- Adminbereich genounced

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7560 0d5edaf7-2b12-4e95-93f4-047927463d4b

7 files changed, 97 insertions, 32 deletions

diff --git a/views/admin/deinstall.phtml b/views/admin/deinstall.phtml
index 885e812..1000e58 100644
--- a/views/admin/deinstall.phtml
+++ b/views/admin/deinstall.phtml
@@ -22,6 +22,8 @@
 

 	<form name="form1" class="form-horizontal" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;noheader=1&amp;subaction=<?php echo $_REQUEST['subaction']; ?>">

 

+		<?php echo wp_nonce_field('wpsg-admin-deinstall'); ?>

+		

 		<p><?php echo __('Bitte wählen Sie aus, was Sie entfernen möchten?', 'wpsg'); ?></p>

 

 		<?php echo wpsg_drawForm_Checkbox('wpsg_deinstall_products', wpsg_translate(__('Produkte (#1# Datensätze)', 'wpsg'), (($this->view['count_products'] > 0)?$this->view['count_products']:0)), false, array('fullWidth' => true)); ?>

diff --git a/views/admin/emailconf.phtml b/views/admin/emailconf.phtml
index 97e0c3d..f9644a6 100644
--- a/views/admin/emailconf.phtml
+++ b/views/admin/emailconf.phtml
@@ -25,6 +25,8 @@
 <div class="wpsg_admin_content form-horizontal">

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=emailconf&noheader=1'); ?>">

 

+		<?php wp_nonce_field('wpsg-admin-emailconf'); ?>

+		

 		<?php echo wpsg_drawForm_AdminboxStart('Allgemeine Einstellungen', 'wpsg'); ?>

 		<?php $logoPath = wpsg_getUploadDir('wpsg_mailconf').'wpsg_email_logo.jpg'; ?>

 

diff --git a/views/admin/laender.phtml b/views/admin/laender.phtml
index 6c91a39..89e2d0c 100644
--- a/views/admin/laender.phtml
+++ b/views/admin/laender.phtml
@@ -37,6 +37,8 @@
 

 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&noheader=1'); ?>">

 

+		<?php echo wp_nonce_field('wpsg-admin-laender'); ?>

+		

 		<?php echo wpsg_drawForm_AdminboxStart(__('Länderverwaltung', 'wpsg')); ?>

 

 		<div id="wpsg_country_list">

@@ -63,13 +65,16 @@
 

 	    function wpsg_country_check_all() { jQuery('td.col_check input').each(function() { jQuery(this).prop('checked', !jQuery(this).prop('checked')); } ); }

 

-		function wpsg_country_remove(land_id)

-		{

+		function wpsg_country_remove(land_id) {

 

 			if (!confirm('<?php echo __('Sind Sie sich sicher?', 'wpsg'); ?>')) return false;

 

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=remove&noheader=1',

+				url: '<?php 

+					

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=remove&noheader=1', 'wpsg-laender-delete'));

+					

+				?>',

 				data: {

 					land_id: land_id

 				},

@@ -92,7 +97,11 @@
 			jQuery('#Modal_wpsg_country_edit').modal('show');

 

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=add&noheader=1',				

+				url: '<?php 

+					

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=add&noheader=1', 'wpsg-laender-add'));

+					

+				?>',				

 				success: function(data) { jQuery('#Modal_wpsg_country_edit .modal-body').html(data); }

 			} );

 			

@@ -100,15 +109,18 @@
 

 		} // function wpsg_country_add()

 

-        function wpsg_country_import()

-        {

+        function wpsg_country_import() {

 

             if (!confirm('<?php echo __('Sind Sie sich sicher?', 'wpsg'); ?>')) return false;

 

             jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');

 

             jQuery.ajax( {

-                url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=import&noheader=1',

+                url: '<?php 

+					

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=import&noheader=1', 'wpsg-laender-import'));

+					

+				?>',

                 success: function(data) {

 

                     jQuery('#wpsg_country_list').html(data);

@@ -128,7 +140,11 @@
             jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');

 

             jQuery.ajax( {

-                url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=eu_import&noheader=1',

+                url: '<?php 

+					

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=eu_import&noheader=1', 'wpsg-laender-eu_import'));

+					

+				?>',

                 success: function(data) {

 

                     jQuery('#wpsg_country_list').html(data);

@@ -146,7 +162,11 @@
 			jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');

 

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=save&noheader=1',

+				url: '<?php

+					 

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=save&noheader=1', 'wpsg-laender-save'));

+					

+				?>',

 				data: {

 					form_data: jQuery('#wpsg_land_edit_form_edit').serialize()

