From 323568cb1a4d1acad9cbf381d0172ce114dabdaf Mon Sep 17 00:00:00 2001
From: Daniel Schmitzer <noreply@maennchen1.de>
Date: Mon, 9 Sep 2019 08:35:33 +0000
Subject: - Adminbereich genounced

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7560 0d5edaf7-2b12-4e95-93f4-047927463d4b
---
 views/admin/deinstall.phtml         |  2 ++
 views/admin/emailconf.phtml         |  2 ++
 views/admin/laender.phtml           | 47 +++++++++++++++++++++++++++++--------
 views/admin/laender_edit.phtml      |  2 +-
 views/admin/licence.phtml           | 18 +++++++++++---
 views/admin/versandzonen.phtml      | 38 ++++++++++++++++++++----------
 views/admin/versandzonen_list.phtml | 20 +++++++++++-----
 7 files changed, 97 insertions(+), 32 deletions(-)

(limited to 'views/admin')

diff --git a/views/admin/deinstall.phtml b/views/admin/deinstall.phtml
index 885e812..1000e58 100644
--- a/views/admin/deinstall.phtml
+++ b/views/admin/deinstall.phtml
@@ -22,6 +22,8 @@
 
 	<form name="form1" class="form-horizontal" method="post" enctype="multipart/form-data" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&amp;noheader=1&amp;subaction=<?php echo $_REQUEST['subaction']; ?>">
 
+		<?php echo wp_nonce_field('wpsg-admin-deinstall'); ?>
+		
 		<p><?php echo __('Bitte wählen Sie aus, was Sie entfernen möchten?', 'wpsg'); ?></p>
 
 		<?php echo wpsg_drawForm_Checkbox('wpsg_deinstall_products', wpsg_translate(__('Produkte (#1# Datensätze)', 'wpsg'), (($this->view['count_products'] > 0)?$this->view['count_products']:0)), false, array('fullWidth' => true)); ?>
diff --git a/views/admin/emailconf.phtml b/views/admin/emailconf.phtml
index 97e0c3d..f9644a6 100644
--- a/views/admin/emailconf.phtml
+++ b/views/admin/emailconf.phtml
@@ -25,6 +25,8 @@
 <div class="wpsg_admin_content form-horizontal">
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=emailconf&noheader=1'); ?>">
 
+		<?php wp_nonce_field('wpsg-admin-emailconf'); ?>
+		
 		<?php echo wpsg_drawForm_AdminboxStart('Allgemeine Einstellungen', 'wpsg'); ?>
 		<?php $logoPath = wpsg_getUploadDir('wpsg_mailconf').'wpsg_email_logo.jpg'; ?>
 
diff --git a/views/admin/laender.phtml b/views/admin/laender.phtml
index 6c91a39..89e2d0c 100644
--- a/views/admin/laender.phtml
+++ b/views/admin/laender.phtml
@@ -37,6 +37,8 @@
 
 	<form name="form1" method="post" enctype="multipart/form-data" action="<?php echo wpsg_hspc(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&noheader=1'); ?>">
 
+		<?php echo wp_nonce_field('wpsg-admin-laender'); ?>
+		
 		<?php echo wpsg_drawForm_AdminboxStart(__('Länderverwaltung', 'wpsg')); ?>
 
 		<div id="wpsg_country_list">
@@ -63,13 +65,16 @@
 
 	    function wpsg_country_check_all() { jQuery('td.col_check input').each(function() { jQuery(this).prop('checked', !jQuery(this).prop('checked')); } ); }
 
-		function wpsg_country_remove(land_id)
-		{
+		function wpsg_country_remove(land_id) {
 
 			if (!confirm('<?php echo __('Sind Sie sich sicher?', 'wpsg'); ?>')) return false;
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=remove&noheader=1',
+				url: '<?php 
+					
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=remove&noheader=1', 'wpsg-laender-delete'));
+					
+				?>',
 				data: {
 					land_id: land_id
 				},
@@ -92,7 +97,11 @@
 			jQuery('#Modal_wpsg_country_edit').modal('show');
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=add&noheader=1',				
+				url: '<?php 
+					
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=add&noheader=1', 'wpsg-laender-add'));
+					
+				?>',				
 				success: function(data) { jQuery('#Modal_wpsg_country_edit .modal-body').html(data); }
 			} );
 			
@@ -100,15 +109,18 @@
 
 		} // function wpsg_country_add()
 
