CVE-2015-10125: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-10-05T23:15Z
Repository: https://github.com/wp-plugins/wp-ultimate-csv-importer
Language: PHP
Files changed: Readme.txt, includes/WPImporter_includes_helper.php, js/ultimate-importer-free.js, lib/jquery-plugins/UploadHandler.php, modules/comments/templates/index.php, modules/custompost/templates/index.php, modules/eshop/templates/index.php, modules/page/templates/index.php, modules/post/templates/index.php, modules/settings/templates/index.php, modules/users/templates/index.php, templates/import.php, templates/layout.php, templates/menu.php, templates/readfile.php, templates/versioncheck.php
Commit date: 2015-05-05 13:28:09 +0000
Commit message: Version 3.7.3 for Vulnarablility fix

git-svn-id: https://plugins.svn.wordpress.org/wp-ultimate-csv-importer/trunk@1153788 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/Readme.txt b/Readme.txt
index 3fd74c8..bde17c5 100644
--- a/Readme.txt
+++ b/Readme.txt
@@ -1,22 +1,22 @@
-=== Import a CSV with Ultimate CSV Importer ===
+=== Import CSV made simple with Ultimate CSV Importer ===
 Contributors: smackcoders
 Donate link: http://www.smackcoders.com/donate.html
 Tags: wp all import, batch, csv, excel, import, spreadsheet, autoblog, Autoblogger, csvimporter, data, dataimport, importer, wpcsvimporter, wpimporter, acf, auto blog, csv import, csv to post, data import, Easy CSV Importer, eci, import plugin, admin, user, users, Advanced CSV Import, Advanced CSV Importer, affiliate, amazon, author, automatic, blog, bulk, bulk edit, bulk editor, categories, comments, content, csv file, csv format, csv importer, custom post, e-commerce, free, images, language, manage, media, meta, multisite, News, page, photos, pictures, plugin, Post, seo, shop, shortcode, tags, Taxonomy, text, title, video, eshop, woocommerce, wordpress, xml, youtube, export
 Requires at least: 4.1
 Tested up to: 4.2.1
-Stable tag: 3.7.2
-Version: 3.7.2
+Stable tag: 3.7.3
+Version: 3.7.3
 Author: smackcoders
 Author URI: http://profiles.wordpress.org/smackcoders/
 
 License: GPLv2 or later
 
-Import a CSV with Ultimate CSV Importer as posts, pages, eshop products, custom posts with custom fields in few simple clicks 
+Import CSV made simple with Ultimate CSV Importer to import/export posts, pages, eshop products, custom posts with custom fields in few simple clicks 
 
 == Description ==
-Import a CSV as wordpress posts made very simple and easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.2 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
+Import CSV data to wordpress is made very easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.3 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
 
 ** New Features of Wordpress Ultimate CSV Importer Pro V4.0 **
 
 * Added common module for all features.
 * Static/Dynamic/Formula content feature.
@@ -29,11 +29,11 @@ Import a CSV as wordpress posts made very simple and easy even for novice users
 * Summarize view,Security fix and Migrations are added.
 * ACF Pro support for all available fields.
 * Mapping template feature with edit option.
 * Auto mapping and specific column update in Update feature.
 
-** Now stable version 3.7.2 available to download with hot linked featured image fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
+** Now stable version 3.7.3 available to download with security issue fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
 
 WP Ultimate CSV Importer Plugin proven much effective advanced CSV File Importer With Ultimate User Friendly Features. It is much easy now even for newbies to import csv file exported from any tool, app or software. Import as any wordpress post type and associated fields by simple mapping feature. Now import any CSV file as thousands of post, page and custom post types. This is admin side free plugin helps you in bulk edit, create and import posts type for your blog or site. 
 
 = Video Walkthrough =
 
@@ -195,10 +195,13 @@ This will solve your issue or get support from hosting if you dint have sufficie
 [CSV File and Format Related](http://wiki.smackcoders.com/WP_Ultimate_CSV_Importer_FAQ#CSV_File_and_Format_Related)
 
 
 == Changelog ==
 
+= 3.7.3 =
+*Fixed: Vulnarablility security issue fix. 
+
 = 3.7.2 =
 * Added: wordpress 4.2 and 4.2.1 compatibility.
 * Fixed: Blank page conflict issue 
 
 = 3.7.1 = 
@@ -440,10 +443,13 @@ This will solve your issue or get support from hosting if you dint have sufficie
 
 
 
 == Upgrade Notice ==
 
+= 3.7.3 =
+* Upgrade now for Vulnarability fix.
+
 = 3.7.2 =
 * Important Upgrade for wordpress 4.2 and above
 