 				},

@@ -166,7 +186,14 @@
 			jQuery('#Modal_wpsg_country_edit').modal('show');

 

 			jQuery.ajax( {

-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=edit&noheader=1&land_id=' + land_id,

+				url: '<?php 

+					

+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=edit&noheader=1', 'wpsg-laender-edit'));

+					

+				?>',

+				data: {

+					land_id: land_id

+				},

 				success: function(data) { jQuery('#Modal_wpsg_country_edit .modal-body').html(data); }

 			} );

 

diff --git a/views/admin/laender_edit.phtml b/views/admin/laender_edit.phtml
index bc5e325..97e09b7 100644
--- a/views/admin/laender_edit.phtml
+++ b/views/admin/laender_edit.phtml
@@ -1,5 +1,5 @@
 <form id="wpsg_land_edit_form_edit" class="form-horizontal">

-

+ 

 	<?php if (wpsg_isSizedInt($this->view['land']['id'])) { ?>

 	<input type="hidden" name="id" value="<?php echo $this->view['land']['id']; ?>" />

 	<?php } ?>

diff --git a/views/admin/licence.phtml b/views/admin/licence.phtml
index cd30bce..351c3ff 100644
--- a/views/admin/licence.phtml
+++ b/views/admin/licence.phtml
@@ -74,6 +74,8 @@
                     

                         <form method="POST" action="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=saveRegister">

                             

+							<?php wp_nonce_field('wpsg-admin-licence-register'); ?>

+							

                             <?php $strLicenceLabel = ''; ?>

                             <?php if ($wpsg_update_data['licence_model'] === 'enterprise') { $strLicenceLabel = __('Enterprise', 'wpsg'); ?>

                             <?php } else if ($wpsg_update_data['licence_model'] === 'pro') { $strLicenceLabel = __('Pro', 'wpsg'); } ?>

@@ -120,7 +122,11 @@
                                         <td class="col_domain"><?php echo $domain; ?></td>

                                         <td class="col_action">

                                             

-                                            <a href="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainDeRegister" class="btn btn-warning btn-sm"><?php echo __('Registrierung aufheben'); ?></a>

+                                            <a href="<?php 

+												

+												echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainDeRegister', 'wpsg-admin-licence-domainDeRegister');

+												

+											?>" class="btn btn-warning btn-sm"><?php echo __('Registrierung aufheben'); ?></a>

                                             

                                         </td>

                                     </tr>

@@ -142,7 +148,11 @@
                             

                             <br />

                             

-                            <a href="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainRegister" class="btn btn-primary"><?php echo __('Diese Domain registrieren', 'wpsg'); ?></a>

+                            <a href="<?php

+								

+								echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainRegister', 'wpsg-admin-licence-domainRegister');

+								

+							?>" class="btn btn-primary"><?php echo __('Diese Domain registrieren', 'wpsg'); ?></a>

                                                     

                         <?php } else if (in_array($_SERVER['HTTP_HOST'], $wpsg_update_data['domainData'])) { ?>

                             

@@ -161,6 +171,8 @@
                         

                         <form method="POST" action="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=activatemodul&source=licence">

 						

+							<?php echo wp_nonce_field('wpsg-admin-licence-activatemodul'); ?>

+							

                             <fieldset>

                                 <legend style="padding-top:0px;"><?php echo __('Modulcode aktivieren', 'wpsg'); ?></legend>

                                                 

@@ -249,7 +261,7 @@
                                                 

                                                     echo '<br />';

                                                     echo wpsg_translate(__('<a href="#1#">Version installieren</a>.', 'wpsg'), WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=installModul&modul='.$modul_key.'&source=licence');

-                                                    

+                                                                                                        

                                                 }

                                                 

                                             }

diff --git a/views/admin/versandzonen.phtml b/views/admin/versandzonen.phtml
index f823780..809e98a 100644
--- a/views/admin/versandzonen.phtml
+++ b/views/admin/versandzonen.phtml
@@ -31,7 +31,7 @@
 	

 </div>

 

-<script type="text/javascript">/* <![CDATA[ */

+<script>

 

 	/**

 	 * Wird aufgerufen um einen neuen Satz hinzu zufügen und die Liste neu zu laden.

