503] ); } /** * Add HTTP security headers for admin page */ function wp_wm_add_security_headers() { if ( is_admin() && isset($_GET["page"]) && strpos($_GET["page"], "leadlab.php") !== false ) { header("X-Frame-Options: DENY"); header("X-Content-Type-Options: nosniff"); header("X-XSS-Protection: 1; mode=block"); header("Referrer-Policy: strict-origin-when-cross-origin"); header( "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" ); } } /** * Add menu link */ function wp_wm_add_links() { if (function_exists("add_options_page")) { add_options_page( "LeadLab by wiredminds", "LeadLab by wiredminds", "manage_options", __FILE__, "wp_wm_admin" ); } } /** * Create admin page */ function wp_wm_admin() { if (!current_user_can("manage_options")) { wp_die( __( "You do not have sufficient permissions to access this page.", "wiredminds-leadlab" ) ); } $error_message = ""; $success_message = ""; if (!empty($_POST["action"])) { if ( !isset($_POST["_wpnonce"]) || !wp_verify_nonce($_POST["_wpnonce"], "wp_wm_save_settings") ) { error_log( "LeadLab Plugin: CSRF attempt detected by user ID: " . get_current_user_id() ); echo '

' . __( "Sicherheitsüberprüfung fehlgeschlagen. Bitte laden Sie die Seite neu und versuchen Sie es erneut.", "wiredminds-leadlab" ) . "

"; return; } if ($_POST["action"] == "save") { $custnum = sanitize_text_field($_POST["wp_wm_custnum"]); // Additional validation: exactly 16 alphanumeric characters (hash format) if (preg_match('/^[a-zA-Z0-9]{16}$/', $custnum)) { update_option("wp_wm_custnum", $custnum); $success_message = __( "Einstellungen erfolgreich gespeichert.", "wiredminds-leadlab" ); } else { $error_message = __( "Ungültiges Kundennummer-Format. Es müssen genau 16 alphanumerische Zeichen sein (A-Z, a-z, 0-9).", "wiredminds-leadlab" ); } $consent_value = isset($_POST["wp_wm_consent"]) && $_POST["wp_wm_consent"] == "1" ? 1 : 0; update_option("wp_wm_consent", $consent_value); } } $wp_wm_custnum = sanitize_text_field(get_option("wp_wm_custnum", "")); $wp_wm_consent = (int) get_option("wp_wm_consent", 0); ?>

' . esc_html($error_message) . "

"; } if (!empty($success_message)) { echo '

' . esc_html($success_message) . "

"; } ?>

Konfiguration