 = 3.7.1 = 
 * Upgrade now for security fix.
diff --git a/includes/WPImporter_includes_helper.php b/includes/WPImporter_includes_helper.php
index e747e91..2aa9db8 100644
--- a/includes/WPImporter_includes_helper.php
+++ b/includes/WPImporter_includes_helper.php
@@ -1130,10 +1130,14 @@ class WPImporter_includes_helper {
 			</span>
 			</a>
 			</span>';
 		return $smackhelpnotes;
 	}
+	function create_nonce_key(){
+		return wp_create_nonce('smack_nonce');
+	}
+        
 }
 
 class CallWPImporterObj extends WPImporter_includes_helper
 {
 	private static $_instance = null;
diff --git a/js/ultimate-importer-free.js b/js/ultimate-importer-free.js
index 1bf264d..163eaf6 100644
--- a/js/ultimate-importer-free.js
+++ b/js/ultimate-importer-free.js
@@ -5,14 +5,10 @@ jQuery( document ).ready(function() {
                 var get_log = document.getElementById('log').innerHTML;
                    if (!jQuery.trim(jQuery('#log').html()).length) {      
                   document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
                 }
        
-//pieStats();
-//lineStats();
-
-
  }
  if (checkmodule == 'custompost') {
 		    var step = jQuery('#stepstatus').val();
 		    if (step == 'mapping_settings') {
 			    var cust_post_list_count = jQuery('#cust_post_list_count').val();
@@ -20,11 +16,13 @@ jQuery( document ).ready(function() {
 				    document.getElementById('cust_post_empty').style.display = '';
 		    }
 	    }
  if (checkmodule != 'filemanager' && checkmodule != 'settings' && checkmodule !='support' && checkmodule !='export') {
 	 var checkfile = jQuery('#checkfile').val();
+	 var dir_path = jQuery('#dirpathval').val();
 	 var uploadedFile = jQuery('#uploadedFile').val();
+	 var noncekey = jQuery('#nonceKey').val();
 	 var select_delimeter = jQuery('#select_delim').val();
 	 var select_delim = jQuery('#select_delim').val();
 	 var get_log = jQuery('#log').val();
 	 var checkmodule = jQuery('#checkmodule').val();
 	 if (!jQuery.trim(jQuery('#log').html()).length) {
@@ -37,12 +35,12 @@ jQuery( document ).ready(function() {
 	 } */
 	 if (select_delimeter != '') {
 		 select_delim = select_delimeter;
 	 }
 	 if(uploadedFile != '' && select_delim != '') { 
-		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule;
 		 var tmpLoc = jQuery('#tmpLoc').val();
+		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule+'&temloc=' + tmpLoc+'&dir_path=' + dir_path + '&wpnonce=' + noncekey;
 		 if(tmpLoc != '' && tmpLoc != null) {
 			jQuery.ajax({
 				url: tmpLoc + 'templates/readfile.php',
 				type: 'post',
 				data: doaction,
@@ -68,10 +66,12 @@ document.getElementById('sec-two').style.display='';
 }
 }
 
 function gotoelement(id) {
     var gotoElement = document.getElementById('current_record').value;
+    var dir_path = jQuery('#dirpathval').val();
+    var noncekey = document.getElementById('nonceKey').value;
     var no_of_records = document.getElementById('totRecords').value;
     var uploadedFile = document.getElementById('uploadedFile').value;
     var delim = document.getElementById('select_delimeter').value;
     var checkmodule = jQuery('#checkmodule').val();
     if (id == 'prev_record') {
@@ -101,11 +101,11 @@ function gotoelement(id) {
             gotoElement = parseInt(no_of_records) - 1;
             showMapMessages('error', 'CSV file have only ' + no_of_records + ' records.');
             return false;
         }
     }
-    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule;
+    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule+ '&dir_path=' + dir_path + '&wpnonce=' + noncekey;
     var tmpLoc = document.getElementById('tmpLoc').value;
     jQuery.ajax({
         url: tmpLoc + 'templates/readfile.php',
         type: 'post',
         data: doaction,
@@ -529,11 +529,12 @@ function enableinlineimageoption() {
 	}
 }
 
