| @@ -27,8 +27,10 @@ | ||
| 27 | 27 | } |
| 28 | 28 | |
| 29 | 29 | public function ajaxSetOrdering(): void |
| 30 | 30 | { |
| 31 | + wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token'); | |
| 32 | + | |
| 31 | 33 | $order = json_decode(acym_getVar('string', 'order'), true); |
| 32 | 34 | if (empty($order)) { |
| 33 | 35 | $order = []; |
| 34 | 36 | } |
| @@ -46,9 +48,9 @@ | ||
| 46 | 48 | |
| 47 | 49 | public function delete(): void |
| 48 | 50 | { |
| 49 | 51 | $fieldClass = new FieldClass(); |
| 50 | - $ids = acym_getVar('cmd', 'elements_checked'); | |
| 52 | + $ids = acym_getVar('array', 'elements_checked', []); | |
| 51 | 53 | if (in_array('1', $ids) || in_array('2', $ids) || in_array($fieldClass->getLanguageFieldId(), $ids)) { |
| 52 | 54 | acym_enqueueMessage(acym_translation('ACYM_CANT_DELETE'), 'error'); |
| 53 | 55 | $this->listing(); |
| 54 | 56 | } else { |
