From d5e3a1f4c0afbb8e7987e8116a60bbac6fab261e Mon Sep 17 00:00:00 2001
From: Daniel Schmitzer <noreply@maennchen1.de>
Date: Mon, 9 Sep 2019 12:12:40 +0000
Subject: - Nounce Bestellverwaltung / Produktgruppen / Produktverwaltung /
 Konfigurtion

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@7561 0d5edaf7-2b12-4e95-93f4-047927463d4b
---
 views/mailtemplates/adminmail.phtml         |  3 +-
 views/mailtemplates/html/adminmail.phtml    |  2 +-
 views/mods/mod_kundenverwaltung/index.phtml |  2 +
 views/mods/mod_productgroups/index.phtml    | 16 ++++++--
 views/order/backendEdit/addProduct.phtml    | 14 +++++--
 views/order/index.phtml                     | 26 ++++++++++---
 views/order/view.phtml                      |  1 +
 views/order/view_orderdata.phtml            | 38 +++++++++++++++----
 views/produkt/addedit.phtml                 |  2 +
 views/produkt/import.phtml                  |  2 +
 views/produkt/index.phtml                   | 59 +++++++++++++++++++++++------
 11 files changed, 132 insertions(+), 33 deletions(-)

(limited to 'views')

diff --git a/views/mailtemplates/adminmail.phtml b/views/mailtemplates/adminmail.phtml
index 361dfed..2c4e00e 100644
--- a/views/mailtemplates/adminmail.phtml
+++ b/views/mailtemplates/adminmail.phtml
@@ -70,8 +70,7 @@
 <?php echo wpsg_pad_right(__('Versandart', 'wpsg').':', 35); ?><?php echo $this->arShipping[$this->view['basket']['checkout']['shipping']]['name']; ?> 
 <?php echo wpsg_pad_right(__('Zahlungsart', 'wpsg').':', 35); ?><?php echo $this->arPayment[$this->view['basket']['checkout']['payment']]['name']; ?>  
 <?php $this->callMods('mail_payment'); ?>
-    
-<?php echo wpsg_pad_right(__('Bestellung', 'wpsg').':', 35); ?><?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Order&action=view&edit_id='.$this->view['o_id']; ?>    
+        
 <?php echo $this->render(WPSG_PATH_VIEW.'/mailtemplates/order.phtml'); ?>
 
 <?php if ($this->view['basket']['checkout']['comment'] != '') { ?>
diff --git a/views/mailtemplates/html/adminmail.phtml b/views/mailtemplates/html/adminmail.phtml
index c7dbf5f..ca04f8c 100644
--- a/views/mailtemplates/html/adminmail.phtml
+++ b/views/mailtemplates/html/adminmail.phtml
@@ -15,7 +15,7 @@
 
 <br />
 
-<h2><?php echo __('Warenkorb', 'wpsg'); ?> <a href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Order&action=view&edit_id='.$this->view['o_id']; ?>"><?php echo __('Bestellverwaltung', 'wpsg'); ?></a>:</h2>
+<h2><?php echo __('Warenkorb', 'wpsg'); ?>:</h2>
 
 <?php $this->render(WPSG_PATH_VIEW.'/mailtemplates/html/order.phtml'); ?> 
 
diff --git a/views/mods/mod_kundenverwaltung/index.phtml b/views/mods/mod_kundenverwaltung/index.phtml
index aa89735..afaf4a6 100644
--- a/views/mods/mod_kundenverwaltung/index.phtml
+++ b/views/mods/mod_kundenverwaltung/index.phtml
@@ -41,6 +41,8 @@
 				<div class="col-lg-4">
 					<form method="post" id="filter_form">
 
+						<?php echo wpsg_formNounce('Customer', 'search'); ?>
+						
 						<input id="wpsg_seite" type="hidden" name="filter[page]" value="<?php echo @$this->view['arFilter']['page']; ?>" class="current-page" />
 