-        function wpsg_country_import()
-        {
+        function wpsg_country_import() {
 
             if (!confirm('<?php echo __('Sind Sie sich sicher?', 'wpsg'); ?>')) return false;
 
             jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');
 
             jQuery.ajax( {
-                url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=import&noheader=1',
+                url: '<?php 
+					
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=import&noheader=1', 'wpsg-laender-import'));
+					
+				?>',
                 success: function(data) {
 
                     jQuery('#wpsg_country_list').html(data);
@@ -128,7 +140,11 @@
             jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');
 
             jQuery.ajax( {
-                url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=eu_import&noheader=1',
+                url: '<?php 
+					
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=eu_import&noheader=1', 'wpsg-laender-eu_import'));
+					
+				?>',
                 success: function(data) {
 
                     jQuery('#wpsg_country_list').html(data);
@@ -146,7 +162,11 @@
 			jQuery('#wpsg_country_list').html('<img src="<?php echo $this->getRessourceURL('gfx/ajax-loader.gif'); ?>" alt="" />');
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=save&noheader=1',
+				url: '<?php
+					 
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=save&noheader=1', 'wpsg-laender-save'));
+					
+				?>',
 				data: {
 					form_data: jQuery('#wpsg_land_edit_form_edit').serialize()
 				},
@@ -166,7 +186,14 @@
 			jQuery('#Modal_wpsg_country_edit').modal('show');
 
 			jQuery.ajax( {
-				url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=edit&noheader=1&land_id=' + land_id,
+				url: '<?php 
+					
+					echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=laender&do=edit&noheader=1', 'wpsg-laender-edit'));
+					
+				?>',
+				data: {
+					land_id: land_id
+				},
 				success: function(data) { jQuery('#Modal_wpsg_country_edit .modal-body').html(data); }
 			} );
 
diff --git a/views/admin/laender_edit.phtml b/views/admin/laender_edit.phtml
index bc5e325..97e09b7 100644
--- a/views/admin/laender_edit.phtml
+++ b/views/admin/laender_edit.phtml
@@ -1,5 +1,5 @@
 <form id="wpsg_land_edit_form_edit" class="form-horizontal">
-
+ 
 	<?php if (wpsg_isSizedInt($this->view['land']['id'])) { ?>
 	<input type="hidden" name="id" value="<?php echo $this->view['land']['id']; ?>" />
 	<?php } ?>
diff --git a/views/admin/licence.phtml b/views/admin/licence.phtml
index cd30bce..351c3ff 100644
--- a/views/admin/licence.phtml
+++ b/views/admin/licence.phtml
@@ -74,6 +74,8 @@
                     
                         <form method="POST" action="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=saveRegister">
                             
+							<?php wp_nonce_field('wpsg-admin-licence-register'); ?>
+							
                             <?php $strLicenceLabel = ''; ?>
                             <?php if ($wpsg_update_data['licence_model'] === 'enterprise') { $strLicenceLabel = __('Enterprise', 'wpsg'); ?>
                             <?php } else if ($wpsg_update_data['licence_model'] === 'pro') { $strLicenceLabel = __('Pro', 'wpsg'); } ?>
@@ -120,7 +122,11 @@
                                         <td class="col_domain"><?php echo $domain; ?></td>
                                         <td class="col_action">
                                             
-                                            <a href="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainDeRegister" class="btn btn-warning btn-sm"><?php echo __('Registrierung aufheben'); ?></a>
+                                            <a href="<?php 
+												
+												echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainDeRegister', 'wpsg-admin-licence-domainDeRegister');
+												
+											?>" class="btn btn-warning btn-sm"><?php echo __('Registrierung aufheben'); ?></a>
                                             
                                         </td>
                                     </tr>
@@ -142,7 +148,11 @@
                             
                             <br />
                             
-                            <a href="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainRegister" class="btn btn-primary"><?php echo __('Diese Domain registrieren', 'wpsg'); ?></a>
+                            <a href="<?php
+								
+								echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=domainRegister', 'wpsg-admin-licence-domainRegister');
+								
+							?>" class="btn btn-primary"><?php echo __('Diese Domain registrieren', 'wpsg'); ?></a>
                                                     
                         <?php } else if (in_array($_SERVER['HTTP_HOST'], $wpsg_update_data['domainData'])) { ?>
                             
@@ -161,6 +171,8 @@
                         
                         <form method="POST" action="<?php echo WPSG_URL_WP ?>wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=activatemodul&source=licence">
 						
+							<?php echo wp_nonce_field('wpsg-admin-licence-activatemodul'); ?>
+							
                             <fieldset>
                                 <legend style="padding-top:0px;"><?php echo __('Modulcode aktivieren', 'wpsg'); ?></legend>
                                                 
@@ -249,7 +261,7 @@
                                                 
                                                     echo '<br />';
                                                     echo wpsg_translate(__('<a href="#1#">Version installieren</a>.', 'wpsg'), WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&action=registrierung&noheader=1&do=installModul&modul='.$modul_key.'&source=licence');
-                                                    
+                                                                                                        
                                                 }
                                                 
                                             }
diff --git a/views/admin/versandzonen.phtml b/views/admin/versandzonen.phtml
index f823780..809e98a 100644
--- a/views/admin/versandzonen.phtml
+++ b/views/admin/versandzonen.phtml
@@ -31,7 +31,7 @@
 	
