Index: /controller/wpsg_OrderController.class.php =================================================================== --- /controller/wpsg_OrderController.class.php (revision 7560) +++ /controller/wpsg_OrderController.class.php (revision 7561) @@ -21,4 +21,6 @@ } else if (wpsg_isSizedString($_REQUEST['subaction'], 'add')) { + check_admin_referer('wpsg-order-add'); + $this->addAction(); @@ -31,7 +33,5 @@ $this->updateOrderAction(); - } - if (wpsg_isSizedString($_REQUEST['subaction'], 'shippingData')) - { + } if (wpsg_isSizedString($_REQUEST['subaction'], 'shippingData')) { $this->shippingDataAction(); } @@ -143,7 +143,5 @@ public function addAction() { - - check_admin_referer('order-index-add'); - + $customer_id = false; @@ -245,5 +243,5 @@ $this->addBackendMessage(__('Die neue Bestellung wurde vorbereitet.', 'wpsg')); - $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Order&action=view&edit_id='.$order_id); + $this->redirect(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Order&action=view&edit_id='.$order_id, 'wpsg-order-edit-'.$order_id)); } @@ -1105,5 +1103,5 @@ } - $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Order&action=view&edit_id='.$_REQUEST['edit_id']); + $this->redirect(wpsg_admin_url('Order', 'view', ['edit_id' => $_REQUEST['edit_id']])); } // public function switchStatusAction() @@ -1112,6 +1110,7 @@ * Wird beim stornieren einer einzelnen Bestellung aufgerufen */ - public function stornoAction() - { + public function stornoAction() { + + wpsg_checkNounce('Order', 'storno', ['edit_id' => wpsg_getInt($_REQUEST['edit_id'])]); $this->shop->setOrderStatus($_REQUEST['edit_id'], 500, true); @@ -1125,7 +1124,6 @@ * Zeigt eine Bestellung an */ - public function viewAction() - { - + public function viewAction() { + if (wpsg_isSizedString($_REQUEST['subaction'], 'updateCalculation')) { @@ -1150,5 +1148,7 @@ } else if (wpsg_isSizedString($_REQUEST['subaction'], 'removeProduct')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'removeProduct', 'edit_id' => $_REQUEST['edit_id']]); + $oCalculation = new \wpsg\wpsg_calculation(); $oCalculation->fromDB($_REQUEST['edit_id']); @@ -1165,5 +1165,7 @@ } else if (wpsg_isSizedString($_REQUEST['subaction'], 'sendMail')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'sendMail', 'do' => 'customer', 'edit_id' => $_REQUEST['edit_id']]); + $oBasket = new wpsg_basket(); $oBasket->initFromDB($_REQUEST['edit_id']); @@ -1285,7 +1287,9 @@ } else if (wpsg_isSizedString($_REQUEST['subaction'], 'addProduct')) { - + if (wpsg_isSizedString($_REQUEST['do'], 'search')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'addProduct', 'edit_id' => $_REQUEST['edit_id'], 'do' => 'search']); + $arReturn = []; @@ -1321,5 +1325,7 @@ } else if (wpsg_isSizedString($_REQUEST['do'], 'product')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'addProduct', 'do' => 'product', 'edit_id' => $_REQUEST['edit_id']]); + if (wpsg_isSizedInt($_REQUEST['product_id'])) { @@ -1345,5 +1351,7 @@ } else if (wpsg_isSizedString($_REQUEST['do'], 'submit')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'addProduct', 'do' => 'submit', 'edit_id' => $_REQUEST['edit_id']]); + $oCalculation = new \wpsg\wpsg_calculation(); $oCalculation->fromDB($_REQUEST['edit_id']); @@ -1364,4 +1372,7 @@ $oCalculation->toDB($_REQUEST['edit_id']); + + $oCalculation = new \wpsg\wpsg_calculation(); + $oCalculation->fromDB($_REQUEST['edit_id']); $this->shop->view['oCalculation'] = $oCalculation; @@ -1371,5 +1382,9 @@ ]); - } + } else { + + wpsg_checkNounce('Order', 'view', ['subaction' => 'addProduct', 'edit_id' => $_REQUEST['edit_id']]); + + } $this->shop->render(WPSG_PATH_VIEW.'/order/backendEdit/addProduct.phtml'); @@ -1377,5 +1392,13 @@ exit; - } + } else { + + if (!