                         <input id="wpsg_order" type="hidden" name="filter[order]" value="<?php echo @$this->view['arFilter']['order']; ?>" />
diff --git a/views/mods/mod_productgroups/index.phtml b/views/mods/mod_productgroups/index.phtml
index 6336955..09b7662 100644
--- a/views/mods/mod_productgroups/index.phtml
+++ b/views/mods/mod_productgroups/index.phtml
@@ -18,7 +18,11 @@
 				<ul class="nav navbar-nav">
 					<li role="presentation" class="wpsg-customer-tab-a active"><a href="#" onclick="return false;"><?php echo wpsg_translate(__("Produktgruppenverwaltung (#1# Produktgruppen)", "wpsg"), $this->view['countAll']); ?></a></li>
                     <li role="presentation" class="wpsg-customer-tab-a wpsg_showhide_filter" id="wpsg-customer-tab-0"><a href="#" onclick="return false;"><span class="glyphicon glyphicon-search"></span><?php echo __("Suche", "wpsg"); ?></a></li>
-                    <li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'add'))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=add"><span class="glyphicon glyphicon-plus"></span><?php echo __("Hinzufügen", "wpsg"); ?></a></li>
+                    <li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'add'))?'active':''); ?>"><a href="<?php 
+							
+						echo wpsg_admin_url('Productgroups', '', ['wpsg_mod_action' => 'add']);
+						
+					?>"><span class="glyphicon glyphicon-plus"></span><?php echo __("Hinzufügen", "wpsg"); ?></a></li>
 				</ul>
 				<ul class="nav navbar-nav navbar-right">
 				</ul>
@@ -30,6 +34,8 @@
                 <div class="col-lg-4">
                     <form method="post" id="filter_form">
 
+						<?php echo wp_nonce_field('wpsg-mod-productgroups-search'); ?>
+						
                         <input id="wpsg_seite" type="hidden" name="filter[page]" value="<?php echo @$this->view['page']; ?>" class="current-page" />
 
                         <input id="wpsg_order" type="hidden" name="filter[order]" value="<?php echo @$this->view['arFilter']['order']; ?>" />
@@ -85,11 +91,15 @@
                         <td class="col_name">
                             <strong><a title="<?php echo __("Diese Produktgruppe bearbeiten", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=edit&edit_id=<?php echo $pg->id; ?>" class="row-title"><?php echo $pg->name; ?></a></strong>
 					        <div class="row-actions">
-                                <span class="edit"><a title="<?php echo __("Diese Produktgruppe bearbeiten", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=edit&edit_id=<?php echo $pg->id; ?>"><?php echo __("Bearbeiten", "wpsg"); ?></a>
+                                <span class="edit"><a title="<?php echo __("Diese Produktgruppe bearbeiten", "wpsg"); ?>" href="<?php
+										
+									echo wpsg_admin_url('Productgroups', '', ['wpsg_mod_action' => 'edit', 'edit_id' => $pg->id]);
+										
+								?>"><?php echo __("Bearbeiten", "wpsg"); ?></a>
                                 |
                                 <span class="del"><a onclick="if (!confirm('<?php echo __("Sind Sie sich sicher?", "wpsg"); ?>')) return false;" title="<?php echo __("Diese Produktgruppe löschen", "wpsg"); ?>" href="<?php 
 										
-										echo \wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=del&noheader=1&edit_id='.$pg->id, 'wpsg-productgroup-del-'.$pg->id); 
+									echo wpsg_admin_url('Productgroups', '', ['wpsg_mod_action' => 'del', 'edit_id' => $pg->id], ['noheader' => '1']); 
 										
 								?>"><?php echo __("Löschen", "wpsg"); ?></a>
                                 <?php if ($pg->countProducts() > 0) { ?>
diff --git a/views/order/backendEdit/addProduct.phtml b/views/order/backendEdit/addProduct.phtml
index afd946b..3511e60 100644
--- a/views/order/backendEdit/addProduct.phtml
+++ b/views/order/backendEdit/addProduct.phtml
@@ -25,7 +25,7 @@
     </div>
     
