Überarbeitete Version der 1. Version. Es bestehen noch grosse Feher in einzelnen Skripten.

www/intern/wk-leitung/riegeneinteilung.php

@@ -1,8 +1,5 @@
 <?php
 
-if (session_status() !== PHP_SESSION_ACTIVE) session_start();
-
-
 ini_set('display_errors', 1);
 ini_set('display_startup_errors', 1);
 // Show all errors except deprecation notices (these come from vendor libraries
@@ -10,17 +7,25 @@ ini_set('display_startup_errors', 1);
 // dependencies to versions compatible with your PHP runtime.
 error_reporting(E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED);
 
+
 if (!isset($baseDir)) {
     $baseDir = $_SERVER['DOCUMENT_ROOT'];
 }
 
-$logintype = 'wk_leitung';
+require_once $baseDir . '/../scripts/session_functions.php';
 
-if (empty($_SESSION['access_granted_wk_leitung']) || $_SESSION['access_granted_wk_leitung'] !== true || empty($_SESSION['passcodewk_leitung_id']) || intval($_SESSION['passcodewk_leitung_id']) < 0 ) {
+ini_wkvs_session(true);
+
+$csrf_token = $_SESSION['csrf_token'] ?? '';
+
+$access_granted_wkl = check_user_permission('wk_leitung', true) ?? false;
+
+if (!$access_granted_wkl) {
+
+    $logintype = 'wk_leitung';
         
     require $baseDir . '/../scripts/login/login.php';
 
-    $logintype = '';
 } else {
 
 
@@ -99,6 +104,9 @@ foreach ($allAbt as $abt) {
   <link rel="stylesheet" href="/intern/css/riegeneinteilung.css">
   <link rel="icon" type="png" href="/intern/img/icon.png">
   <link href="/files/fonts/fonts.css" rel="stylesheet">
+  <script src="/intern/js/jquery/jquery-3.7.1.min.js"></script>
+  <script src="/intern/js/jquery/jquery-ui.min.js"></script>
+  <script src="/intern/js/jquery/jquery.ui.touch-punch.min.js"></script>
   <script src="/intern/js/custom-msg-display.js"></script>
 </head>
 
@@ -367,15 +375,11 @@ foreach ($allAbt as $abt) {
 </div>
 
 
-<script src="/intern/js/jquery/jquery-3.7.1.min.js"></script>
-<script src="/intern/js/jquery/jquery-ui.min.js"></script>
-<script src="/intern/js/jquery/jquery.ui.touch-punch.min.js"></script>
-<link rel="stylesheet" href="/intern/js/jquery/jquery-ui.css">
-
-
 <script>
 $(function () {
 
+  const csrf_token = "<?= $csrf_token ?>";
+
   function updateCounters() {
     $(".geraet-table").each(function () {
       const count = $(this).find("tr.turnerin-row").length;
@@ -453,6 +457,7 @@ $(function () {
             url: "/intern/scripts/riegeneinteilung/ajax_update_turnerin.php",
             method: "POST",
             data: {
+              csrf_token,
               turnerin_id: turnerinId,
               abteilung: newAbt,
               geraet: newGeraet
@@ -470,6 +475,7 @@ $(function () {
           url: "/intern/scripts/riegeneinteilung/ajax_update_turnerin.php",
           method: "POST",
           data: {
+            csrf_token,
             turnerin_id: turnerinId,
             abteilung: newAbt,
             geraet: newGeraet
@@ -479,6 +485,7 @@ $(function () {
       }
 
       const payload = {
+        csrf_token,
         new: newIndexes(newTable),
         old: newTable.is(oldTable) ? [] : newIndexes(oldTable)
       };
@@ -486,8 +493,7 @@ $(function () {
       $.ajax({
         url: "/intern/scripts/riegeneinteilung/ajax_update_start_indexes.php",
         method: "POST",
-        contentType: "application/json",
-        data: JSON.stringify(payload),
+        data: payload,
         success: function () {
           console.log("Order saved");
         },
@@ -619,6 +625,7 @@ $(function () {
             url: "/intern/scripts/riegeneinteilung/ajax_delete_specific_abt.php",
             method: "POST",
             data: {
+                csrf_token,
                 abt: $(this).data('abt')
             }
         })
@@ -639,6 +646,7 @@ $(function () {
             url: "/intern/scripts/riegeneinteilung/ajax_change_number_of_abt.php",
             method: "POST",
             data: {
+                csrf_token,
                 anz_abt: $(this).val()
             }
         })
@@ -657,7 +665,10 @@ $(function () {
 
         $.ajax({
             url: "/intern/scripts/riegeneinteilung/ajax_auto_riegeneinteilung.php",
-            method: "POST"
+            method: "POST",
+            data: {
+              csrf_token
+            }
         })
         .done(function (data, textStatus, jqXHR) {
             if (jqXHR.status === 201) {