 function importRecordsbySettings(siteurl)
 {
-        var importlimit = document.getElementById('importlimit').value; 
+        var importlimit = document.getElementById('importlimit').value;
+	var noncekey = document.getElementById('wpnoncekey').value; 
         var get_requested_count = importlimit; 
         var tot_no_of_records = document.getElementById('checktotal').value;
         var importas = document.getElementById('selectedImporter').value;
         var uploadedFile = document.getElementById('checkfile').value;
        // var no_of_columns = document.getElementById('h2').value;
@@ -585,11 +586,11 @@ function importRecordsbySettings(siteurl)
 	}
 	var advancemedia = "";
 	if(importas == 'post' || importas == 'page' || importas == 'custompost' || importas == 'eshop')
 	advancemedia = document.getElementById('advance_media_handling').checked;
 	var postdata = new Array();
-	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,}
+	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,'wpnonce':noncekey}
 
         var tmpLoc = document.getElementById('tmpLoc').value;
 	jQuery.ajax({
 		type: 'POST',
 		url: ajaxurl,
@@ -978,10 +979,13 @@ function addexportfilter(id) {
 		else if(id == 'getdatabyspecificauthors') {
 			document.getElementById('specificauthorexport').style.display = '';
 			document.getElementById('authors').style.display = '';
 			document.getElementById('postauthor').style.display = '';
 		}
+		else if(id == 'getdatawithdelimeter'){
+			document.getElementById('delimeter').style.display = '';			
+		}
 	} else if (document.getElementById(id).checked == false) {
                 if(id == 'getdataforspecificperiod') {
 			document.getElementById('specificperiodexport').style.display = 'none';
 			document.getElementById('periodstartfrom').style.display = 'none';
 			document.getElementById('postdatefrom').style.display = 'none';
@@ -996,10 +1000,13 @@ function addexportfilter(id) {
                 else if(id == 'getdatabyspecificauthors') {
 			document.getElementById('specificauthorexport').style.display = 'none';
                         document.getElementById('authors').style.display = 'none';
                         document.getElementById('postauthor').style.display = 'none';
                 }
+		else if(id == 'getdatawithdelimeter'){
+                        document.getElementById('delimeter').style.display = 'none';
+                }
 	}
 }
 