 </form>
-
+ 
 <script>
     
     function wpsg_loadProduct(product_id, order_product_id) {
@@ -33,7 +33,11 @@
         jQuery('#wpsg_product_add_target').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
         
         jQuery.ajax( {
-            url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=addProduct&do=product&noheader=1&edit_id=<?php $_REQUEST['edit_id']; ?>',
+            url: '<?php
+	
+				echo wpsg_admin_url('Order', 'view', ['subaction' => 'addProduct', 'do' => 'product', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true);
+				
+			?>',
             data: {
                 product_id: product_id,
                 order_product_id: order_product_id
@@ -52,7 +56,11 @@
         jQuery('#wpsg_product_add_form').on('submit', function() { return false; } );
         
         jQuery('#product_search').autocomplete( {
-            source: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=addProduct&do=search&noheader=1&edit_id=<?php echo $_REQUEST['edit_id']; ?>',
+            source: '<?php 
+				
+				echo wpsg_admin_url('Order', 'view', ['subaction' => 'addProduct', 'do' => 'search', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true); 
+				
+			?>',
             minLength: 2,
             appendTo: ".autocomplete_wrap",
             select: function(event, ui) {
diff --git a/views/order/index.phtml b/views/order/index.phtml
index 0f6d6ee..267732c 100644
--- a/views/order/index.phtml
+++ b/views/order/index.phtml
@@ -38,6 +38,8 @@
 				<div class="col-lg-5">
 					<form method="post" id="filter_form" >
 
+						<?php echo wp_nonce_field('wpsg-order-search'); ?>
+						
 						<input id="wpsg_seite" type="hidden" name="seite" value="<?php echo @$this->view['arFilter']['page']; ?>" class="current-page" />
 						<input id="wpsg_order" type="hidden" name="filter[order]" value="<?php echo @$this->view['arFilter']['order']; ?>" />
 						<input id="wpsg_ascdesc" type="hidden" name="filter[ascdesc]" value="<?php echo @$this->view['arFilter']['ascdesc']; ?>" />
@@ -124,9 +126,9 @@
                     <div class="col-lg-4">
                         
                         <form method="POST" id="add_form" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&subaction=add&noheader=1">
-    
-                            <?php echo wp_nonce_field('order-index-add'); ?>
-                            
+	
+							<?php echo wp_nonce_field('wpsg-order-add'); ?>
+							                            
                             <br />
                             
                             <?php echo wpsg_drawForm_Input('search_customer',__('Kunde (E-Mail oder Kundennummer)', 'wpsg'), @$_REQUEST['search_customer']); ?>
@@ -250,11 +252,23 @@
                             <?php echo $oOrder->getNr(); ?> <span class="wpsg_grey"><?php echo wpsg_formatTimestamp(strtotime($oOrder->cdate), false); ?></span><br />
 
