Index: branches/2.8.x/CHANGELOG
===================================================================
--- branches/2.8.x/CHANGELOG	(revision 1356)
+++ branches/2.8.x/CHANGELOG	(revision 1357)
@@ -11,6 +11,9 @@
 ! = Update/Change
 
 ------------------------------------- 2.8.2 -------------------------------------
+27 Dec-2010 Build 1357 Frank Heyne (FrankH)
+# security fix: in path admin/pages/ - added FTAN check
+! had to enhance parameter for getFTAN() in framework/class.secureform.php 
 27 Dec-2010 Build 1356 Dietmar Woellbrink (Luisehahne)
 # more little fixes in settings
 ! change to RC2
Index: branches/2.8.x/wb/admin/pages/move_down.php
===================================================================
--- branches/2.8.x/wb/admin/pages/move_down.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/move_down.php	(revision 1357)
@@ -48,6 +48,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_settings');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the ordering class
 require(WB_PATH.'/framework/class.order.php');
 
Index: branches/2.8.x/wb/admin/pages/save.php
===================================================================
--- branches/2.8.x/wb/admin/pages/save.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/save.php	(revision 1357)
@@ -35,6 +35,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_modify');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Get perms
 $sql  = 'SELECT `admin_groups`,`admin_users` FROM `'.TABLE_PREFIX.'pages` ';
 $sql .= 'WHERE `page_id` = '.$page_id;
@@ -89,7 +95,8 @@
 {
 	$admin->print_error($database->get_error(), $js_back);
 } else {
-	$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id);
+	$ftan2 = $admin->getFTAN(2);
+	$admin->print_success($MESSAGE['PAGES']['SAVED'], ADMIN_URL."/pages/modify.php?page_id=$page_id&$ftan2");
 }
 
 // Print admin footer
Index: branches/2.8.x/wb/admin/pages/empty_trash.php
===================================================================
--- branches/2.8.x/wb/admin/pages/empty_trash.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/empty_trash.php	(revision 1357)
@@ -27,11 +27,17 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions.php');
 
 // Get page list from database
-$database = new database();
+//$database = new database();
 $query = "SELECT * FROM ".TABLE_PREFIX."pages WHERE visibility = 'deleted' ORDER BY level DESC";
 $get_pages = $database->query($query);
 
Index: branches/2.8.x/wb/admin/pages/settings.php
===================================================================
--- branches/2.8.x/wb/admin/pages/settings.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/settings.php	(revision 1357)
@@ -30,6 +30,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_settings');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions-utf8.php');
 
@@ -90,6 +96,7 @@
 $template = new Template(THEME_PATH.'/templates');
 $template->set_file('page', 'pages_settings.htt');
 $template->set_block('page', 'main_block', 'main');
+$template->set_var('FTAN', $admin->getFTAN());
 
 $template->set_var(array(
 				'PAGE_ID' => $results_array['page_id'],
Index: branches/2.8.x/wb/admin/pages/delete.php
===================================================================
--- branches/2.8.x/wb/admin/pages/delete.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/delete.php	(revision 1357)
@@ -44,6 +44,12 @@
 	$admin->print_error($MESSAGE['PAGES']['INSUFFICIENT_PERMISSIONS']);
 }
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Find out more about the page
 $query = "SELECT * FROM ".TABLE_PREFIX."pages WHERE page_id = '$page_id'";
 $results = $database->query($query);
Index: branches/2.8.x/wb/admin/pages/sections_save.php
===================================================================
--- branches/2.8.x/wb/admin/pages/sections_save.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/sections_save.php	(revision 1357)
@@ -46,6 +46,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_modify');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Get perms
 $database = new database();
 $results = $database->query("SELECT admin_groups,admin_users FROM ".TABLE_PREFIX."pages WHERE page_id = '$page_id'");
@@ -120,7 +126,8 @@
 if($database->is_error()) {
 	$admin->print_error($database->get_error(), ADMIN_URL.'/pages/sections.php?page_id='.$page_id);
 } else {
-	$admin->print_success($MESSAGE['PAGES']['SECTIONS_PROPERTIES_SAVED'], ADMIN_URL.'/pages/sections.php?page_id='.$page_id);
+	$ftan2 = $admin->getFTAN(2);
+	$admin->print_success($MESSAGE['PAGES']['SECTIONS_PROPERTIES_SAVED'], ADMIN_URL."/pages/sections.php?page_id=$page_id&$ftan2");
 }
 
