From d95166f8a52e3d47af276176cec99774a185d861 Mon Sep 17 00:00:00 2001
From: Daniel Schmitzer <noreply@maennchen1.de>
Date: Mon, 9 Sep 2019 06:05:07 +0000
Subject: - Sync

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7558 0d5edaf7-2b12-4e95-93f4-047927463d4b
---
 views/admin/access.phtml             |  2 +-
 views/admin/dataprotection.phtml     |  4 +++-
 views/admin/includes.phtml           |  2 ++
 views/admin/kalkulation.phtml        |  4 +++-
 views/admin/konfiguration.phtml      | 16 ++++++++++++++--
 views/admin/kundendaten.phtml        | 14 ++++++++------
 views/admin/seiten.phtml             |  2 ++
 views/admin/widerrufsbelehrung.phtml | 18 +++++++++++++++---
 8 files changed, 48 insertions(+), 14 deletions(-)

diff --git a/views/admin/access.phtml b/views/admin/access.phtml
index 3cdf383..9eaa323 100644
--- a/views/admin/access.phtml
+++ b/views/admin/access.phtml
@@ -19,7 +19,7 @@
 <div class="wpsg_admin_content form-horizontal">
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction='.$_REQUEST['subaction'].'&noheader=1'); ?>">
 		
-		<?php \wp_nonce_field('wpsg-save-admin-access'); ?>
+		<?php \wp_nonce_field('wpsg-admin-access'); ?>
 		
 		<?php global $wpdb; $arRoles = get_option($wpdb->prefix."user_roles"); ?>
 		
diff --git a/views/admin/dataprotection.phtml b/views/admin/dataprotection.phtml
index 233e2df..8c7d6cf 100644
--- a/views/admin/dataprotection.phtml
+++ b/views/admin/dataprotection.phtml
@@ -17,8 +17,10 @@
 </div>
 
 <div class="wpsg_admin_content form-horizontal">
-	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=<?php echo $_REQUEST['subaction']; ?>&amp;noheader=1">
+	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=<?php echo $_REQUEST['subaction']; ?>&noheader=1">
 	
+		<?php echo wp_nonce_field('wpsg-admin-dataprotection'); ?>
+		
 		<div class="panel panel-default">
   			<div class="panel-heading clearfix">
           		<h3 class="panel-title"><?php echo __('Datenschutzbeauftragter', 'wpsg'); ?></h3>
diff --git a/views/admin/includes.phtml b/views/admin/includes.phtml
index f28e64a..2a87ab5 100644
--- a/views/admin/includes.phtml
+++ b/views/admin/includes.phtml
@@ -19,6 +19,8 @@
 <div class="wpsg_admin_content form-horizontal">
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=includes&noheader=1'; ?>">
 
+		<?php echo wp_nonce_field('wpsg-admin-includes'); ?>
+		
 		<?php echo wpsg_drawForm_AdminboxStart(__('Bibliotheken/Includes', 'wpsg')); ?>
 
 			<?php echo wpsg_drawForm_Checkbox('wpsg_load_css', __('Shop CSS styles nicht einbinden', 'wpsg'), $this->get_option('wpsg_load_css'), array('help' => 'wpsg_load_css')); ?>
diff --git a/views/admin/kalkulation.phtml b/views/admin/kalkulation.phtml
index fc2e5e1..6b49cb2 100644
--- a/views/admin/kalkulation.phtml
+++ b/views/admin/kalkulation.phtml
@@ -18,7 +18,9 @@
 