                             <div class="actions">
-                                <span class="view"><a title="<?php echo __("Diese Bestellung ansehen", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&edit_id=<?php echo $oOrder->id; ?>"><?php echo __("Ansehen", "wpsg"); ?></a></span>
+                                <span class="view"><a title="<?php echo __("Diese Bestellung ansehen", "wpsg"); ?>" href="<?php
+		
+									echo wpsg_admin_url('Order', 'view', ['edit_id' => $oOrder->getId()]);
+	
+								?>"><?php echo __("Ansehen", "wpsg"); ?></a></span>
                                 |
-                                <span class="storno"><a onclick="return confirm('<?php echo __('Sind Sie sich sicher, dass Sie diese Bestellung stornieren möchten?', 'wpsg'); ?>');" title="<?php echo __("Diese Bestellung stornieren", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=storno&noheader=1&edit_id=<?php echo $oOrder->id; ?>"><?php echo __("Stornieren", "wpsg"); ?></a></span>
+                                <span class="storno"><a onclick="return confirm('<?php echo __('Sind Sie sich sicher, dass Sie diese Bestellung stornieren möchten?', 'wpsg'); ?>');" title="<?php echo __("Diese Bestellung stornieren", "wpsg"); ?>" href="<?php 
+										
+									echo wpsg_admin_url('Order', 'storno', ['edit_id' => $oOrder->getId()], ['noheader' => '1']); 
+										
+								?>"><?php echo __("Stornieren", "wpsg"); ?></a></span>
                                 |
-                                <span class="delete"><a onclick="return confirm('<?php echo __('Sind Sie sich sicher, dass Sie diese Bestellung löschen möchten?', 'wpsg'); ?>');" title="<?php echo __('Diese Bestellung löschen', 'wpsg'); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=delete&noheader=1&edit_id=<?php echo $oOrder->id; ?>"><?php echo __('Löschen', 'wpsg'); ?></a></span>
+                                <span class="delete"><a onclick="return confirm('<?php echo __('Sind Sie sich sicher, dass Sie diese Bestellung löschen möchten?', 'wpsg'); ?>');" title="<?php echo __('Diese Bestellung löschen', 'wpsg'); ?>" href="<?php
+									
+									echo wpsg_admin_url('Order', 'delete', ['edit_id' => $oOrder->getId()], ['noheader' => '1']);
+									
+								?>"><?php echo __('Löschen', 'wpsg'); ?></a></span>
                             </div>
 
                             <?php if (trim($oOrder->admincomment) != "") { ?>
diff --git a/views/order/view.phtml b/views/order/view.phtml
index fd0670c..9888e6c 100644
--- a/views/order/view.phtml
+++ b/views/order/view.phtml
@@ -130,6 +130,7 @@
 	 */
 	function wpsg_sendMail(oid)
 	{
+		
 		jQuery('#wpsg_produkte_table').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 
 		jQuery.ajax( {
diff --git a/views/order/view_orderdata.phtml b/views/order/view_orderdata.phtml
index 5f63a8d..55bafd9 100644
--- a/views/order/view_orderdata.phtml
+++ b/views/order/view_orderdata.phtml
@@ -51,7 +51,11 @@
 				jQuery('#wpsg_shipping_dialog').modal( { } ).modal('show');
 								
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=editPayShipping&edit_id=<?php echo $_REQUEST['edit_id']; ?>&noheader=1',
+					url: '<?php 
+						
+						echo wpsg_admin_url('Order', 'view', ['subaction' => 'editPayShipping', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true);
+					
+					?>',
 					success: function(data) {
 	
 						jQuery('#wpsg_shipping_dialog .modal-body').html(data);
@@ -105,7 +109,11 @@
 				jQuery('#wpsg_product_dialog .btn-primary').prop('disabled', true);
 				
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=addProduct&edit_id=<?php echo $_REQUEST['edit_id']; ?>&noheader=1',
+					url: '<?php 
+						
+						echo wpsg_admin_url('Order', 'view', ['subaction' => 'addProduct', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true); 
+						
+					?>',
 					success: function(data) {
 		
 						jQuery('#wpsg_product_dialog .modal-body').html(data);
@@ -122,7 +130,11 @@
 				jQuery('#wpsg_product_table_wrap').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 				
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=removeProduct&noheader=1&edit_id=<?php echo $_REQUEST['edit_id']; ?>',
+					url: '<?php 
+						
+						echo wpsg_admin_url('Order', 'view', ['subaction' => 'removeProduct', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true);
+						
+					?>',
 					data: { 
 						order_product_id: order_product_id
 					},
@@ -144,7 +156,11 @@
 				jQuery('#wpsg_product_dialog .btn-primary').prop('disabled', true);
 	
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=addProduct&edit_id=<?php echo $_REQUEST['edit_id']; ?>&noheader=1',
+					url: '<?php
+					
+						echo wpsg_admin_url('Order', 'view', ['subaction' => 'addProduct', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true);
+					
+					?>',
 					data: {
 						order_product_id: order_product_id  
 					},
@@ -165,7 +181,11 @@
 				jQuery('#wpsg_product_table_wrap').html('<img src="<?php echo WPSG_URL; ?>views/gfx/ajax-loader.gif" alt="<?php echo __('Bitte warten ...', 'wpsg'); ?>" />');
 	