 // Print admin footer
Index: branches/2.8.x/wb/admin/pages/index.php
===================================================================
--- branches/2.8.x/wb/admin/pages/index.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/index.php	(revision 1357)
@@ -19,6 +19,9 @@
 require('../../config.php');
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages');
+
+$ftan = $admin->getFTAN(2);
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions.php');
 // eggsurplus: add child pages for a specific page
@@ -125,7 +128,7 @@
 				</td>
 				<?php if($admin->get_permission('pages_modify') == true AND $can_modify == true) { ?>
 				<td class="list_menu_title">
-					<a href="<?php echo ADMIN_URL; ?>/pages/modify.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
+					<a href="<?php echo ADMIN_URL; ?>/pages/modify.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $TEXT['MODIFY']; ?>">
 						<?php if($page['visibility'] == 'public') { ?>
 							<img src="<?php echo THEME_URL; ?>/images/visible_16.png" alt="<?php echo $TEXT['VISIBILITY']; ?>: <?php echo $TEXT['PUBLIC']; ?>" class="page_list_rights" />
 						<?php } elseif($page['visibility'] == 'private') { ?>
@@ -176,12 +179,12 @@
 				<td class="list_actions">
 					<?php if($page['visibility'] != 'deleted') { ?>
 						<?php if($admin->get_permission('pages_settings') == true AND $can_modify == true) { ?>
-						<a href="<?php echo ADMIN_URL; ?>/pages/settings.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $TEXT['SETTINGS']; ?>">
+						<a href="<?php echo ADMIN_URL; ?>/pages/settings.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $TEXT['SETTINGS']; ?>">
 							<img src="<?php echo THEME_URL; ?>/images/modify_16.png" border="0" alt="<?php echo $TEXT['SETTINGS']; ?>" />
 						</a>
 						<?php } ?>
 					<?php } else { ?>
-						<a href="<?php echo ADMIN_URL; ?>/pages/restore.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $TEXT['RESTORE']; ?>">
+						<a href="<?php echo ADMIN_URL; ?>/pages/restore.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $TEXT['RESTORE']; ?>">
 							<img src="<?php echo THEME_URL; ?>/images/restore_16.png" border="0" alt="<?php echo $TEXT['RESTORE']; ?>" />
 						</a>
 					<?php } ?>
@@ -214,11 +217,11 @@
                         {
 							$file=$admin->page_is_active($page)?"clock_16.png":"clock_red_16.png";
 							?>
-							<a href="<?php echo ADMIN_URL; ?>/pages/sections.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $HEADING['MANAGE_SECTIONS']; ?>">
+							<a href="<?php echo ADMIN_URL; ?>/pages/sections.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $HEADING['MANAGE_SECTIONS']; ?>">
 							<img src="<?php echo THEME_URL."/images/$file"; ?>" border="0" alt="<?php echo $HEADING['MANAGE_SECTIONS']; ?>" />
 							</a>
 						<?php } else { ?>
-							<a href="<?php echo ADMIN_URL; ?>/pages/sections.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $HEADING['MANAGE_SECTIONS']; ?>">
+							<a href="<?php echo ADMIN_URL; ?>/pages/sections.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $HEADING['MANAGE_SECTIONS']; ?>">
 							<img src="<?php echo THEME_URL; ?>/images/noclock_16.png" border="0" alt="<?php echo $HEADING['MANAGE_SECTIONS']; ?>" /></a>
 						<?php } ?>
 					<?php } ?>
@@ -228,7 +231,7 @@
 				<?php if($page['position'] != 1) { ?>
 					<?php if($page['visibility'] != 'deleted') { ?>
 						<?php if($admin->get_permission('pages_settings') == true AND $can_modify == true) { ?>
-						<a href="<?php echo ADMIN_URL; ?>/pages/move_up.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
+						<a href="<?php echo ADMIN_URL; ?>/pages/move_up.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $TEXT['MOVE_UP']; ?>">
 							<img src="<?php echo THEME_URL; ?>/images/up_16.png" border="0" alt="<?php echo $TEXT['MOVE_UP']; ?>" />
 						</a>
 						<?php } ?>
@@ -239,7 +242,7 @@
 				<?php if($page['position'] != $num_pages) { ?>
 					<?php if($page['visibility'] != 'deleted') { ?>
 						<?php if($admin->get_permission('pages_settings') == true AND $can_modify == true) { ?>
-						<a href="<?php echo ADMIN_URL; ?>/pages/move_down.php?page_id=<?php echo $page['page_id']; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
+						<a href="<?php echo ADMIN_URL; ?>/pages/move_down.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>" title="<?php echo $TEXT['MOVE_DOWN']; ?>">
 							<img src="<?php echo THEME_URL; ?>/images/down_16.png" border="0" alt="<?php echo $TEXT['MOVE_DOWN']; ?>" />
 						</a>
 						<?php } ?>
@@ -248,7 +251,7 @@
 				</td>
 				<td class="list_actions">
 					<?php if($admin->get_permission('pages_delete') == true AND $can_modify == true) { ?>
-					<a href="javascript: confirm_link('<?php echo $MESSAGE['PAGES']['DELETE_CONFIRM']; ?>?', '<?php echo ADMIN_URL; ?>/pages/delete.php?page_id=<?php echo $page['page_id']; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
+					<a href="javascript: confirm_link('<?php echo $MESSAGE['PAGES']['DELETE_CONFIRM']; ?>?', '<?php echo ADMIN_URL; ?>/pages/delete.php?page_id=<?php echo $page['page_id']."&amp;$ftan"; ?>');" title="<?php echo $TEXT['DELETE']; ?>">
 						<img src="<?php echo THEME_URL; ?>/images/delete_16.png" border="0" alt="<?php echo $TEXT['DELETE']; ?>" />
 					</a>
 					<?php } ?>
@@ -301,7 +304,7 @@
 					$query_trash = $database->query("SELECT page_id FROM ".TABLE_PREFIX."pages WHERE visibility = 'deleted'");
 					if($query_trash->numRows() > 0) {
 						?>
-						<a href="<?php echo ADMIN_URL; ?>/pages/trash.php">
+						<a href="<?php echo ADMIN_URL."/pages/trash.php?$ftan"; ?>">
 						<img src="<?php echo THEME_URL; ?>/images/delete_16.png" alt="<?php echo $TEXT['PAGE_TRASH']; ?>" border="0" />
 						<?php echo $TEXT['VIEW_DELETED_PAGES']; ?></a>
 						<?php
@@ -349,6 +352,7 @@
 $template = new Template(THEME_PATH.'/templates');
 $template->set_file('page', 'pages.htt');
 $template->set_block('page', 'main_block', 'main');
+$template->set_var('FTAN', $admin->getFTAN());
 
