From d95166f8a52e3d47af276176cec99774a185d861 Mon Sep 17 00:00:00 2001
From: Daniel Schmitzer <noreply@maennchen1.de>
Date: Mon, 9 Sep 2019 06:05:07 +0000
Subject: - Sync

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7558 0d5edaf7-2b12-4e95-93f4-047927463d4b
---
 views/admin/kundendaten.phtml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'views/admin/kundendaten.phtml')

diff --git a/views/admin/kundendaten.phtml b/views/admin/kundendaten.phtml
index d40b0c4..04d4e72 100644
--- a/views/admin/kundendaten.phtml
+++ b/views/admin/kundendaten.phtml
@@ -39,6 +39,8 @@
 
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=<?php echo $_REQUEST['subaction']; ?>&noheader=1">
 	
+		<?php echo wp_nonce_field('wpsg-admin-kundendaten'); ?>
+		
 		<div class="panel panel-default">
 			<div class="panel-heading clearfix">
 	       		<h3 class="panel-title"><?php echo __('Kundendaten', 'wpsg'); ?></h3>
@@ -77,7 +79,7 @@
 		
 	</form>
 	
-	<script type="text/javascript">/* <![CDATA[ */
+	<script>
 
 		/**
 		 * Fügt ein neues Feld in die Liste der Kundenvariablen ein und lädt die Liste neu
@@ -88,7 +90,7 @@
 			jQuery('#wpsg_kv_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 			
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1',
+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=add&noheader=1', 'wpsg-admin-kundendaten-add')); ?>',
 				success: function(data) {
 					jQuery('#wpsg_kv_list').html(data);
 				}
@@ -109,7 +111,7 @@
 			jQuery('.wpsg_customervar_row_' + kv_index).hide(250, function() { jQuery(this).remove(); } );
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1',
+				url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&do=remove&noheader=1', 'wpsg-admin-kundendaten-delete')); ?>',
 				data: {
 					'kv_index': kv_index
 				},
@@ -132,10 +134,10 @@
 
 			jQuery('#wpsg_code_dialog .modal-body').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 			
-			jQuery('#wpsg_code_dialog').modal( { } )
+			jQuery('#wpsg_code_dialog').modal( { } );
 			
 			jQuery.ajax( {
-    			url: 'admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code',
+    			url: '<?php echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=kundendaten&noheader=1&show=code', 'wpsg-admin-kundendaten-code')); ?>',
     			data: { 'kv_id': kv_index },
     			success: function(data) { jQuery('#wpsg_code_dialog .modal-body').html(data); }
         	} );
@@ -153,6 +155,6 @@
 			
 		} );
 	    
-	/* ]]> */</script>
+	</script>
 
 </div>
\ No newline at end of file
-- 
cgit v1.2.3