← All changes | admin/controllers/shortcode.php +63 -9 1.6.6 → 1.8.16 View file →

		@@ -32,19 +32,43 @@
32	32	}
33	33
34	34	public function save($close = 0)
35	35	{
36		- $app = JFactory::getApplication();
37		- $input = $app->input;
38		- $dbo = JFactory::getDbo();
	36	+ $app = JFactory::getApplication();
39	37
40	38	// get return URL
41		- $encoded = $input->getBase64('return', '');
	39	+ $encoded = $app->input->getBase64('return', '');
42	40
	41	+ // set up redirect url in case of error
	42	+ $this->setRedirect('admin.php?page=vikbooking&view=shortcodes' . ($encoded ? '&return=' . $encoded : ''));
	43	+
	44	+ /**
	45	+ * Added token validation.
	46	+ *
	47	+ * @since 1.6.7
	48	+ */
	49	+ if (!JSession::checkToken() && !JSession::checkToken('get'))
	50	+ {
	51	+ if (wp_doing_ajax())
	52	+ {
	53	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));
	54	+ }
	55	+
	56	+ // missing CSRF token
	57	+ $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
	58	+ return false;
	59	+ }
	60	+
43	61	// make sure the user is authorised to change shortcodes
44	62	if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
45	63	{
46		- $app->redirect($return);
	64	+ if (wp_doing_ajax())
	65	+ {
	66	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
	67	+ }
	68	+
	69	+ // not authorized
	70	+ return false;
47	71	}
48	72
49	73	// get item from request
50	74	$data = $this->model->getFormData();
		@@ -51,22 +75,53 @@
51	75
52	76	// dispatch model to save the item
53	77	$id = $this->model->save($data);
54	78
	79	+ if (!$id)
	80	+ {
	81	+ // get string error
	82	+ $error = $this->model->getError(null, true);
	83	+ $error = JText::sprintf('JLIB_APPLICATION_ERROR_SAVE_FAILED', $error);
	84	+
	85	+ if (wp_doing_ajax())
	86	+ {
	87	+ VBOHttpDocument::getInstance($app)->close(500, $error);
	88	+ }
	89	+
	90	+ // display error message
	91	+ $app->enqueueMessage($error, 'error');
	92	+
	93	+ $url = 'admin.php?page=vikbooking&view=shortcode';
	94	+
	95	+ if ($data->id)
	96	+ {
	97	+ $url .= '&cid[]=' . $data->id;
	98	+ }
	99	+
	100	+ // redirect to new/edit page
	101	+ $this->setRedirect($url);
	102	+ return false;
	103	+ }
	104	+
	105	+ if (wp_doing_ajax())
	106	+ {
	107	+ VBOHttpDocument::getInstance($app)->json($this->model->getItem($id));
	108	+ }
	109	+
55	110	if ($close == 2)
56	111	{
57	112	// save and new
58		- $return = 'admin.php?option=com_vikbooking&task=shortcodes.create&return=' . $encoded;
	113	+ $return = 'admin.php?page=vikbooking&task=shortcodes.create&return=' . $encoded;
59	114	}
60	115	else if ($close == 1)
61	116	{
62	117	// save and close
63		- $return = 'admin.php?option=com_vikbooking&view=shortcodes&return=' . $encoded;
	118	+ $return = 'admin.php?page=vikbooking&view=shortcodes&return=' . $encoded;
64	119	}
65	120	else
66	121	{
67	122	// save and stay in edit page
68		- $return = 'admin.php?option=com_vikbooking&task=shortcodes.edit&cid[]=' . $id . '&return=' . $encoded;
	123	+ $return = 'admin.php?page=vikbooking&task=shortcodes.edit&cid[]=' . $id . '&return=' . $encoded;
69	124	}
70	125
71	126	$app->redirect($return);
72	127	}
		@@ -112,9 +167,8 @@
112	167	public function add_to_page()
113	168	{
114	169	$app = JFactory::getApplication();
115	170	$input = $app->input;
116		- $dbo = JFactory::getDbo();
117	171
118	172	// get return URL
119	173	$encoded = $input->getBase64('return', '');
120	174