 // Figure out if the no pages found message should be shown or not
 if($editable_pages == 0) {
Index: branches/2.8.x/wb/admin/pages/move_up.php
===================================================================
--- branches/2.8.x/wb/admin/pages/move_up.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/move_up.php	(revision 1357)
@@ -48,6 +48,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_settings');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the ordering class
 require(WB_PATH.'/framework/class.order.php');
 
Index: branches/2.8.x/wb/admin/pages/trash.php
===================================================================
--- branches/2.8.x/wb/admin/pages/trash.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/trash.php	(revision 1357)
@@ -27,6 +27,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 ?>
 <script type="text/javascript" language="javascript">
 function toggle_viewers() {
@@ -215,6 +221,7 @@
 
 // Generate pages list
 if($admin->get_permission('pages_view') == true) {
+	$ftan2 = $admin->getFTAN(2);
 	?>
 	<table cellpadding="0" cellspacing="0" width="100%" border="0">
 	<tr>
@@ -222,7 +229,7 @@
 			<h2><?php echo $HEADING['DELETED_PAGES']; ?></h2>
 		</td>
 		<td align="right">
-				<a href="<?php echo ADMIN_URL; ?>/pages/empty_trash.php">
+				<a href="<?php echo ADMIN_URL. "/pages/empty_trash.php?$ftan2"; ?>">
 				<img src="<?php echo THEME_URL; ?>/images/delete_16.png" alt="<?php echo $TEXT['PAGE_TRASH']; ?>" border="0" />
 				<?php echo $TEXT['EMPTY_TRASH']; ?></a>
 		</td>
Index: branches/2.8.x/wb/admin/pages/settings2.php
===================================================================
--- branches/2.8.x/wb/admin/pages/settings2.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/settings2.php	(revision 1357)
@@ -30,6 +30,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_settings');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['PAGES_NOT_SAVED'],'index.php');
+	exit();
+}
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions.php');
 