(wpsg_isSizedString($_REQUEST['subaction'], 'editPayShipping'))) { + + wpsg_checkNounce('Order', 'view', ['edit_id' => wpsg_getInt($_REQUEST['edit_id'])]); + + } + + } $this->shop->view['data'] = $this->db->fetchRow(" @@ -1412,5 +1435,7 @@ if (wpsg_isSizedString($_REQUEST['subaction'], 'editPayShipping')) { - + + wpsg_checkNounce('Order', 'view', ['subaction' => 'editPayShipping', 'edit_id' => $_REQUEST['edit_id']]); + $this->shop->render(WPSG_PATH_VIEW.'/order/backendEdit/editPayShipping.phtml'); @@ -1528,9 +1553,9 @@ * Übernimmt das löschen von Bestellungen */ - public function deleteAction() - { - - if (!isset($_REQUEST['edit_id'])) - { + public function deleteAction() { + + wpsg_checkNounce('Order', 'delete', ['edit_id' => wpsg_getInt($_REQUEST['edit_id'])]); + + if (!isset($_REQUEST['edit_id'])) { $this->shop->addBackendError(__('Keine Bestellnummer ÃŒbergeben.', 'wpsg')); @@ -1547,6 +1572,5 @@ } // public function deleteAction() - public function indexAction() - { + public function indexAction() { if (wpsg_isSizedString($_REQUEST['do'], 'writeMultiRechnung') || wpsg_isSizedString($_REQUEST['wpsg_action'], 'showRechnung')) @@ -1749,4 +1773,6 @@ } + + if (isset($_REQUEST['submit-button'])) check_admin_referer('wpsg-order-search'); $nPerPage = $this->get_option('wpsg_order_perpage'); Index: /controller/wpsg_ProduktController.class.php =================================================================== --- /controller/wpsg_ProduktController.class.php (revision 7560) +++ /controller/wpsg_ProduktController.class.php (revision 7561) @@ -152,7 +152,8 @@ * Stellt die Übersicht der Produkte im Backend dar */ - public function indexAction() - { - + public function indexAction() { + + if (isset($_REQUEST['submit-button'])) check_admin_referer('wpsg-product-search'); + $nPerPage = $this->shop->get_option('wpsg_produkte_perpage'); if ($nPerPage <= 0) $nPerPage = 10; @@ -168,17 +169,18 @@ $this->shop->view['pages'] = 1; - if (wpsg_isSizedArray($_REQUEST['filter'])) - { - - $_REQUEST['filter']['s'] = wpsg_xss($_REQUEST['filter']['s']); - $_REQUEST['filter']['productgroup_ids'] = sanitize_key($_REQUEST['filter']['productgroup_ids']); - $_REQUEST['filter']['productcategory_ids'] = sanitize_key($_REQUEST['filter']['productcategory_ids']); + if (wpsg_isSizedInt($_REQUEST['search']['pgruppe'])) { + + $_REQUEST['filter']['productgroup_ids'] = $_REQUEST['search']['pgruppe']; + + } + + if (wpsg_isSizedArray($_REQUEST['filter'])) { + + $_REQUEST['filter']['s'] = wpsg_xss($_REQUEST['filter']['s']); $this->shop->view['arFilter'] = $_REQUEST['filter']; $this->shop->view['hasFilter'] = true; - } - else if (wpsg_isSizedArray($_SESSION['wpsg']['backend']['products']['arFilter'])) - { + } else if (wpsg_isSizedArray($_SESSION['wpsg']['backend']['products']['arFilter'])) { //$this->shop->view['arFilter'] = $_SESSION['wpsg']['backend']['customer']['arFilter']; @@ -208,14 +210,18 @@ } // public function indexAction() - + /** * Wird beim exportieren der Produkte aufgerufen + * @param bool $bReturnData + * @return array|void + * @throws \wpsg\Exception */ - public function exportAction($bReturnData = false) - { + public function exportAction($bReturnData = false, $noNounce = false) { + + if (!$noNounce) check_admin_referer('wpsg-product-export'); $arData = $this->db->fetchAssoc("SELECT * FROM `".wpsg_q(WPSG_TBL_PRODUCTS)."