 <div class="wpsg_admin_content form-horizontal">
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=<?php echo $_REQUEST['subaction']; ?>&amp;noheader=1">
-	
+		
+		<?php echo wp_nonce_field('wpsg-admin-kalkulation'); ?>
+		
 		<div class="panel panel-default">
   			<div class="panel-heading clearfix">
           		<h3 class="panel-title"><?php echo __('Preiskalkulation', 'wpsg'); ?></h3>
diff --git a/views/admin/konfiguration.phtml b/views/admin/konfiguration.phtml
index 259b644..8d4a527 100644
--- a/views/admin/konfiguration.phtml
+++ b/views/admin/konfiguration.phtml
@@ -32,14 +32,26 @@
 						<span style="color:red;"><?php echo __("Update", "wpsg"); ?>:</span>
 					</div>
 					<div class="wpsg_form_right">
-						<p><?php echo __("Die Version der Datenbank stimmt nicht mit der installierten Version überein!<br />Bitte klicken Sie auf ", "wpsg").'<a href="'.WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&amp;subaction=allgemein&amp;do=update&amp;submit=1&amp;noheader=1">'.__("Aktualisieren", "wpsg").'</a>&nbsp;('.__("Produkte etc. werden dabei nicht gelöscht.", "wpsg"); ?>)</p>				
+						
+						<p>
+							<?php echo wpsg_translate(
+								__('Die Version der Datenbank stimmt nicht mit der installierten Version überein!<br />Bitte klicken Sie auf <a href="#1#">Aktualisieren</a> Produkte etc. werden dabei nicht gelöscht.', 'wpsg'),
+								wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=allgemein&do=update&submit=1&noheader=1', 'wpsg-admin-db-update')							
+							); ?>
+						</p>
+						
 						<a rel="?page=wpsg-Admin&subaction=loadHelp&noheader=1&field=DBUpdate" href="?page=wpsg-Admin&subaction=loadHelp&noheader=1&field=DBUpdate" class="wpsg_glyphicon_right glyphicon glyphicon-question-sign"></a>
+						
 					</div>
 					<div class="wpsg_clear"></div>
 				</div>
 				<?php } else { ?>
 				<?php wpsg_drawForm_TextStart(); ?>		
-				<?php echo WPSG_VERSION; ?>&nbsp;<a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;subaction=allgemein&amp;do=update&amp;submit=1&amp;noheader=1"><?php echo __("Aktualisieren", "wpsg"); ?></a>
+				<?php echo WPSG_VERSION; ?>&nbsp;<a href="<?php 
+				
+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=allgemein&do=update&submit=1&noheader=1', 'wpsg-admin-db-update');
+					
+				?>"><?php echo __("Aktualisieren", "wpsg"); ?></a>
 				<?php echo wpsg_drawForm_TextEnd(__('Installierte DB Version', 'wpsg'), array('help' => 'DBUpdate')); ?>	
 				<?php } ?>
 				
diff --git a/views/admin/kundendaten.phtml b/views/admin/kundendaten.phtml
index d40b0c4..04d4e72 100644
--- a/views/admin/kundendaten.phtml
+++ b/views/admin/kundendaten.phtml
@@ -39,6 +39,8 @@
 
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=<?php echo $_REQUEST['subaction']; ?>&noheader=1">
 	
+		<?php echo wp_nonce_field('wpsg-admin-kundendaten'); ?>
+		
 		<div class="panel panel-default">
 			<div class="panel-heading clearfix">
 	       		<h3 class="panel-title"><?php echo __('Kundendaten', 'wpsg'); ?></h3>
@@ -77,7 +79,7 @@
 		
 	</form>
 	
-	<script type="text/javascript">/* <![CDATA[ */
+	<script>
 
 		/**
 		 * Fügt ein neues Feld in die Liste der Kundenvariablen ein und lädt die Liste neu
@@ -88,7 +90,7 @@
 			jQuery('#wpsg_kv_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 			
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1',
+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1', 'wpsg-admin-kundendaten-add')); ?>',
 				success: function(data) {
 					jQuery('#wpsg_kv_list').html(data);
 				}
@@ -109,7 +111,7 @@
 			jQuery('.wpsg_customervar_row_' + kv_index).hide(250, function() { jQuery(this).remove(); } );
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1',
+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1', 'wpsg-admin-kundendaten-delete')); ?>',
 				data: {
 					'kv_index': kv_index
 				},
@@ -132,10 +134,10 @@
 