@@ -199,7 +205,8 @@
 $sql .= 'WHERE `page_id` = '.$page_id;
 $database->query($sql);
 
-$target_url = ADMIN_URL.'/pages/settings.php?page_id='.$page_id;
+$ftan2 = $admin->getFTAN(2);
+$target_url = ADMIN_URL."/pages/settings.php?page_id=$page_id&amp;$ftan2";
 if($database->is_error())
 {
 	$admin->print_error($database->get_error(), $target_url );
@@ -296,7 +303,8 @@
 /* END page "access file" code */
 
 $pagetree_url = ADMIN_URL.'/pages/index.php';
-$target_url = ADMIN_URL.'/pages/settings.php?page_id='.$page_id;
+$ftan2 = $admin->getFTAN(2);
+$target_url = ADMIN_URL."/pages/settings.php?page_id=$page_id&amp;$ftan2";
 // Check if there is a db error, otherwise say successful
 if($database->is_error())
 {
Index: branches/2.8.x/wb/admin/pages/restore.php
===================================================================
--- branches/2.8.x/wb/admin/pages/restore.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/restore.php	(revision 1357)
@@ -36,6 +36,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_delete');
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions.php');
 
Index: branches/2.8.x/wb/admin/pages/modify.php
===================================================================
--- branches/2.8.x/wb/admin/pages/modify.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/modify.php	(revision 1357)
@@ -24,6 +24,12 @@
 	$page_id = $_GET['page_id'];
 }
 
+if (!$admin->checkFTAN('get'))
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Create new admin object
 require('../../config.php');
 require_once(WB_PATH.'/framework/class.admin.php');
@@ -53,6 +59,7 @@
 $template = new Template(THEME_PATH.'/templates');
 $template->set_file('page', 'pages_modify.htt');
 $template->set_block('page', 'main_block', 'main');
+$template->set_var('FTAN2', $admin->getFTAN(2));
 
 $template->set_var(array(
 			'PAGE_ID' => $results_array['page_id'],
Index: branches/2.8.x/wb/admin/pages/sections.php
===================================================================
--- branches/2.8.x/wb/admin/pages/sections.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/sections.php	(revision 1357)
@@ -41,6 +41,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_modify');
 
+if (!$admin->checkFTAN('get') and !$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Check if we are supposed to add or delete a section
 if(isset($_GET['section_id']) AND is_numeric($_GET['section_id']))
 {
@@ -71,7 +77,8 @@
 		require(WB_PATH.'/framework/class.order.php');
 		$order = new order(TABLE_PREFIX.'sections', 'position', 'section_id', 'page_id');
 		$order->clean($page_id);
-		$admin->print_success($TEXT['SUCCESS'], ADMIN_URL.'/pages/sections.php?page_id='.$page_id);
+		$ftan2 = $admin->getFTAN(2);
+		$admin->print_success($TEXT['SUCCESS'], ADMIN_URL."/pages/sections.php?page_id=$page_id&amp;$ftan2");
 		$admin->print_footer();
 		exit();
 	}
@@ -172,6 +179,7 @@
 $template = new Template(THEME_PATH.'/templates');
 $template->set_file('page', 'pages_sections.htt');
 $template->set_block('page', 'main_block', 'main');
+$template->set_var('FTAN', $admin->getFTAN());
 $template->set_block('main_block', 'module_block', 'module_list');
 $template->set_block('main_block', 'section_block', 'section_list');
 $template->set_block('section_block', 'block_block', 'block_list');
@@ -201,11 +209,12 @@
 			);
 
 // Insert variables
+$ftan2 = $admin->getFTAN(2);
 $template->set_var(array(
 				'VAR_PAGE_ID' => $results_array['page_id'],
 				'VAR_PAGE_TITLE' => $results_array['page_title'],
-				'SETTINGS_LINK' => ADMIN_URL.'/pages/settings.php?page_id='.$results_array['page_id'],
-				'MODIFY_LINK' => ADMIN_URL.'/pages/modify.php?page_id='.$results_array['page_id']
+				'SETTINGS_LINK' => ADMIN_URL.'/pages/settings.php?page_id='.$results_array['page_id']."&amp;$ftan2",
+				'MODIFY_LINK' => ADMIN_URL.'/pages/modify.php?page_id='.$results_array['page_id']."&amp;$ftan2"
 				) 
 			);
 