` WHERE `deleted` != '1'"); - if (!wpsg_isSizedArray($arData)) { $this->addBackendError(__('Keine Daten zum Exportieren vorhanden.', 'wpsg')); $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=index'); return; } + if (!wpsg_isSizedArray($arData)) { $this->addBackendError(__('Keine Daten zum Exportieren vorhanden.', 'wpsg')); $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=index'); return; } foreach ($arData as $k => $v) @@ -282,6 +288,7 @@ } // public function exportAction() - public function exportMediaAction() - { + public function exportMediaAction() { + + check_admin_referer('wpsg-product-exportMedia'); @ini_set('memory_limit', '2000M'); @@ -291,9 +298,8 @@ $zip = new ZipArchive(); - if ($zip->open($zip_file, ZIPARCHIVE::CREATE) == true) - { + if ($zip->open($zip_file, ZIPARCHIVE::CREATE) == true) { // Produktdaten, wie normaler Export - list($product_export_file, $arData) = $this->exportAction(true); + list($product_export_file, $arData) = $this->exportAction(true, true); $zip->addFile($product_export_file, 'productdata.csv'); @@ -328,10 +334,9 @@ $zip->close(); - + wpsg_header::ZIP($zip_file, 'wpsg_export.zip'); - - } - else - { + exit; + + } else { $this->addBackendError(_('Konnte ZIP Archiv nicht erstellen.', 'wpsg')); @@ -346,13 +351,13 @@ * Wird beim importieren der Produkte aufgerufen. Zeichnet das Upload Formular und fÃŒhrt auch den Import durch */ - public function importAction() - { - + public function importAction() { + @ini_set('memory_limit', '2000M'); @set_time_limit(3600); - if (isset($_REQUEST['wpsg_import']) && file_exists($_FILES['wpsg_importfile']['tmp_name'])) - { - + if (isset($_REQUEST['wpsg_import']) && file_exists($_FILES['wpsg_importfile']['tmp_name'])) { + + check_admin_referer('wpsg-product-import-do'); + // Import starten @@ -549,11 +554,13 @@ die($this->shop->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=index')); - } - else if (isset($_REQUEST['wpsg_import'])) - { + } else if (isset($_REQUEST['wpsg_import'])) { $this->shop->addBackendError(__('Keine Datei zum Import angegeben.', 'wpsg')); $this->shop->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=import'); + } else { + + check_admin_referer('wpsg-product-import'); + } @@ -565,6 +572,7 @@ * Wird beim bearbeiten aufgerufen */ - public function editAction() - { + public function editAction() { + + check_admin_referer('wpsg-product-edit-'.intval($_REQUEST['edit_id'])); // VerfÃŒgbare Produkttemplates @@ -781,4 +789,6 @@ public function copyAction() { + check_admin_referer('wpsg-product-copy-'.intval($_REQUEST['edit_id'])); + if (!wpsg_checkInput($_REQUEST['edit_id'], WPSG_SANITIZE_INT)) throw new \Exception(__('Requestfehler', 'wpsg')); @@ -836,7 +846,8 @@ * Speichert ein Produkt */ - public function saveAction() - { - + public function saveAction() { + + check_admin_referer('wpsg-product-save-'.wpsg_getInt($_REQUEST['edit_id'])); + if ($this->shop->get_option('wpsg_options_nl2br') == '1') { @@ -869,9 +880,7 @@ if (isset($_REQUEST['submit_index'])) $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=index'); - else $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$_REQUEST['edit_id'].'&wpsg_lang='.$_REQUEST['wpsg_lang']); - - } - else - { + else $this->redirect(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$_REQUEST['edit_id'].'&wpsg_lang='.$_REQUEST['wpsg_lang'], 'wpsg-product-edit-'.wpsg_getInt($_REQUEST['edit_id']))); + + } else { // RegulÀres Produkt speichern @@ -963,5 +972,5 @@ if (isset($_REQUEST['submit_index'])) $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=index'); - else $this->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$_REQUEST['edit_id']); + else $this->redirect(wp_nonce_url(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Produkt&action=edit&edit_id='.$_REQUEST['edit_id'], 'wpsg-product-edit-'.wpsg_getInt($_REQUEST['edit_id']))); } @@ -974,7 +983,8 @@ * Wird beim erstellen eines neuen Produktes aufgerufen */ - public function addAction() - { - + public function addAction() { + + check_admin_referer('wpsg-product-admin'); + // VerfÃŒgbare Produkttemplates $this->shop->view['templates'] = $this->shop->loadProduktTemplates(); @@ -1022,6 +1032,7 @@ * Wird beim löschen eines Produktes aufgerufen */ - public function delAction() - { + public function delAction() { + + check_admin_referer('wpsg-product-del-'.intval($_REQUEST['edit_id'])); $oProduct = wpsg_product::getInstance($_REQUEST['edit_id']); Index: /controller/wpsg_ShopController.class.php =================================================================== --- /controller/wpsg_ShopController.class.php (revision 7560) +++ /controller/wpsg_ShopController.class.php (revision 7561) @@ -931,12 +931,7 @@ wp_enqueue_script('jquery-ui-datepicker-de', $this->url(WPSG_URL_CONTENT.'plugins/'.WPSG_FOLDERNAME.'