 //Settings js code
 function showsettingsoption(id) {
diff --git a/js/ultimate-importer-pro.js b/js/ultimate-importer-pro.js
deleted file mode 100644
index bf2c84d..0000000
--- a/js/ultimate-importer-pro.js
+++ /dev/null
@@ -1,770 +0,0 @@
-jQuery( document ).ready(function() {
-      jQuery('.dropdown-toggle').dropdown('toggle');
-   var checkmodule = document.getElementById('checkmodule').value;
-        if(checkmodule != 'dashboard' && checkmodule != 'filemanager') {
-                var get_log = document.getElementById('log').innerHTML;
-                   if (!jQuery.trim(jQuery('#log').html()).length) {      
-                  document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
-                }
-       
-pieStats();
-lineStats();
-
-
- }
-if(checkmodule=='custompost')
-{
-	var step = document.getElementById('stepstatus').value;
-        if(step == 'mapping_settings') {
-        var cust_post_list_count = document.getElementById('cust_post_list_count').value;
-        if(cust_post_list_count=='0')
-        document.getElementById('cust_post_empty').style.display='';
-	}
-}	
-var checkfile = document.getElementById('checkfile').value;
-var uploadedFile = document.getElementById('uploadedFile').value;
-var select_delimeter=document.getElementById('select_delim').value;
-var select_delim=document.getElementById('select_delim').value;
-var get_log = document.getElementById('log').innerHTML; 
-if (!jQuery.trim(jQuery('#log').html()).length) {	
-document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
-}
-	if(checkfile != ''){
-		uploadedFile = checkfile;
-	}
-	if(select_delimeter!='')
-	{
-	select_delim=select_delimeter;
-	}
-        var doaction = 'record_no=1&file_name='+uploadedFile+'&selected_delimeter='+select_delim;
-        var tmpLoc = document.getElementById('tmpLoc').value;
-                jQuery.ajax({
-                        url: tmpLoc+'templates/readfile.php',
-                        type: 'post',
-                        data: doaction,
-                        dataType: 'json',
-                        success: function(response){ 
-                                var totalLength = response.length;
-				var setHeight = (parseInt(totalLength)*30)+250;
-				//document.getElementById('sec-two').style.height = setHeight+'px';
-                        }
-                });
-});
-function goto_mapping(id){
-if(id == 'importfile'){
-var currentURL = document.URL; 
-var go_to_url = currentURL.replace("uploadfile","mapping_settings");
-window.location.assign(go_to_url);
-document.getElementById('sec-one').style.display='none';
-document.getElementById('sec-two').style.display='';
-}
-}
-
-function gotoelement(id) {
-    var gotoElement = document.getElementById('current_record').value;
-    var no_of_records = document.getElementById('totRecords').value;
-    var uploadedFile = document.getElementById('uploadedFile').value;
-    var delim = document.getElementById('select_delimeter').value;
-    if (id == 'prev_record') {
-        gotoElement = parseInt(gotoElement) - 1;
-    }
-    if (id == 'next_record') {
-        gotoElement = parseInt(gotoElement) + 1;
-    }
-    if (gotoElement <= 0) {
-        gotoElement = 0;
-    }
-    if (gotoElement >= no_of_records) {
-        gotoElement = parseInt(no_of_records) - 1;
-    }
-    if (id == 'apply_element') {
-        gotoElement = parseInt(document.getElementById('goto_element').value);
-        if (isNaN(gotoElement)) {
-            showMapMessages('error', ' Please provide valid record number.');
-        }
-        if (gotoElement <= 0) {
-            gotoElement = 0;
-            showMapMessages('error', ' Please provide valid record number.');
-        } else {
-            gotoElement = gotoElement - 1;
-        }
-        if (gotoElement >= no_of_records) {
-            gotoElement = parseInt(no_of_records) - 1;
-            showMapMessages('error', 'CSV file have only ' + no_of_records + ' records.');
-            return false;
-        }
-    }
-    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim;
-    var tmpLoc = document.getElementById('tmpLoc').value;
-    jQuery.ajax({
-        url: tmpLoc + 'templates/readfile.php',
-        type: 'post',
-        data: doaction,
-        dataType: 'json',
-        success: function (response) {
-            var totalLength = response.length;
-            for (var i = 0; i < totalLength; i++) {
-                if ((response[i].length) > 32) {
-                    document.getElementById('elementVal_' + i).innerHTML = response[i].substring(0, 28) + '...';
-                } else {
-                    document.getElementById('elementVal_' + i).innerHTML = response[i];
-                }
-            }
-        var displayRecCount = gotoElement + 1;
-            document.getElementById('preview_of_row').innerHTML = "Showing preview of row #" + displayRecCount;
-            document.getElementById('current_record').value = gotoElement;
-        }
-    });
-}
-
-function showtemplatediv_wpuci(checked, div)
-{
-	if(checked)