@@ -232,11 +241,12 @@
 
 			if(SECTION_BLOCKS)
             {
-                if(defined('EDIT_ONE_SECTION') && EDIT_ONE_SECTION)
+                
+				if(defined('EDIT_ONE_SECTION') && EDIT_ONE_SECTION)
                 {
-				    $edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id.'&amp;wysiwyg='.$section['section_id'] .'">'.$module_tmp.'</a>';
+				    $edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id."&amp;$ftan2&amp;wysiwyg=".$section['section_id'] .'">'.$module_tmp.'</a>';
                 } else {
-				    $edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id.'#wb'.$section['section_id'].'">'.$module_tmp.'</a>';
+				    $edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id.'#wb'.$section['section_id'].."&amp;$ftan2"'">'.$module_tmp.'</a>';
                 }
                 $edit_page = ( trim($module_name) == '' ) ? '<span class="module_disabled">'.$section['module'].'</span>' : $edit_page;
 				$input_attribute = 'input_normal';
@@ -267,7 +277,7 @@
 					$template->parse('block_list', 'block_block', true);
 				}
 			} else {
-				$edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id.'#'.$section['section_id'].'">'.$module_tmp.'</a>';
+				$edit_page ='<a name="'.$section['section_id'].'" href="'.ADMIN_URL.'/pages/modify.php?page_id='.$page_id.'#'.$section['section_id']."&amp;$ftan2".'">'.$module_tmp.'</a>';
                 $edit_page = ( trim($module_name) == '' ) ? '<span class="module_disabled">'.$section['module'].'</span>' : $edit_page;
 				$input_attribute = 'input_small';
 				$template->set_var(array(
@@ -309,7 +319,7 @@
             {
 				$template->set_var(
 							'VAR_MOVE_UP_URL',
-							'<a href="'.ADMIN_URL.'/pages/move_up.php?page_id='.$page_id.'&amp;section_id='.$section['section_id'].'">
+							'<a href="'.ADMIN_URL.'/pages/move_up.php?page_id='.$page_id.'&amp;section_id='.$section['section_id']."&amp;$ftan2".'">
 							<img src="'.THEME_URL.'/images/up_16.png" alt="{TEXT_MOVE_UP}" />
 							</a>' );
 			} else {
@@ -321,7 +331,7 @@
 			if($section['position'] != $num_sections ) {
 				$template->set_var(
 							'VAR_MOVE_DOWN_URL',
-							'<a href="'.ADMIN_URL.'/pages/move_down.php?page_id='.$page_id.'&amp;section_id='.$section['section_id'].'">
+							'<a href="'.ADMIN_URL.'/pages/move_down.php?page_id='.$page_id.'&amp;section_id='.$section['section_id']."&amp;$ftan2".'">
 							<img src="'.THEME_URL.'/images/down_16.png" alt="{TEXT_MOVE_DOWN}" />
 							</a>' );
 			} else {
Index: branches/2.8.x/wb/admin/pages/add.php
===================================================================
--- branches/2.8.x/wb/admin/pages/add.php	(revision 1356)
+++ branches/2.8.x/wb/admin/pages/add.php	(revision 1357)
@@ -21,6 +21,12 @@
 require_once(WB_PATH.'/framework/class.admin.php');
 $admin = new admin('Pages', 'pages_add');
 
+if (!$admin->checkFTAN())
+{
+	$admin->print_error($MESSAGE['PAGES']['NOT_FOUND']);
+	exit();
+}
+
 // Include the WB functions file
 require_once(WB_PATH.'/framework/functions.php');
 