/lib/ui/jquery.ui.datepicker-de.js'), array('jquery', 'jquery-ui-core')); - //if (in_array(wpsg_getStr($_REQUEST['page']), array('wpsg-Admin', 'wpsg-Produkt', 'wpsg-Order'))) - { - - wp_enqueue_style('wpsg-bscss', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap-3.3.6-dist/css/bootstrap.css')); - wp_enqueue_style('wpsg-bs-theme-css', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap-3.3.6-dist/css/bootstrap-theme.css')); - wp_enqueue_style('wpsg_bs_editable', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap3-editable-1.5.1/bootstrap3-editable/css/bootstrap-editable.css')); - - } + wp_enqueue_style('wpsg-bscss', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap-3.3.6-dist/css/bootstrap.css')); + wp_enqueue_style('wpsg-bs-theme-css', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap-3.3.6-dist/css/bootstrap-theme.css')); + wp_enqueue_style('wpsg_bs_editable', $GLOBALS['wpsg_sc']->getRessourceURL('js/bootstrap3-editable-1.5.1/bootstrap3-editable/css/bootstrap-editable.css')); wp_enqueue_style('wp-jquery-ui-dialog'); Index: /lib/functions.inc.php =================================================================== --- /lib/functions.inc.php (revision 7560) +++ /lib/functions.inc.php (revision 7561) @@ -1690,4 +1690,59 @@ } + + function wpsg_checkNounce($controller, $action = '', $arParam = []) { + + check_admin_referer(wpsg_getNounce($controller, $action, $arParam)); + + } + + function wpsg_formNounce($controller, $action = '', $arParam = []) { + + echo wp_nonce_field(wpsg_getNounce($controller, $action, $arParam)); + + } + + function wpsg_getNounce($controller, $action = '', $arParam = []) { + + $strNounce = 'wpsg-'.strtolower($controller).'-'.strtolower($action).'-'; + + if (wpsg_isSizedArray($arParam)) { + + ksort($arParam); + + foreach ($arParam as $k => $v) { + + $strNounce .= $k.'-'.$v; + + } + + } + + return $strNounce; + + } + + function wpsg_admin_url($controller, $action = '', $arParam = [], $arParamNoNounce = [], $html_entity_decode = false) { + + $strURL = WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-'.$controller.'&action='.$action; + + if (wpsg_isSizedArray($arParam)) { + + $strURL .= '&'.http_build_query($arParam); + + } + + if (wpsg_isSizedArray($arParamNoNounce)) { + + $strURL .= '&'.http_build_query($arParamNoNounce); + + } + + $url = wp_nonce_url($strURL, wpsg_getNounce($controller, $action, $arParam)); + + if ($html_entity_decode) return html_entity_decode($url); + else return $url; + + } /** Index: /mods/wpsg_mod_kundenverwaltung.class.php =================================================================== --- /mods/wpsg_mod_kundenverwaltung.class.php (revision 7560) +++ /mods/wpsg_mod_kundenverwaltung.class.php (revision 7561) @@ -331,5 +331,11 @@ else if (wpsg_isSizedString($_REQUEST['action'], 'del')) $this->be_delAction(); else if (wpsg_isSizedString($_REQUEST['action'], 'save')) $this->be_saveAction(); - else $this->be_indexAction(); + else { + + if (isset($_REQUEST['submit-button'])) wpsg_checkNounce('Customer', 'search'); + + $this->be_indexAction(); + + } } // public function dispatch() Index: /mods/wpsg_mod_productgroups.class.php =================================================================== --- /mods/wpsg_mod_productgroups.class.php (revision 7560) +++ /mods/wpsg_mod_productgroups.class.php (revision 7561) @@ -616,25 +616,31 @@ } // public function getAllProductGroups() - public function dispatch() - { - - if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "add") - { + public function dispatch() { + + if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "add") { + + wpsg_checkNounce('Productgroups', '', ['wpsg_mod_action' => 'add']); + $this->addAction(); - } - else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "edit") - { + + } else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "edit") { + + wpsg_checkNounce('Productgroups', '', ['wpsg_mod_action' => 'edit', 'edit_id' => $_REQUEST['edit_id']]); + $this->editAction(); - } - else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "del") - { + + } else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "del") { + + wpsg_checkNounce('Productgroups', '', ['wpsg_mod_action' => 'del', 'edit_id' => $_REQUEST['edit_id']]); + $this->delAction(); - } - else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "save") - { + + } else if (isset($_REQUEST['wpsg_mod_action']) && $_REQUEST['wpsg_mod_action'] == "save") { + + \check_admin_referer('wpsg-productgroup-save-'.wpsg_getInt($_REQUEST['edit_id'])); + $this->saveAction(); - } - else - { + + } else { $this->indexAction(); } @@ -642,6 +648,7 @@ } // public function dispatch() - public function indexAction() - { + public function indexAction() { + + if (isset($_REQUEST['submit-button'])) check_admin_referer('wpsg-mod-productgroups-search'); $nPerPage = 25; @@ -692,6 +699,4 @@ public function delAction() { - \check_admin_referer('wpsg-productgroup-del-'.intval($_REQUEST['edit_id'])); - $this->db->Query("DELETE FROM `".WPSG_TBL_PRODUCTS_GROUP."` WHERE `id` = '".wpsg_q($_REQUEST['edit_id'])."'"); $this->shop->addBackendMessage(__('Produktgruppe wurde erfolgreich gelöscht.', 'wpsg')); @@ -702,7 +707,5 @@ public function saveAction() { - - \check_admin_referer('wpsg-productgroup-save-'.wpsg_getInt($_REQUEST['edit_id'])); - + $arTemplateFiles = [0] + $this->shop->loadProduktTemplates(true); @@ -760,5 +763,5 @@ if (isset($_REQUEST['submit_index'])) $this->shop->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=index'); - else $this->shop->redirect(WPSG_URL_WP.'wp-admin/admin.php?page=wpsg-Productgroups&wpsg_mod_action=edit&edit_id='.$_REQUEST['edit_id']); + else $this->shop->redirect(wpsg_admin_url('Productgroups', '', ['wpsg_mod_action' => 'edit', 'edit_id' => $_REQUEST['edit_id']])); } // public function saveAction() Index: /views/mailtemplates/adminmail.phtml =================================================================== --- /views/mailtemplates/adminmail.phtml (revision 7560) +++ /views/mailtemplates/adminmail.phtml (revision 7561) @@ -71,6 +71,5 @@ arPayment[$this->view['basket']['checkout']['payment']]['name']; ?> callMods('mail_payment'); ?> - -view['o_id']; ?> + render(WPSG_PATH_VIEW.'/mailtemplates/order.phtml'); ?> Index: /views/mailtemplates/html/adminmail.phtml =================================================================== --- /views/mailtemplates/html/adminmail.phtml (revision 7560) +++ /views/mailtemplates/html/adminmail.phtml (revision 7561) @@ -16,5 +16,5 @@
-

:

+

:

render(WPSG_PATH_VIEW.'/mailtemplates/html/order.phtml'); ?> Index: /views/mods/mod_kundenverwaltung/index.phtml =================================================================== --- /views/mods/mod_kundenverwaltung/index.phtml (revision 7560) +++ /views/mods/mod_kundenverwaltung/index.phtml (revision 7561) @@ -42,4 +42,6 @@
+ + Index: /views/mods/mod_productgroups/index.phtml =================================================================== --- /views/mods/mod_productgroups/index.phtml (revision 7560) +++ /views/mods/mod_productgroups/index.phtml (revision 7561) @@ -19,5 +19,9 @@ - +