-		jQuery('#'+div).show();
-	else
-		jQuery('#'+div).hide();
-}
-
-function showtemplatediv_edit(checked, value)
-{
-	if(value == 'saveas')
-		jQuery('#showtemplate_edit_div').show();
-	else
-		jQuery('#showtemplate_edit_div').hide();
-}
-
-
-function selectpoststatus()
-{
-	var ps = document.getElementById("importallwithps");
-	var selectedpsindex = ps.options[ps.selectedIndex].value;
-	if(selectedpsindex == 3){
-		document.getElementById('globalpassword_label').style.display = "block";
-		document.getElementById('globalpassword_text').style.display = "block";
-	}
-	else{
-                document.getElementById('globalpassword_label').style.display = "none";
-                document.getElementById('globalpassword_text').style.display = "none";
-	}
-	var totdropdown= document.getElementById('h2').value;
-	var total = parseInt(totdropdown);
-	if(selectedpsindex=='0')
-	{
-
-		for(var i=0;i < total;i++)
-		{
-
-			dropdown = document.getElementById("mapping"+i);
-			var option=document.createElement('option');
-			option.text="post_status";
-			dropdown.add(option);
-
-		}
-
-	}
-	else {
-		for(var i=0;i < total;i++)
-		{
-
-			dropdown = document.getElementById("mapping"+i);
-
-			var totarr = dropdown.options.length;
-
-			for(var j=0;j<totarr;j++)
-			{
-
-				if(dropdown.options[j].value=='post_status')
-				{
-
-					dropdown.options.remove(j);
-					totarr--;
-				}
-			}
-
-		}
-	}
-}
-
-
-
-// Function for add customfield
-
-function addcustomfield(myval, selected_id) { 
-    var a = document.getElementById('h1').value;
-    var importer = document.getElementById('selectedImporter').value;
-    var aa = document.getElementById('h2').value;
-    var selected_dropdown = document.getElementById('mapping' + selected_id);
-    var selected_value = selected_dropdown.value; 
-    var prevoptionindex = document.getElementById('prevoptionindex').value;
-    var prevoptionvalue = document.getElementById('prevoptionvalue').value;
-    var mappedID = 'mapping' + selected_id;
-    var add_prev_option = false;
-    if(mappedID == prevoptionindex){
-	    add_prev_option = true;	
-    }
-    for (var i = 0; i < aa; i++) {
-	    var b = document.getElementById('mapping' + i).value; 
-	    var id = 'mapping' + i;
-	    if(add_prev_option){
-		    if(i != selected_id){	
-			    jQuery('#'+id).append( new Option(prevoptionvalue,prevoptionvalue) );
-		    }
-	    }
-	    if(i != selected_id){
-		    var x=document.getElementById('mapping' + i);
-		    jQuery('#'+id+' option[value="'+selected_value+'"]').remove();
-	    }
-	    if (b == 'add_custom' + i) {
-		    document.getElementById('textbox' + i).style.display = "";
-		    document.getElementById('customspan' + i).style.display = "";
-	    }
-	    else {
-		    document.getElementById('textbox' + i).style.display = "none";
-		    document.getElementById('customspan' + i).style.display = "none";
-	    }
-    }
-    document.getElementById('prevoptionindex').value = 'mapping' + selected_id;
-    var customField = selected_value.indexOf("add_custom");
-    if(selected_value != '-- Select --' && customField != 0){
-	    document.getElementById('prevoptionvalue').value = selected_value;
-    }
-}
-
-
-function clearMapping()
-{
-	var total_mfields = document.getElementById('h2').value; 
-	var mfields_arr = document.getElementById('mapping_fields_array').value;
-	var n=mfields_arr.split(",");
-	var options = '<option id="select">-- Select --</option>';
-	for(var i=0;i<n.length;i++){
-		options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
-	}
-	for(var j=0;j<total_mfields;j++){
-		document.getElementById('mapping'+j).innerHTML = options;
-		document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
-		document.getElementById('textbox'+j).style.display = 'none';
-		document.getElementById('customspan'+j).style.display = 'none';
-	}	
-}
-
-function clearmapping()
-{
-        var total_mfields = document.getElementById('h2').value;
-        var mfields_arr = document.getElementById('mapping_fields_array').value;
-        var n=mfields_arr.split(",");
-        var options = "<option id='select'>-- Select --</option>";
-        for(var i=0;i<n.length;i++){
-                options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
-        }
-        for(var j=0;j<total_mfields;j++){
-                document.getElementById('mapping'+j).innerHTML = options;
-                //document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
-                document.getElementById('textbox'+j).style.display = 'none';
-                document.getElementById('customspan'+j).style.display = 'none';
-        }
-}
-
-function shownotification(msg, alerts)
-{
-        var newclass;
-        var divid = "notification_wp_csv";
-
-        if(alerts == 'success')
-                newclass = "alert alert-success";
-        else if(alerts == 'danger')
-                newclass = "alert alert-danger";
-        else if(alerts == 'warning')
-                newclass = "alert alert-warning";
-        else
-                newclass = "alert alert-info";