@@ -42,7 +42,11 @@
 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" /><br />');

 		

 		jQuery.ajax( {

-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=add&noheader=1',

+			url: '<?php 

+				

+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=add&noheader=1', 'wpsg-admin-versandzonen-add'));

+				

+			?>',

 			success: function(data) {

 				jQuery('#wpsg_vz_list').html(data);

 			}

@@ -63,7 +67,11 @@
 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" /><br />');

 		

 		jQuery.ajax( {

-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=remove&noheader=1',

+			url: '<?php 

+				

+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=remove&noheader=1', 'wpsg-admin-versandzonen-delete'));

+				

+			?>',

 			data: {

 				vz_id: vz_id

 			},

@@ -76,18 +84,21 @@
 		

 	} // function wpsg_removeVZ(vz_id)

 

-	function wpsg_editPLZ(vz_id)

-	{

+	function wpsg_editPLZ(vz_id) {

+		

 		jQuery('#vz_' + vz_id + '_plz').attr('style', 'display:display');

 

 		return false;

 	}

 

-	function wpsg_savePLZ(vz_id)

-	{

+	function wpsg_savePLZ(vz_id) {

 	

 		jQuery.ajax( {

-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=save_plz&noheader=1',

+			url: '<?php 

+				

+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=save_plz&noheader=1', 'wpsg-admin-versandzonen-save_plz'));

+				

+			?>',

 			data: {

 				vz_id: vz_id,

 				textarea: jQuery('#vz_' + vz_id + '_plz textarea').val()

@@ -101,15 +112,18 @@
 		

 	}

 

-	function wpsg_loadStandard()

-	{

+	function wpsg_loadStandard() {

 

 		if (!confirm('<?php echo __('Sind Sie sich sicher, dass sie die Standard Versandzonen und Länder laden möchten? Die alten Versandzonen und Länder gehen verloren.', 'wpsg'); ?>')) return false;

 		

 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');

 

 		jQuery.ajax( {

-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=loadStandard&noheader=1',

+			url: '<?php 

+				

+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=loadStandard&noheader=1', 'wpsg-admin-versandzonen-loadStandard'));

+			

+			?>',

 			success: function(data) {

 				jQuery('#wpsg_vz_list').html(data);

 			}

@@ -119,4 +133,4 @@
 		

 	} // function wpsg_loadStandard()

 	

-/* ]]> */</script>
\ No newline at end of file
+</script>
\ No newline at end of file
diff --git a/views/admin/versandzonen_list.phtml b/views/admin/versandzonen_list.phtml
index 61b8ddf..cd8352f 100644
--- a/views/admin/versandzonen_list.phtml
+++ b/views/admin/versandzonen_list.phtml
@@ -35,31 +35,39 @@
 			<a class="wpsg_icon_plzedit" href="#" title="<?php echo __('Versandzonen PLZ bearbeiten', 'wpsg'); ?>" onclick="return wpsg_editPLZ(<?php echo $vz['id']; ?>);">[ PLZ ]</a>

 			<a class="glyphicon glyphicon-trash" href="#" title="<?php echo __('Versandzone löschen', 'wpsg'); ?>" onclick="return wpsg_removeVZ(<?php echo $vz['id']; ?>);"></a>

 			

-			<script type="text/javascript">/* <![CDATA[ */

+			<script>

 

-				jQuery('#vz_<?php echo $vz['id']; ?>_name').wpsg_editable('<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', {

+				jQuery('#vz_<?php echo $vz['id']; ?>_name').wpsg_editable('<?php

+					

+						echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', 'wpsg-admin-versandzonen-inline_edit-'.$vz['id']));

+					

+					?>', {

 					submitdata: { 

 			    		field: 'name',

 			    		vz_id: '<?php echo $vz['id']; ?>'

 					}, 					

-					submit  : '<?php echo __('Speichern', 'wpsg'); ?>',

+					submit: '<?php echo __('Speichern', 'wpsg'); ?>',

 					placeholder: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>',

 					indicator: '<?php echo __('Speicher ...', 'wpsg'); ?>',

 			    	tooltip: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>'

 				});

 			

-				jQuery('#vz_<?php echo $vz['id']; ?>_value').wpsg_editable('<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', {

+				jQuery('#vz_<?php echo $vz['id']; ?>_value').wpsg_editable('<?php 

+					

+						echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', 'wpsg-admin-versandzonen-inline_edit-'.$vz['id'])); 

+										

+					?>', {

 					submitdata: { 

 			    		field: 'value',

 			    		vz_id: '<?php echo $vz['id']; ?>'

 					}, 					

-					submit  : '<?php echo __('Speichern', 'wpsg'); ?>',

+					submit: '<?php echo __('Speichern', 'wpsg'); ?>',

 					placeholder: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>',

 					indicator: '<?php echo __('Speicher ...', 'wpsg'); ?>',

 			    	tooltip: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>'

 				});

 

-				/* ]]> */</script>		

+				</script>		

 		</td>

 	</tr>

 	<?php } ?>