From 309b2f4476af6fa3c8209e13906abb1e8cd1e267 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Tue, 24 Jan 2017 17:29:28 +0100
Subject: [PATCH] feature #606, check pwg_token and display error (if any)

---
 admin/themes/default/js/batchManagerGlobal.js          | 4 +++-
 admin/themes/default/template/batch_manager_global.tpl | 2 ++
 include/ws_functions/pwg.images.php                    | 5 +++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/admin/themes/default/js/batchManagerGlobal.js b/admin/themes/default/js/batchManagerGlobal.js
index f26ab11db..3e48a74f0 100644
--- a/admin/themes/default/js/batchManagerGlobal.js
+++ b/admin/themes/default/js/batchManagerGlobal.js
@@ -373,7 +373,9 @@ function delete_orphans_block(blockSize) {
         document.location = redirect_to;
       }
     },
-    error:function(XMLHttpRequest, textStatus, errorThrows) {
+    error:function(XMLHttpRequest) {
+      jQuery('#orphans_deletion').hide();
+      jQuery('#orphans_deletion_error').show().html('error '+XMLHttpRequest.status+' : '+XMLHttpRequest.statusText);
     }
   });
 }
\ No newline at end of file
diff --git a/admin/themes/default/template/batch_manager_global.tpl b/admin/themes/default/template/batch_manager_global.tpl
index 254bdf551..f66bb0546 100644
--- a/admin/themes/default/template/batch_manager_global.tpl
+++ b/admin/themes/default/template/batch_manager_global.tpl
@@ -356,6 +356,8 @@ var sliders = {
           {'orphans to delete'|translate}
         </span>
 
+        <span id="orphans_deletion_error" class="errors" style="display:none"></span>
+
         <span id="duplicates_options" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'duplicates'}display:none{/if}">
           {'based on'|translate}
           <label class="font-checkbox"><span class="icon-check"></span><input type="checkbox" name="filter_duplicates_filename" {if isset($filter.duplicates_filename)}checked="checked"{/if}> {'file name'|translate}</label>
diff --git a/include/ws_functions/pwg.images.php b/include/ws_functions/pwg.images.php
index aa9cc1189..393e42c13 100644
--- a/include/ws_functions/pwg.images.php
+++ b/include/ws_functions/pwg.images.php
@@ -1770,6 +1770,11 @@ function ws_images_checkUpload($params, $service)
  */
 function ws_images_deleteOrphans($params, $service)
 {
+  if (get_pwg_token() != $params['pwg_token'])
+  {
+    return new PwgError(403, 'Invalid security token');
+  }
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
   $orphan_ids_to_delete = array_slice(get_orphans(), 0, $params['block_size']);