  |
1 | 1 | | <?php |
| |
2 | 2 | | /* |
 |
3 | | - | $Id: address_book_process.php 1766 2008-01-03 17:35:06Z hpdl $ |
| |
| 3 | + | $Id: address_book_process.php 1843 2008-12-12 13:32:10Z hpdl $ |
|
4 | 4 | | |
| |
5 | 5 | | osCommerce, Open Source E-Commerce Solutions |
| |
6 | 6 | | http://www.oscommerce.com |
| |
7 | 7 | | |
|
8 | | - | Copyright (c) 2007 osCommerce |
| |
| 8 | + | Copyright (c) 2008 osCommerce |
|
9 | 9 | | |
| |
10 | 10 | | Released under the GNU General Public License |
| |
11 | 11 | | */ |
| |
|
|
 |
… |
|
20 | 20 | | // needs to be included earlier to set the success message in the messageStack |
| |
21 | 21 | | require(DIR_WS_LANGUAGES . $language . '/' . FILENAME_ADDRESS_BOOK_PROCESS); |
| |
22 | 22 | | |
|
23 | | - | if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'deleteconfirm') && isset($HTTP_GET_VARS['delete']) && is_numeric($HTTP_GET_VARS['delete'])) { |
| |
| 23 | + | if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'deleteconfirm') && isset($HTTP_GET_VARS['delete']) && is_numeric($HTTP_GET_VARS['delete']) && isset($HTTP_GET_VARS['formid']) && ($HTTP_GET_VARS['formid'] == md5($sessiontoken))) { |
|
24 | 24 | | tep_db_query("delete from " . TABLE_ADDRESS_BOOK . " where address_book_id = '" . (int)$HTTP_GET_VARS['delete'] . "' and customers_id = '" . (int)$customer_id . "'"); |
| |
25 | 25 | | |
| |
26 | 26 | | $messageStack->add_session('addressbook', SUCCESS_ADDRESS_BOOK_ENTRY_DELETED, 'success'); |
| |
|
|
|
… |
|
30 | 30 | | |
| |
31 | 31 | | // error checking when updating or adding an entry |
| |
32 | 32 | | $process = false; |
|
33 | | - | if (isset($HTTP_POST_VARS['action']) && (($HTTP_POST_VARS['action'] == 'process') || ($HTTP_POST_VARS['action'] == 'update'))) { |
| |
| 33 | + | if (isset($HTTP_POST_VARS['action']) && (($HTTP_POST_VARS['action'] == 'process') || ($HTTP_POST_VARS['action'] == 'update')) && isset($HTTP_POST_VARS['formid']) && ($HTTP_POST_VARS['formid'] == $sessiontoken)) { |
|
34 | 34 | | $process = true; |
| |
35 | 35 | | $error = false; |
| |
36 | 36 | | |
| |
|
|
|
… |
|
270 | 270 | | <!-- left_navigation_eof //--> |
| |
271 | 271 | | </table></td> |
| |
272 | 272 | | <!-- body_text //--> |
|
273 | | - | <td width="100%" valign="top"><?php if (!isset($HTTP_GET_VARS['delete'])) echo tep_draw_form('addressbook', tep_href_link(FILENAME_ADDRESS_BOOK_PROCESS, (isset($HTTP_GET_VARS['edit']) ? 'edit=' . $HTTP_GET_VARS['edit'] : ''), 'SSL'), 'post', 'onSubmit="return check_form(addressbook);"'); ?><table border="0" width="100%" cellspacing="0" cellpadding="0"> |
| |
| 273 | + | <td width="100%" valign="top"><?php if (!isset($HTTP_GET_VARS['delete'])) echo tep_draw_form('addressbook', tep_href_link(FILENAME_ADDRESS_BOOK_PROCESS, (isset($HTTP_GET_VARS['edit']) ? 'edit=' . $HTTP_GET_VARS['edit'] : ''), 'SSL'), 'post', 'onSubmit="return check_form(addressbook);"', true); ?><table border="0" width="100%" cellspacing="0" cellpadding="0"> |
|
274 | 274 | | <tr> |
| |
275 | 275 | | <td><table border="0" width="100%" cellspacing="0" cellpadding="0"> |
| |
276 | 276 | | <tr> |
| |
|
|
|
… |
|
329 | 329 | | <tr> |
| |
330 | 330 | | <td width="10"><?php echo tep_draw_separator('pixel_trans.gif', '10', '1'); ?></td> |
| |
331 | 331 | | <td><?php echo '<a href="' . tep_href_link(FILENAME_ADDRESS_BOOK, '', 'SSL') . '">' . tep_image_button('button_back.gif', IMAGE_BUTTON_BACK) . '</a>'; ?></td> |
|
332 | | - | <td align="right"><?php echo '<a href="' . tep_href_link(FILENAME_ADDRESS_BOOK_PROCESS, 'delete=' . $HTTP_GET_VARS['delete'] . '&action=deleteconfirm', 'SSL') . '">' . tep_image_button('button_delete.gif', IMAGE_BUTTON_DELETE) . '</a>'; ?></td> |
| |
| 332 | + | <td align="right"><?php echo '<a href="' . tep_href_link(FILENAME_ADDRESS_BOOK_PROCESS, 'delete=' . $HTTP_GET_VARS['delete'] . '&action=deleteconfirm&formid=' . md5($sessiontoken), 'SSL') . '">' . tep_image_button('button_delete.gif', IMAGE_BUTTON_DELETE) . '</a>'; ?></td> |
|
333 | 333 | | <td width="10"><?php echo tep_draw_separator('pixel_trans.gif', '10', '1'); ?></td> |
| |
334 | 334 | | </tr> |
| |
335 | 335 | | </table></td> |