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=addProduct&do=submit&edit_id=<?php echo $_REQUEST['edit_id']; ?>&noheader=1',
+					url: '<?php 
+					
+						echo wpsg_admin_url('Order', 'view', ['edit_id' => $_REQUEST['edit_id'], 'do' => 'submit', 'subaction' => 'addProduct'], ['noheader' => '1'], true);
+						
+					?>',
 					data: jQuery('#wpsg_product_add_form').serialize(),
 					success: function(data) {
 	
@@ -178,7 +198,7 @@
 	
 			}
 		
-		}
+		};
 	
 		var WPSG_BE_Voucher = {
 			
@@ -301,7 +321,11 @@
 			sendCustomerMail: function(order_id) {
 
 				jQuery.ajax( {
-					url: '<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Order&action=view&subaction=sendMail&do=customer&edit_id=<?php echo $_REQUEST['edit_id']; ?>&noheader=1',
+					url: '<?php 
+						
+						echo wpsg_admin_url('Order', 'view', ['subaction' => 'sendMail', 'do' => 'customer', 'edit_id' => $_REQUEST['edit_id']], ['noheader' => '1'], true);				
+						
+					?>',
 					data: jQuery('#wpsg_be_discount_form').serialize(),
 					success: function(data) { alert(data); }
 				} );
diff --git a/views/produkt/addedit.phtml b/views/produkt/addedit.phtml
index 5ecbd68..a5ff076 100644
--- a/views/produkt/addedit.phtml
+++ b/views/produkt/addedit.phtml
@@ -32,6 +32,8 @@
 				
 	<form method="POST" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&action=save&noheader=1" enctype="multipart/form-data">
 	
+		<?php echo wp_nonce_field('wpsg-product-save-'.wpsg_getInt($_REQUEST['edit_id'])); ?>
+		
 		<div class="wpsg_admin_submenu">
 		 
 			<div class="list-group" id="wpsg_product_tabs">		
diff --git a/views/produkt/import.phtml b/views/produkt/import.phtml
index b90c55f..b6417a7 100644
--- a/views/produkt/import.phtml
+++ b/views/produkt/import.phtml
@@ -29,6 +29,8 @@
 					
 				<form method="POST" action="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&amp;action=import&noheader=1" id="import_form" enctype="multipart/form-data">
 				
+					<?php echo wp_nonce_field('wpsg-product-import-do'); ?>
+					
 					<div class="wpsg_hinweis"><?php echo __('Laden Sie ein vorher exportiertes CSV File hoch, die Produktdaten werden dann aus dieser Datei importiert.', 'wpsg'); ?></div>
 					<br />
 				
diff --git a/views/produkt/index.phtml b/views/produkt/index.phtml
index d4aa0c3..c66703c 100644
--- a/views/produkt/index.phtml
+++ b/views/produkt/index.phtml
@@ -18,10 +18,13 @@
 			</div>
 			<div class="collapse navbar-collapse" id="wpsg-bs-headermenu">
 				<ul class="nav navbar-nav">
-					<li role="presentation" class="<?php echo ((!isset($_REQUEST['action']))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt"><?php echo wpsg_translate(__("Produktübersicht (#1# Produkte)", "wpsg"), $this->view['countAll']); ?></a></li>
+					<li role="presentation" class="<?php echo ((!isset($_REQUEST['action']))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt'; ?>"><?php echo wpsg_translate(__("Produktübersicht (#1# Produkte)", "wpsg"), $this->view['countAll']); ?></a></li>
 					<li role="presentation" class="wpsg_showhide_filter <?php echo (($this->view['submit'] === true)?'active':''); ?>"><a href="#" onclick="return false;"><span class="glyphicon glyphicon-search"></span><?php echo __("Suche", "wpsg"); ?></a></li>
-			 		<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'add'))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&action=add"><span class="glyphicon glyphicon-plus"></span><?php echo __("Hinzufügen", "wpsg"); ?></a></li>
-                    
+			 		<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'add'))?'active':''); ?>"><a href="<?php
+							
+						echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=add', 'wpsg-product-add');
+							
+					?>"><span class="glyphicon glyphicon-plus"></span><?php echo __("Hinzufügen", "wpsg"); ?></a></li>                    
                     <?php /* Integration Exportprofile */ ?>
                     <?php if ($this->hasMod('wpsg_mod_export')) { $arProfile = $this->callMod('wpsg_mod_export', 'getProfile', array(wpsg_mod_export::TYPE_PRODUCT)); ?>
                     <?php if (wpsg_isSizedArray($arProfile)) { ?>
@@ -31,10 +34,22 @@
                     
