← All changes | back/Controllers/Fields/Listing.php +8 -2 10.2.2 → 11.1.0 View file →

		@@ -27,9 +27,15 @@
27	27	}
28	28
29	29	public function ajaxSetOrdering(): void
30	30	{
31		- $order = json_decode(acym_getVar('string', 'order'));
	31	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	32	+
	33	+ $order = json_decode(acym_getVar('string', 'order'), true);
	34	+ if (empty($order)) {
	35	+ $order = [];
	36	+ }
	37	+
32	38	$i = 1;
33	39	$error = false;
34	40	foreach ($order as $field) {
35	41	$query = 'UPDATE #__acym_field SET `ordering` = '.intval($i).' WHERE `id` = '.intval($field);
		@@ -42,9 +48,9 @@
42	48
43	49	public function delete(): void
44	50	{
45	51	$fieldClass = new FieldClass();
46		- $ids = acym_getVar('cmd', 'elements_checked');
	52	+ $ids = acym_getVar('array', 'elements_checked', []);
47	53	if (in_array('1', $ids) || in_array('2', $ids) || in_array($fieldClass->getLanguageFieldId(), $ids)) {
48	54	acym_enqueueMessage(acym_translation('ACYM_CANT_DELETE'), 'error');
49	55	$this->listing();
50	56	} else {