Index: /controller/wpsg_AdminController.class.php =================================================================== --- /controller/wpsg_AdminController.class.php (revision 7557) +++ /controller/wpsg_AdminController.class.php (revision 7558) @@ -1499,5 +1499,5 @@ public function kundendatenAction() { - + $this->shop->view['pflicht'] = $this->get_option('wpsg_admin_pflicht'); @@ -1518,4 +1518,6 @@ { + check_admin_referer('wpsg-admin-kundendaten-code'); + $this->shop->view['id'] = $_REQUEST['kv_id']; $this->shop->view['field'] = $this->shop->view['pflicht']['custom'][$_REQUEST['kv_id']]; @@ -1525,7 +1527,8 @@ } - if (isset($_REQUEST['submit'])) - { + if (isset($_REQUEST['submit'])) { + check_admin_referer('wpsg-admin-kundendaten'); + $this->shop->update_option('wpsg_customerpreset_shipping', $_REQUEST['wpsg_customerpreset_shipping'], false, false, WPSG_SANITIZE_VALUES, array_keys($this->shop->arShipping)); $this->shop->update_option('wpsg_customerpreset_payment', $_REQUEST['wpsg_customerpreset_payment'], false, false, array_keys($this->shop->arPayment)); @@ -1593,7 +1596,8 @@ } - if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'add') - { - + if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'add') { + + check_admin_referer('wpsg-admin-kundendaten-add'); + if (!is_array($this->shop->view['pflicht'])) $this->shop->view['pflicht'] = array(); $this->shop->view['pflicht']['custom'][] = array( @@ -1608,7 +1612,7 @@ die($this->shop->render(WPSG_PATH_VIEW.'/admin/kundendaten_tab2.phtml')); - } - else if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'remove') - { + } else if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'remove') { + + check_admin_referer('wpsg-admin-kundendaten-delete'); unset($this->shop->view['pflicht']['custom'][$_REQUEST['kv_index']]); @@ -1830,4 +1834,6 @@ if (isset($_REQUEST['download'])) { + + check_admin_referer('wpsg-admin-widerrufsbelehrung-download'); wpsg_header::PDFPlugin(WPSG_PATH_UPLOADS.'wpsg_revocation/'.$this->get_option('wpsg_revocationform')); @@ -1891,7 +1897,8 @@ } - if (wpsg_isSizedString($_REQUEST['do']) && $_REQUEST['do'] == 'generateWiderrufsformular') - { - + if (wpsg_isSizedString($_REQUEST['do']) && $_REQUEST['do'] == 'generateWiderrufsformular') { + + check_admin_referer('wpsg-admin-widerrufsbelehrung-generate'); + if (!file_exists(WPSG_PATH_UPLOADS.'wpsg_revocation/')) mkdir(WPSG_PATH_UPLOADS.'wpsg_revocation/', 0775, true); @@ -1907,6 +1914,7 @@ } - else if (wpsg_isSizedString($_REQUEST['do']) && $_REQUEST['do'] == 'removeWiderrufsformular') - { + else if (wpsg_isSizedString($_REQUEST['do']) && $_REQUEST['do'] == 'removeWiderrufsformular') { + + check_admin_referer('wpsg-admin-widerrufsbelehrung-delete'); $bOK = unlink(WPSG_PATH_UPLOADS.'wpsg_revocation/'.$this->shop->get_option('wpsg_revocationform')); @@ -2091,4 +2099,6 @@ } else if (@$_REQUEST['subaction'] == "dataprotection") { + + check_admin_referer('wpsg-admin-dataprotection'); $this->update_option('dataprotectioncommissioner', $_REQUEST['dataprotectioncommissioner'], false, false, WPSG_SANITIZE_CHECKBOX); @@ -2311,7 +2321,8 @@ } - else if (@$_REQUEST['subaction'] == 'includes') - { - + else if (@$_REQUEST['subaction'] == 'includes') { + + check_admin_referer('wpsg-admin-includes'); + $this->update_option('wpsg_load_css', $_REQUEST['wpsg_load_css'], false, false, WPSG_SANITIZE_CHECKBOX); $this->update_option('wpsg_load_jquery', $_REQUEST['wpsg_load_jquery'], false, false, WPSG_SANITIZE_CHECKBOX); @@ -2340,6 +2351,7 @@ } - else if (@$_REQUEST['subaction'] == 'kalkulation') - { + else if (@$_REQUEST['subaction'] == 'kalkulation') { + + check_admin_referer('wpsg-admin-kalkulation'); $this->update_option('wpsg_kleinunternehmer', $_REQUEST['wpsg_kleinunternehmer'], false, false, WPSG_SANITIZE_CHECKBOX); @@ -2354,7 +2366,7 @@ $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction='.$_REQUEST['subaction']); - } - else if (@$_REQUEST['subaction'] == 'access') - { + } else if (@$_REQUEST['subaction'] == 'access') { + + check_admin_referer('wpsg-admin-access'); $this->addBackendMessage(__('Berechtigungen gespeichert.', 'wpsg')); @@ -2362,7 +2374,5 @@ if (wpsg_isSizedArray($_REQUEST['wpsg_cap'])) { - - \check_admin_referer('wpsg-save-admin-access'); - + // Sanitization foreach ($_REQUEST['wpsg_cap'] as $k => $v) { @@ -2416,7 +2426,8 @@ } - else if (@$_REQUEST['subaction'] == 'seiten') - { - + else if (@$_REQUEST['subaction'] == 'seiten') { + + check_admin_referer('wpsg-admin-seiten'); + // Seiten speichern $this->createPage(__('Anfrageliste', 'wpsg'), 'wpsg_page_request', $_REQUEST['wpsg_page_request']); @@ -2485,6 +2496,7 @@ { - if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'update') - { + if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'update') { + + check_admin_referer('wpsg-admin-db-update'); wpsg_install(); Index: /views/admin/access.phtml =================================================================== --- /views/admin/access.phtml (revision 7557) +++ /views/admin/access.phtml (revision 7558) @@ -20,5 +20,5 @@
- + prefix."user_roles"); ?> Index: /views/admin/dataprotection.phtml =================================================================== --- /views/admin/dataprotection.phtml (revision 7557) +++ /views/admin/dataprotection.phtml (revision 7558) @@ -18,6 +18,8 @@
- + + +
Index: /views/admin/includes.phtml =================================================================== --- /views/admin/includes.phtml (revision 7557) +++ /views/admin/includes.phtml (revision 7558) @@ -20,4 +20,6 @@ + + Index: /views/admin/kalkulation.phtml =================================================================== --- /views/admin/kalkulation.phtml (revision 7557) +++ /views/admin/kalkulation.phtml (revision 7558) @@ -19,5 +19,7 @@
- + + +
Index: /views/admin/konfiguration.phtml =================================================================== --- /views/admin/konfiguration.phtml (revision 7557) +++ /views/admin/konfiguration.phtml (revision 7558) @@ -33,6 +33,14 @@
-