Index: branches/2.8.x/wb/framework/class.secureform.php
===================================================================
--- branches/2.8.x/wb/framework/class.secureform.php	(revision 1356)
+++ branches/2.8.x/wb/framework/class.secureform.php	(revision 1357)
@@ -68,13 +68,14 @@
 /*
  * creates Formular transactionnumbers for unique use
  * @access public
- * @param bool $asTAG: true returns a complete prepared, hidden HTML-Input-Tag (default)
- *                    false returns an array including FTAN0 and FTAN1
+ * @param bool $asTAG: 	1 returns a complete prepared, hidden HTML-Input-Tag (default)
+ * 						2 returns a key value pair (prepared as a GET parameter)
+ *                    	anything else returns an array including FTAN0 and FTAN1
  * @return mixed:      array or string
  *
  * requirements: an active session must be available
  */
-	function getFTAN( $as_tag = true)
+	function getFTAN( $as_tag = 1)
 	{
 		if( $this->_FTAN == '')
 		{
@@ -91,10 +92,11 @@
 		}
 		$ftan0 = 'a'.substr($this->_FTAN, -(10 + hexdec(substr($this->_FTAN, 1))), 10);
 		$ftan1 = 'a'.substr($this->_FTAN, hexdec(substr($this->_FTAN, -1)), 10);
-		if($as_tag == true)
-		{
+		if ($as_tag == 1) {
 			return '<input type="hidden" name="'.$ftan0.'" value="'.$ftan1.'" title="" />';
-		}else{
+		} elseif ($as_tag == 2) {
+			return "$ftan0=$ftan1";
+		} else {
 			return array('FTAN0' => $ftan0, 'FTAN1' => $ftan1);
 		}
 	}
Index: branches/2.8.x/wb/templates/wb_theme/templates/pages.htt
===================================================================
--- branches/2.8.x/wb/templates/wb_theme/templates/pages.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/wb_theme/templates/pages.htt	(revision 1357)
@@ -2,6 +2,7 @@
 <div class="{DISPLAY_ADD}">
     <h2>{HEADING_ADD_PAGE}</h2>
     <form name="add" action="add.php" method="post">
+	{FTAN}
     <table cellpadding="2" cellspacing="0" border="0" width="100%" align="center">
     <tr>
     	<td width="70" height="20">{TEXT_TITLE}:</td>
Index: branches/2.8.x/wb/templates/wb_theme/templates/pages_modify.htt
===================================================================
--- branches/2.8.x/wb/templates/wb_theme/templates/pages_modify.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/wb_theme/templates/pages_modify.htt	(revision 1357)
@@ -8,10 +8,10 @@
 		{TEXT_CURRENT_PAGE}:
 		<b>{PAGE_TITLE}</b>
 		-
-		<a href="{ADMIN_URL}/pages/settings.php?page_id={PAGE_ID}">{TEXT_CHANGE_SETTINGS}</a>
+		<a href="{ADMIN_URL}/pages/settings.php?page_id={PAGE_ID}&amp;{FTAN2}">{TEXT_CHANGE_SETTINGS}</a>
 <!-- BEGIN show_section_block -->
 		<font style="{DISPLAY_MANAGE_SECTIONS}">-</font>
-		<a href="{ADMIN_URL}/pages/sections.php?page_id={PAGE_ID}" style="{DISPLAY_MANAGE_SECTIONS}">{TEXT_MANAGE_SECTIONS}</a>
+		<a href="{ADMIN_URL}/pages/sections.php?page_id={PAGE_ID}&amp;{FTAN2}" style="{DISPLAY_MANAGE_SECTIONS}">{TEXT_MANAGE_SECTIONS}</a>
 <!-- END show_section_block -->
 		<font style="color: #999999;" class="{CLASS_DISPLAY_MODIFIED}"><br />
 <!-- BEGIN show_modify_block -->
Index: branches/2.8.x/wb/templates/wb_theme/templates/pages_sections.htt
===================================================================
--- branches/2.8.x/wb/templates/wb_theme/templates/pages_sections.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/wb_theme/templates/pages_sections.htt	(revision 1357)
@@ -16,6 +16,8 @@
         </table>
 
         <form name="section_properties" action="{ADMIN_URL}/pages/sections_save.php?page_id={VAR_PAGE_ID}" method="post">
+		{FTAN}
+		
         <table cellpadding="5" cellspacing="0" align="center" border="0" width="100%">
                 <tr class="sections_list">
                 	<td valign="middle" width="{NAME_SIZE}">{TEXT_TYPE}:</td>
@@ -85,6 +87,7 @@
 	<h2>{TEXT_ADD_SECTION}</h2>
 	<form name="add" action="{ADMIN_URL}/pages/sections.php?page_id={VAR_PAGE_ID}" method="post">
         <input type="hidden" name="page_id" value="{VAR_PAGE_ID}"  />
+		{FTAN}
     	<table cellpadding="5" cellspacing="0" border="0" align="center" width="100%">
     	<tr>
     		<td width="100%">
Index: branches/2.8.x/wb/templates/wb_theme/templates/pages_settings.htt
===================================================================
--- branches/2.8.x/wb/templates/wb_theme/templates/pages_settings.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/wb_theme/templates/pages_settings.htt	(revision 1357)
@@ -26,7 +26,7 @@
 <form name="settings" action="settings2.php" method="post">
 