 				</ul>
 				<ul class="nav navbar-nav navbar-right">
-					<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'import'))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&action=import"><span class="glyphicon glyphicon-import"></span><?php echo __("Daten-Import", "wpsg"); ?></a></li>
+					<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'import'))?'active':''); ?>"><a href="<?php 
+							 
+						echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=import', 'wpsg-product-import');
+							
+					?>"><span class="glyphicon glyphicon-import"></span><?php echo __("Daten-Import", "wpsg"); ?></a></li>
 					<?php if (wpsg_isSizedArray($this->view['arData'])) { ?>
-					<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'export'))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&action=export&noheader=1"><span class="glyphicon glyphicon-export"></span><?php echo __("Daten-Export", "wpsg"); ?></a></li>
-                    <li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'export'))?'active':''); ?>"><a href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&action=exportMedia&noheader=1"><span class="glyphicon glyphicon-export"></span><?php echo __("Daten-Export mit Medien", "wpsg"); ?></a></li>
+					<li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'export'))?'active':''); ?>"><a href="<?php 
+							
+						echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=export&noheader=1', 'wpsg-product-export'); 
+							
+					?>"><span class="glyphicon glyphicon-export"></span><?php echo __("Daten-Export", "wpsg"); ?></a></li>
+                    <li role="presentation" class="<?php echo ((wpsg_isSizedString($_REQUEST['action'], 'export'))?'active':''); ?>"><a href="<?php 
+							
+						echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=exportMedia&noheader=1', 'wpsg-product-exportMedia');
+						
+					?>"><span class="glyphicon glyphicon-export"></span><?php echo __("Daten-Export mit Medien", "wpsg"); ?></a></li>
                     <?php } ?>
 			 	</ul>
 			</div>
@@ -44,6 +59,8 @@
 			<div class="row">
 				<div class="col-lg-4">
 					<form method="post" id="filter_form">
+						
+						<?php echo wp_nonce_field('wpsg-product-search'); ?>
 