Bitte klicken Sie auf ", "wpsg").''.__("Aktualisieren", "wpsg").' ('.__("Produkte etc. werden dabei nicht gelöscht.", "wpsg"); ?>)

+ +

+ Bitte klicken Sie auf Aktualisieren Produkte etc. werden dabei nicht gelöscht.', 'wpsg'), + wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Admin&subaction=allgemein&do=update&submit=1&noheader=1', 'wpsg-admin-db-update') + ); ?> +

+ +
@@ -40,5 +48,9 @@ -   +   'DBUpdate')); ?> Index: /views/admin/kundendaten.phtml =================================================================== --- /views/admin/kundendaten.phtml (revision 7557) +++ /views/admin/kundendaten.phtml (revision 7558) @@ -40,4 +40,6 @@ + +
@@ -78,5 +80,5 @@ - +
Index: /views/admin/seiten.phtml =================================================================== --- /views/admin/seiten.phtml (revision 7557) +++ /views/admin/seiten.phtml (revision 7558) @@ -20,4 +20,6 @@
+ + Index: /views/admin/widerrufsbelehrung.phtml =================================================================== --- /views/admin/widerrufsbelehrung.phtml (revision 7557) +++ /views/admin/widerrufsbelehrung.phtml (revision 7558) @@ -32,6 +32,14 @@ view['revocationform'])) { ?> - view['revocationform']; ?> - + view['revocationform']; ?> + @@ -42,5 +50,9 @@

- +