-
-        jQuery('#'+divid).removeClass()
-        jQuery('#'+divid).html(msg);
-        jQuery('#'+divid).addClass(newclass);
-        // Scroll
-        jQuery('html,body').animate({
-                scrollTop: jQuery("#"+divid).offset().top},
-        'slow'); 
-}
-
-function import_csv() 
-{
-	// code added by goku to check whether templatename
-	var mapping_checked = jQuery('#mapping_templatename_checked').is(':checked');
-	var mapping_tempname = jQuery('#mapping_templatename').val();
-	var mapping_checked_radio = jQuery('input[name=tempaction]:radio:checked').val();
-	if(mapping_checked || mapping_checked_radio == 'saveas')	
-	{
-		if(mapping_checked_radio == 'saveas')
-			mapping_tempname = jQuery('#mapping_templatename_edit').val();
-
-		if(jQuery.trim(mapping_tempname) == '')	
-		{
-			alert('Template name is empty');
-			return false;
-		}
-		else
-		{
-			// check templatename already exists
-			jQuery.ajax({
-		                type: 'POST',
-                		url: ajaxurl,
-				async: false,
-		                data: {
-                		    'action'       : 'checktemplatename',
-		                    'templatename' : mapping_tempname,
-		                },
-                		success:function(data) 
-				{
-					if(data != 0)
-					{
-						jQuery('#mapping_templatename').val('');
-					}
-        	        	},
-		                error: function(errorThrown){
-        	        	        console.log(errorThrown);
-        		        }
-		        });		
-		}
-	}
-	var mapping_tempname = jQuery('#mapping_templatename').val();
-	if(mapping_checked_radio == 'saveas')
-        	//mapping_tempname = jQuery('#mapping_templatename_edit').val();
-
-	if(mapping_tempname == '' && (mapping_checked || mapping_templatename_edit == 'saveas'))
-	{
-		alert('Template Name already exists');return false;
-	}
-	// code ends here on checking templatename
-
-    var importer = document.getElementById('selectedImporter').value;
-    var header_count = document.getElementById('h2').value;
-    var array = new Array();
-    var val1, val2, val3, val4, val5, val6, val7, error_msg, chk_status_in_csv, post_status_msg;
-    val1 = val2 = val3 = val4 = val5 = val6 = val7 = post_status_msg = post_type = 'Off';
-    for (var i = 0; i < header_count; i++) {
-        var e = document.getElementById("mapping" + i);
-        var value = e.options[e.selectedIndex].value;
-        array[i] = value;
-    }
-//alert(array.length);
-    if (importer == 'post' || importer == 'page' || importer == 'custompost') { 
-	if(importer == 'custompost') {
-        	var getSelectedIndex = document.getElementById('custompostlist');
-	        var SelectedIndex = getSelectedIndex.value;
-			//var t=getSelectedIndex.options[getSelectedIndex.selectedIndex];
-			if( SelectedIndex != 'select')
-			post_type='On';
-			//alert(t+'---'+SelectedIndex);
-	}
-
-        chk_status_in_csv = document.getElementById('importallwithps').value;
-        if (chk_status_in_csv != 0)
-            post_status_msg = 'On';
-
-        for (var j = 0; j < array.length; j++) {
-            if (array[j] == 'post_title') {
-                val1 = 'On';
-            }
-            if (array[j] == 'post_content') {
-                val2 = 'On';
-            }
-            if (post_status_msg == 'Off') {
-                if (array[j] == 'post_status')
-                    post_status_msg = 'On';
-            }
-        }
-        if (importer != 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On') {
-		return true;
-        }
-	else if (importer == 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On' && post_type=='On') {
-                return true;
-        }
-        else {
-            error_msg = '';
-            if (val1 == 'Off')
-                error_msg += " post_title,";
-            if (val2 == 'Off')
-                error_msg += " post_content,";
-	    if(importer == 'custompost') {
-	            if (SelectedIndex == 'select')
-        	        error_msg += " post_type,";
-	    }
-            if (post_status_msg == 'Off')
-                error_msg += " post_status";
-            showMapMessages('error', 'Error: ' + error_msg + ' - Mandatory fields. Please map the fields to proceed.');
-            return false;
-        }
-    }
-
-// validation starts
-else if(importer == 'comments'){
-        //var getSelectedIndex1 = document.getElementById('selectPosts');
-        //var SelectedIndex1 = getSelectedIndex1.options[getSelectedIndex1.selectedIndex].text;
-                for(var j=0;j<array.length;j++){
-                        if(array[j] == 'comment_author'){
-                                val1 = 'On';
-                        }
-                        if(array[j] == 'comment_author_email'){
-                                val2 = 'On';
-                        }
-                        if(array[j] == 'comment_content'){
-                                val3 = 'On';
-                        }
-			if(array[j] == 'comment_post_ID'){
-                                val4 = 'On';
