feature #606, check pwg_token and display error (if any)

admin/themes/default/js/batchManagerGlobal.js

@@ -373,7 +373,9 @@ function delete_orphans_block(blockSize) {
         document.location = redirect_to;
       }
     },
-    error:function(XMLHttpRequest, textStatus, errorThrows) {
+    error:function(XMLHttpRequest) {
+      jQuery('#orphans_deletion').hide();
+      jQuery('#orphans_deletion_error').show().html('error '+XMLHttpRequest.status+' : '+XMLHttpRequest.statusText);
     }
   });
 }

admin/themes/default/template/batch_manager_global.tpl

@@ -356,6 +356,8 @@ var sliders = {
           {'orphans to delete'|translate}
         </span>
 
+        <span id="orphans_deletion_error" class="errors" style="display:none"></span>
+
         <span id="duplicates_options" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'duplicates'}display:none{/if}">
           {'based on'|translate}
           <label class="font-checkbox"><span class="icon-check"></span><input type="checkbox" name="filter_duplicates_filename" {if isset($filter.duplicates_filename)}checked="checked"{/if}> {'file name'|translate}</label>

include/ws_functions/pwg.images.php

@@ -1770,6 +1770,11 @@ function ws_images_checkUpload($params, $service)
  */
 function ws_images_deleteOrphans($params, $service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
   $orphan_ids_to_delete = array_slice(get_orphans(), 0, $params['block_size']);