @@
 			<?php } ?>

 			

 			<br /><br />

-			<a href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=generateWiderrufsformular'; ?>" class="button"><?php echo __('Standardformular aus Shopinfo erstellen', 'wpsg'); ?></a>

+			<a href="<?php 

+				

+				echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=generateWiderrufsformular', 'wpsg-admin-widerrufsbelehrung-generate'); 

+				

+			?>" class="button"><?php echo __('Standardformular aus Shopinfo erstellen', 'wpsg'); ?></a>

 			<br /><br />

 			

 			<?php echo wpsg_drawForm_TextEnd(); ?>