 						<input id="wpsg_seite" type="hidden" name="seite" value="<?php echo @$this->view['arFilter']['page']; ?>" class="current-page" />
 						<input id="wpsg_order" type="hidden" name="filter[order]" value="<?php echo @$this->view['arFilter']['order']; ?>" />
@@ -199,20 +216,40 @@
                                 <?php if ($this->isMultiLingual()) { ?>
                                 <?php foreach ($this->getStoreLanguages() as $l) { ?>
                                     <?php if ($l['locale'] != $this->getDefaultLanguageLocale()) { ?>
-                                    <a href="<?php echo $this->url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&amp;action=edit&amp;edit_id='.$d['id'].'&amp;wpsg_lang='.$l['lang']); ?>" title="<?php echo wpsg_translate(__('Produkt für Sprache #1# bearbeiten.', 'wpsg'), $l['name']); ?>">
+                                    <a href="<?php
+	
+										echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$d['id'].'&wpsg_lang='.$l['lang'], 'wpsg-product-edit-'.$d['id']);
+										
+									?>" title="<?php echo wpsg_translate(__('Produkt für Sprache #1# bearbeiten.', 'wpsg'), $l['name']); ?>">
                                         <img src="<?php echo $this->getFlagURL().$l['flag']; ?>" alt="<?php echo wpsg_translate(__('Produkt für Sprache #1# bearbeiten.', 'wpsg'), $l['name']); ?>" />
                                     </a>
                                     <?php } ?>
                                 <?php } ?>
                                 <?php } ?>
-                                <a title="<?php echo __("Dieses Produkt bearbeiten", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&amp;action=edit&amp;edit_id=<?php echo $d['id']; ?>" class="row-title"><?php echo (($d['name'] == "")?__("---- ", "wpsg"):$d['name']); ?></a>
+                                <a title="<?php echo __("Dieses Produkt bearbeiten", "wpsg"); ?>" href="<?php 
+									
+									echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$d['id'], 'wpsg-product-edit-'.$d['id']);									
+									
+								?>" class="row-title"><?php echo (($d['name'] == "")?__("---- ", "wpsg"):$d['name']); ?></a>
                             </strong>
                             <div class="row-actions">
-                                <span class="edit"><a title="<?php echo __("Dieses Produkt bearbeiten", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&amp;action=edit&amp;edit_id=<?php echo $d['id']; ?>"><?php echo __("Bearbeiten", "wpsg"); ?></a></span>
+                                <span class="edit"><a title="<?php echo __("Dieses Produkt bearbeiten", "wpsg"); ?>" href="<?php
+		
+									echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$d['id'], 'wpsg-product-edit-'.$d['id']);
+	
+								?>"><?php echo __("Bearbeiten", "wpsg"); ?></a></span>
                                 |
-                                <span class="del"><a onclick="if (!confirm('<?php echo __("Sind Sie sicher, dass Sie das Produkt löschen wollen?", "wpsg"); ?>')) return false;" title="<?php echo __("Dieses Produkt löschen", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&amp;action=del&amp;edit_id=<?php echo $d['id']; ?>&amp;noheader=1"><?php echo __("Löschen", "wpsg"); ?></a></span>
+                                <span class="del"><a onclick="if (!confirm('<?php echo __("Sind Sie sicher, dass Sie das Produkt löschen wollen?", "wpsg"); ?>')) return false;" title="<?php echo __("Dieses Produkt löschen", "wpsg"); ?>" href="<?php
+										
+									echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=del&edit_id='.$d['id'].'&noheader=1', 'wpsg-product-del-'.$d['id']);
+
+								?>"><?php echo __("Löschen", "wpsg"); ?></a></span>
                                 |
-                                <span class="copy"><a onclick="if (!confirm('<?php echo __("Sind Sie sicher, dass Sie das Produkt kopieren wollen?", "wpsg"); ?>')) return false;" title="<?php echo __("Dieses Produkt kopieren", "wpsg"); ?>" href="<?php echo WPSG_URL_WP; ?>wp-admin/admin.php?page=wpsg-Produkt&amp;action=copy&amp;edit_id=<?php echo $d['id']; ?>&amp;noheader=1"><?php echo __("Kopieren", "wpsg"); ?></a></span>
+                                <span class="copy"><a onclick="if (!confirm('<?php echo __("Sind Sie sicher, dass Sie das Produkt kopieren wollen?", "wpsg"); ?>')) return false;" title="<?php echo __("Dieses Produkt kopieren", "wpsg"); ?>" href="<?php
+		
+									echo wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=copy&edit_id='.$d['id'].'&noheader=1', 'wpsg-product-copy-'.$d['id']);
+										
+								?>"><?php echo __("Kopieren", "wpsg"); ?></a></span>
                                 |
                                 <span class="view"><a target="_blank" title="<?php echo __("Dieses Produkt im Frontend ansehen", "wpsg"); ?>" href="<?php echo $this->getProduktLink(array('id' => $d['id'])); ?>"><?php echo __("Ansehen", "wpsg"); ?></a></span>
                                 <?php $this->callMods('produkt_index_editmenu', array(&$d)); ?>
-- 
cgit v1.2.3