 <input type="hidden" name="page_id" value="{PAGE_ID}" />
-
+{FTAN}
 <table cellpadding="2" cellspacing="0" border="0" width="100%" align="center">
 <tr>
 	<td width="100" height="20">{TEXT_PAGE_TITLE}:</td>
Index: branches/2.8.x/wb/templates/argos_theme/templates/pages.htt
===================================================================
--- branches/2.8.x/wb/templates/argos_theme/templates/pages.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/argos_theme/templates/pages.htt	(revision 1357)
@@ -4,6 +4,7 @@
 <div class="{DISPLAY_ADD}">
 <h2>{HEADING_ADD_PAGE}</h2>
 <form name="add" action="add.php" method="post">
+{FTAN}
 <table cellpadding="2" cellspacing="0" border="0" width="100%" align="center">
   <tr>
 	<td width="70" height="20">{TEXT_TITLE}:</td>
Index: branches/2.8.x/wb/templates/argos_theme/templates/pages_modify.htt
===================================================================
--- branches/2.8.x/wb/templates/argos_theme/templates/pages_modify.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/argos_theme/templates/pages_modify.htt	(revision 1357)
@@ -8,10 +8,10 @@
 		{TEXT_CURRENT_PAGE}:
 		<b>{PAGE_TITLE}</b>
 		- 
-		<a href="{ADMIN_URL}/pages/settings.php?page_id={PAGE_ID}">{TEXT_CHANGE_SETTINGS}</a>
+		<a href="{ADMIN_URL}/pages/settings.php?page_id={PAGE_ID}&amp;{FTAN2}">{TEXT_CHANGE_SETTINGS}</a>
 <!-- BEGIN show_section_block -->
 		<font style="{DISPLAY_MANAGE_SECTIONS}">-</font>
-		<a href="{ADMIN_URL}/pages/sections.php?page_id={PAGE_ID}" style="{DISPLAY_MANAGE_SECTIONS}">{TEXT_MANAGE_SECTIONS}</a>
+		<a href="{ADMIN_URL}/pages/sections.php?page_id={PAGE_ID}&amp;{FTAN2}" style="{DISPLAY_MANAGE_SECTIONS}">{TEXT_MANAGE_SECTIONS}</a>
 <!-- END show_section_block -->
 		<font style="color:#999;" class="{CLASS_DISPLAY_MODIFIED}"><br />
 <!-- BEGIN show_modify_block -->
Index: branches/2.8.x/wb/templates/argos_theme/templates/pages_sections.htt
===================================================================
--- branches/2.8.x/wb/templates/argos_theme/templates/pages_sections.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/argos_theme/templates/pages_sections.htt	(revision 1357)
@@ -14,6 +14,7 @@
 </table>
 
         <form name="section_properties" action="{ADMIN_URL}/pages/sections_save.php?page_id={VAR_PAGE_ID}" method="post">
+		{FTAN}
 		
         <table cellpadding="0" cellspacing="0" border="0" width="100%" class="img_noborder">
 			<tr class="sections_list">
@@ -81,6 +82,7 @@
 	<h2>{TEXT_ADD_SECTION}</h2>
 	<form name="add" action="{ADMIN_URL}/pages/sections.php?page_id={VAR_PAGE_ID}" method="post">
         <input type="hidden" name="page_id" value="{VAR_PAGE_ID}"  />
+		{FTAN}
     	<table cellpadding="5" cellspacing="0" border="0" align="center" width="100%">
     	<tr>
     		<td width="50%" valign="middle">
Index: branches/2.8.x/wb/templates/argos_theme/templates/pages_settings.htt
===================================================================
--- branches/2.8.x/wb/templates/argos_theme/templates/pages_settings.htt	(revision 1356)
+++ branches/2.8.x/wb/templates/argos_theme/templates/pages_settings.htt	(revision 1357)
@@ -24,6 +24,7 @@
 <form name="settings" action="settings2.php" method="post">
 
 <input type="hidden" name="page_id" value="{PAGE_ID}" />
+{FTAN}
 
 <table cellpadding="2" cellspacing="0" border="0" width="100%" align="center">
 <tr>