 </div>
 
-<script type="text/javascript">/* <![CDATA[ */
+<script>
 
 	/**
 	 * Wird aufgerufen um einen neuen Satz hinzu zufügen und die Liste neu zu laden.
@@ -42,7 +42,11 @@
 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" /><br />');
 		
 		jQuery.ajax( {
-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=add&noheader=1',
+			url: '<?php 
+				
+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=add&noheader=1', 'wpsg-admin-versandzonen-add'));
+				
+			?>',
 			success: function(data) {
 				jQuery('#wpsg_vz_list').html(data);
 			}
@@ -63,7 +67,11 @@
 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" /><br />');
 		
 		jQuery.ajax( {
-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=remove&noheader=1',
+			url: '<?php 
+				
+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=remove&noheader=1', 'wpsg-admin-versandzonen-delete'));
+				
+			?>',
 			data: {
 				vz_id: vz_id
 			},
@@ -76,18 +84,21 @@
 		
 	} // function wpsg_removeVZ(vz_id)
 
-	function wpsg_editPLZ(vz_id)
-	{
+	function wpsg_editPLZ(vz_id) {
+		
 		jQuery('#vz_' + vz_id + '_plz').attr('style', 'display:display');
 
 		return false;
 	}
 
-	function wpsg_savePLZ(vz_id)
-	{
+	function wpsg_savePLZ(vz_id) {
 	
 		jQuery.ajax( {
-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=save_plz&noheader=1',
+			url: '<?php 
+				
+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=save_plz&noheader=1', 'wpsg-admin-versandzonen-save_plz'));
+				
+			?>',
 			data: {
 				vz_id: vz_id,
 				textarea: jQuery('#vz_' + vz_id + '_plz textarea').val()
@@ -101,15 +112,18 @@
 		
 	}
 
-	function wpsg_loadStandard()
-	{
+	function wpsg_loadStandard() {
 
 		if (!confirm('<?php echo __('Sind Sie sich sicher, dass sie die Standard Versandzonen und Länder laden möchten? Die alten Versandzonen und Länder gehen verloren.', 'wpsg'); ?>')) return false;
 		
 		jQuery('#wpsg_vz_list').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 
 		jQuery.ajax( {
-			url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=loadStandard&noheader=1',
+			url: '<?php 
+				
+				echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=loadStandard&noheader=1', 'wpsg-admin-versandzonen-loadStandard'));
+			
+			?>',
 			success: function(data) {
 				jQuery('#wpsg_vz_list').html(data);
 			}
@@ -119,4 +133,4 @@
 		
 	} // function wpsg_loadStandard()
 	
-/* ]]> */</script>
\ No newline at end of file
+</script>
\ No newline at end of file
diff --git a/views/admin/versandzonen_list.phtml b/views/admin/versandzonen_list.phtml
index 61b8ddf..cd8352f 100644
--- a/views/admin/versandzonen_list.phtml
+++ b/views/admin/versandzonen_list.phtml
@@ -35,31 +35,39 @@
 			<a class="wpsg_icon_plzedit" href="#" title="<?php echo __('Versandzonen PLZ bearbeiten', 'wpsg'); ?>" onclick="return wpsg_editPLZ(<?php echo $vz['id']; ?>);">[ PLZ ]</a>
 			<a class="glyphicon glyphicon-trash" href="#" title="<?php echo __('Versandzone löschen', 'wpsg'); ?>" onclick="return wpsg_removeVZ(<?php echo $vz['id']; ?>);"></a>
 			
-			<script type="text/javascript">/* <![CDATA[ */
+			<script>
 
-				jQuery('#vz_<?php echo $vz['id']; ?>_name').wpsg_editable('<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', {
+				jQuery('#vz_<?php echo $vz['id']; ?>_name').wpsg_editable('<?php
+					
+						echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', 'wpsg-admin-versandzonen-inline_edit-'.$vz['id']));
+					
+					?>', {
 					submitdata: { 
 			    		field: 'name',
 			    		vz_id: '<?php echo $vz['id']; ?>'
 					}, 					
-					submit  : '<?php echo __('Speichern', 'wpsg'); ?>',
+					submit: '<?php echo __('Speichern', 'wpsg'); ?>',
 					placeholder: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>',
 					indicator: '<?php echo __('Speicher ...', 'wpsg'); ?>',
 			    	tooltip: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>'
 				});
 			
-				jQuery('#vz_<?php echo $vz['id']; ?>_value').wpsg_editable('<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', {
+				jQuery('#vz_<?php echo $vz['id']; ?>_value').wpsg_editable('<?php 
+					
+						echo html_entity_decode(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=vz&do=inlinedit&noheader=1', 'wpsg-admin-versandzonen-inline_edit-'.$vz['id'])); 
+										
+					?>', {
 					submitdata: { 
 			    		field: 'value',
 			    		vz_id: '<?php echo $vz['id']; ?>'
 					}, 					
-					submit  : '<?php echo __('Speichern', 'wpsg'); ?>',
+					submit: '<?php echo __('Speichern', 'wpsg'); ?>',
 					placeholder: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>',
 					indicator: '<?php echo __('Speicher ...', 'wpsg'); ?>',
 			    	tooltip: '<?php echo __('Zum Bearbeiten anklicken ...', 'wpsg'); ?>'
 				});
 
-				/* ]]> */</script>		
+				</script>		
 		</td>
 	</tr>
 	<?php } ?>
-- 
cgit v1.2.3