-                        }
-
-
-                }
-                if(val1 == 'On' && val2 == 'On' && val3 == 'On' && val4 == 'On') {
-                 return true;
-                }
-                else{
-                 showMapMessages('error',' "Post Id", "Comment Author", "Comment Author Email" and "Comment Content" should be mapped.');
-                 return false;
-                }
-
-	
-		showMapMessages('error',header_count);return false;
-	}
-	else if(importer == 'users'){
-		//var getSelectedIndex = document.getElementById('userrole');
-		//var SelectedIndex = getSelectedIndex.options[getSelectedIndex.selectedIndex].text;
-		for(var j=0;j<array.length;j++){
-			if(array[j] == 'user_login'){
-				val1 = 'On';	
-			}
-			if(array[j] == 'user_email'){
-				val2 = 'On';
-			}
-			if(array[j] == 'role'){
-				val3 = 'On';
-			}
-		}
-		if(val1 == 'On' && val2 == 'On' && val3 == 'On') {
-	   	 return true;
-		}
-		else{
-		 showMapMessages('error','"role", "user_login" and "user_email" should be mapped.');
-		 return false;
-		}
-	}
-// validation ends
-}
-
-
-function showMapMessages(alerttype, msg) {
-    jQuery("#showMsg").addClass("maperror");
-    document.getElementById('showMsg').innerHTML = msg;
-    document.getElementById('showMsg').className += ' ' + alerttype;
-    document.getElementById('showMsg').style.display = '';
-    jQuery("#showMsg").fadeOut(10000);
-}
-
-function importRecordsbySettings(siteurl)
-{
-        var importlimit = document.getElementById('importlimit').value; 
-        var get_requested_count = importlimit; 
-        var tot_no_of_records = document.getElementById('checktotal').value;
-        var importas = document.getElementById('selectedImporter').value;
-        var uploadedFile = document.getElementById('checkfile').value;
-       // var no_of_columns = document.getElementById('h2').value;
-        var step = document.getElementById('stepstatus').value;
-        var mappingArr = document.getElementById('mappingArr').value;
-	var dupContent = document.getElementById('duplicatecontent').checked;
-	var dupTitle = document.getElementById('duplicatetitle').checked;
-	var currentlimit = document.getElementById('currentlimit').value;
-	var tmpCnt = document.getElementById('tmpcount').value;
-	var no_of_tot_records = document.getElementById('tot_records').value;
-        var get_log = document.getElementById('log').innerHTML;
-         document.getElementById('reportLog').style.display = '';
-         document.getElementById('terminatenow').style.display = '';
-        if(get_requested_count != '') {
-                //return true;
-        } else {
-                 document.getElementById('showMsg').style.display = "";
-                 document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';			jQuery("#showMsg").fadeOut(10000);
-                 return false;
-        }
-	if(parseInt(get_requested_count) <= parseInt(no_of_tot_records)) {
-                document.getElementById('server_request_warning').style.display = 'none';
-        } else {
-                document.getElementById('server_request_warning').style.display = '';
-                return false;
-        }
-	if(get_log == '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>'){
-		document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">Your Import Is In Progress...</p>';
-		document.getElementById('startbutton').disabled = true;
-	}
-	document.getElementById('ajaxloader').style.display="";
-        var tempCount = parseInt(tmpCnt);
-        var totalCount = parseInt(tot_no_of_records);
-        if(tempCount>totalCount){
-		document.getElementById('ajaxloader').style.display="none";
-		document.getElementById('startbutton').style.display="none";
-		document.getElementById('importagain').style.display="";
-                document.getElementById('terminatenow').style.display = "none";
-		return false;
-	}
-
-	var postdata = new Array();
-	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,}
-
-        var tmpLoc = document.getElementById('tmpLoc').value;
-	jQuery.ajax({
-		type: 'POST',
-		url: ajaxurl,
-		data: {
-		    'action'   : 'importByRequest',
-		    'postdata' : postdata,
-		    'siteurl'  : siteurl,
-		},
-		success:function(data) {
-                        if(parseInt(tmpCnt) == parseInt(tot_no_of_records)){
-                                document.getElementById('terminatenow').style.display = "none";
-                        } 
-        	        if(parseInt(tmpCnt) < parseInt(tot_no_of_records)){
-				var terminate_action = document.getElementById('terminateaction').value;
-				if(terminate_action == 'continue'){
-					currentlimit = parseInt(currentlimit)+parseInt(importlimit);
-					document.getElementById('currentlimit').value = currentlimit;
-					console.log('impLmt: '+importlimit+'totRecds: '+tot_no_of_records);
-					document.getElementById('tmpcount').value = parseInt(tmpCnt)+parseInt(importlimit);
-					setTimeout(function(){importRecordsbySettings()},0);
-				} else {