 			jQuery('#wpsg_code_dialog .modal-body').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 			
-			jQuery('#wpsg_code_dialog').modal( { } )
+			jQuery('#wpsg_code_dialog').modal( { } );
 			
 			jQuery.ajax( {
-    			url: 'admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code',
+    			url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code', 'wpsg-admin-kundendaten-code')); ?>',
     			data: { 'kv_id': kv_index },
     			success: function(data) { jQuery('#wpsg_code_dialog .modal-body').html(data); }
         	} );
@@ -153,6 +155,6 @@
 			
 		} );
 	    
-	/* ]]> */</script>
+	</script>
 
 </div>
\ No newline at end of file
diff --git a/views/admin/seiten.phtml b/views/admin/seiten.phtml
index 72bda97..cb7bc23 100644
--- a/views/admin/seiten.phtml
+++ b/views/admin/seiten.phtml
@@ -19,6 +19,8 @@
 <div class="wpsg_admin_content form-horizontal">
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=seiten&noheader=1'); ?>">	
 
+		<?php wp_nonce_field('wpsg-admin-seiten'); ?>
+		
 		<?php echo wpsg_drawForm_AdminboxStart(__('Seitenkonfiguration', 'wpsg')); ?>
 			
 			<?php if ($this->hasMod('wpsg_mod_request') == '1') { ?>
diff --git a/views/admin/widerrufsbelehrung.phtml b/views/admin/widerrufsbelehrung.phtml
index b7765d4..ac1c355 100644
--- a/views/admin/widerrufsbelehrung.phtml
+++ b/views/admin/widerrufsbelehrung.phtml
@@ -31,8 +31,16 @@
 			<?php echo wpsg_drawForm_TextStart(); ?>
 			<?php if (wpsg_isSizedString($this->view['revocationform'])) { ?>
 			
-				<a target="_blank" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php/?page=wpsg-Admin&subaction=widerrufsbelehrung&download&noheader=1"><?php echo $this->view['revocationform']; ?></a>
-				<a onclick="if (!confirm('<?php echo __('Sind Sie sich sicher, dass Sie das Widerrufsformular löschen möchten?', 'wpsg'); ?>')) return false;" style="float:right;" href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=removeWiderrufsformular'; ?>"><?php echo __('Widerrufsformular löschen', 'wpsg'); ?></a>
+				<a target="_blank" href="<?php 
+					
+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php/?page=wpsg-Admin&subaction=widerrufsbelehrung&download&noheader=1', 'wpsg-admin-widerrufsbelehrung-download');
+
+				?>"><?php echo $this->view['revocationform']; ?></a>
+				<a onclick="if (!confirm('<?php echo __('Sind Sie sich sicher, dass Sie das Widerrufsformular löschen möchten?', 'wpsg'); ?>')) return false;" style="float:right;" href="<?php 
+					
+					echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=removeWiderrufsformular', 'wpsg-admin-widerrufsbelehrung-delete'); 
+					
+				?>"><?php echo __('Widerrufsformular löschen', 'wpsg'); ?></a>
 			
 			<?php } else { ?>
 			
@@ -41,7 +49,11 @@
 			<?php } ?>
 			
 			<br /><br />
-			<a href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=generateWiderrufsformular'; ?>" class="button"><?php echo __('Standardformular aus Shopinfo erstellen', 'wpsg'); ?></a>
+			<a href="<?php 
+				
+				echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=widerrufsbelehrung&noheader=1&do=generateWiderrufsformular', 'wpsg-admin-widerrufsbelehrung-generate'); 
+				
+			?>" class="button"><?php echo __('Standardformular aus Shopinfo erstellen', 'wpsg'); ?></a>
 			<br /><br />
 			
 			<?php echo wpsg_drawForm_TextEnd(); ?>
-- 
cgit v1.2.3