InUse Link mit CSRF (#1475)

* InUse Link mit CSRF fixes: #1474 * csrf to infuse check be_link.php
yakamara · Feb 22, 2024 · 9516a44 · 9516a44
1 parent 9bca540
commit 9516a44
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 9 deletions.
diff --git a/plugins/manager/lib/yform/value/be_link.php b/plugins/manager/lib/yform/value/be_link.php
@@ -104,13 +104,7 @@ public static function isArticleInUse(rex_extension_point $ep)
                             foreach ($items as $item) {
                                 $sqlData = \rex_sql::factory();
                                 $sqlData->setQuery('SELECT `name` FROM `' . \rex_yform_manager_table::table() . '` WHERE `table_name` = "' . $tableName . '"');
-
-                                $url = \rex_url::backendController([
-                                    'page' => 'yform/manager/data_edit',
-                                    'table_name' => $tableName,
-                                    'data_id' => $item['id'],
-                                    'func' => 'edit',
-                                ]);
+                                $url = rex_yform_manager::url($tableName, $item['id']);
                                 $messages .= '<li><a href="' . $url . '">' . $sqlData->getValue('name') . ' [id=' . $item['id'] . ']</a></li>';
                             }
                         }

diff --git a/plugins/manager/lib/yform/value/be_media.php b/plugins/manager/lib/yform/value/be_media.php
@@ -146,8 +146,8 @@ public static function isMediaInUse(rex_extension_point $ep)
                 foreach ($items as $item) {
                     $sqlData = \rex_sql::factory();
                     $sqlData->setQuery('SELECT `name` FROM `' . \rex_yform_manager_table::table() . '` WHERE `table_name` = "' . $tableName . '"');
-
-                    $messages .= '<li><a href="javascript:openPage(\'index.php?page=yform/manager/data_edit&amp;table_name=' . $tableName . '&amp;data_id=' . $item['id'] . '&amp;func=edit\')">' . $sqlData->getValue('name') . ' [id=' . $item['id'] . ']</a></li>';
+                    $editUrl = rex_yform_manager::url($tableName, $item['id']);
+                    $messages .= '<li><a href="javascript:openPage(\'' . $editUrl . '\')">' . $sqlData->getValue('name') . ' [id=' . $item['id'] . ']</a></li>';
                 }
             }
         }