-					document.getElementById('log').innerHTML += "Import process has been terminated.</br>";
-					return false;
-				}
-	                }else{
-				document.getElementById('ajaxloader').style.display="none";
-		                document.getElementById('startbutton').style.display="none";
-		                document.getElementById('importagain').style.display="";
-        	                return false;
-	                }
-			document.getElementById('log').innerHTML += data+'<br/>';
-				
-		},
-		error: function(errorThrown){
-			console.log(errorThrown);
-		}
-	});
-}
-
-// Terminate import process
-function terminateProcess(){
-	document.getElementById('terminateaction').value = 'terminate';
-}
-
-
-// Enable/Disable WP-e-Commerce Custom Fields
-function enablewpcustomfield(val){
-	if(val == 'wpcustomfields'){
-		document.getElementById('wpcustomfieldstr').style.display = '';
-	}
-	else{
-		document.getElementById('wpcustomfields').checked = false;
-		document.getElementById('wpcustomfieldstr').style.display = 'none';
-	}
-}
-
-function saveSettings(){ //alert('dd');
-//document.getElementById('ShowMsg').style.display = '';
-jQuery(document).ready( function() {
-        jQuery('#ShowMsg').delay(2000).fadeOut();
-      });
-}
-
-function Reload(){
-window.location.reload();
-}
-
-function  check_if_avail(val){
-	var proModule = new Array();
-	proModule[0] = 'categories';
-	proModule[1] = 'customtaxonomy';
-	proModule[2] = 'eshop';
-	proModule[3] = 'marketpress';
-	proModule[4] = 'woocommerce';
-	proModule[5] = 'wpcommerce';
-	proModule[6] = 'cctm';
-	proModule[7] = 'types';
-	proModule[8] = 'acf';
-	proModule[9] = 'Customerreviews';
-	proModule[10] = 'WP-Members';
-	proModule[11] = 'yoastseo';
-	proModule[12] = 'caticonenable';
-	proModule[13] = 'custompostuitype';
-	proModule[14] = 'wpcustomfields';
-	proModule[15] = 'recommerce';
-	proModule[16] = 'automapping';
-	proModule[17] = 'utfsupport';
-        
-	
-	var warning_name = new Array();
-	warning_name['categories'] = 'Categories/Tags';
-	warning_name['customtaxonomy'] = 'Custom Taxonomy';
-	warning_name['eshop'] = 'Eshop';
-	warning_name['marketpress'] = 'Market Press Lite';
-	warning_name['woocommerce'] = 'WooCommerce';
-	warning_name['wpcommerce'] = 'WP e-Commerce';
-	warning_name['cctm'] = 'CCTM';
-	warning_name['types'] = 'Types';
-	warning_name['acf'] = 'ACF';
-	warning_name['Customerreviews'] = 'Customer Reviews';
-	warning_name['WP-Members'] = 'WP-Members';
-	warning_name['aioseo'] = 'All-in-SEO';
-	warning_name['yoastseo'] = 'Yoast SEO';
-	warning_name['caticonenable'] = 'Category Icons';
-	warning_name['custompostuitype'] = 'Custom Post Type UI';
-	warning_name['automapping'] = 'Auto Mapping';
-	warning_name['utfsupport'] = 'UTF Support';
-
-	var result = inArray(val, proModule);
-	if(result == true){
-
-		if(val == 'eshop' || val == 'wpcustomfields' || val == 'wpcommerce' || val == 'woocommerce' || val == 'marketpress'){
-			if(val == 'wpcommerce' || val == 'wpcustomfields') {
-				document.getElementById('wpcustomfieldstr').style.display = '';
-			} else {
-				document.getElementById('wpcustomfieldstr').style.display = '';
-			}
-			//			document.getElementById('wpcustomfieldstr').style.display = 'none';
-			document.getElementById('nonerecommerce').checked = true;
-		}
-		if(val == 'cctm' || val == 'acf'){
-			document.getElementById('nonercustompost').checked = true;
-		}
-		if(val == 'aioseo' || val == 'yoastseo'){
-			document.getElementById('nonerseooption').checked = true;
-		}
-		if(val == 'caticonenable'){
-			document.getElementById('caticondisable').checked = true;
-		}
-		document.getElementById(val).checked = false;
-		document.getElementById('ShowMsg').style.display = "";
-		document.getElementById('warning-msg').innerHTML = warning_name[val]+' feature is available only for PRO!.';
-		jQuery('#ShowMsg').delay(7000).fadeOut();
-	}
-}
-
-function inArray(needle, haystack) {
-    var length = haystack.length;
-    for(var i = 0; i < length; i++) {
-        if(typeof haystack[i] == 'object') {
-            if(arrayCompare(haystack[i], needle)) {
-		 return true;
-	    }
-        } else {
-            if(haystack[i] == needle) {
-		 return true;
-	    }
-        }
-    }
-    return false;
-}
-
-function import_again(){
-	var get_current_url = document.getElementById('current_url').value;
-	window.location.assign(get_current_url);
-}
-function sendemail2smackers(){
-//	var useremail = document.getElementById('usermailid').value;
-	var message_content = document.getElementById('message').value;
-	var firstname = document.getElementById('firstname').value;
-	var lastname = document.getElementById('lastname').value;
-	if(message_content != '' && firstname != '' && lastname != '')
-		return true;
-	else
-		document.getElementById('showMsg').style.display = '';
-		document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';
-		jQuery("#showMsg").fadeOut(10000);
-		return false;
-}
-
-
-function check_allnumeric(inputtxt)  
-{  
-	var numbers = /^[0-9]+$/;  
-	if(inputtxt.match(numbers))  
-	{  
-		return true;
-	}  
-	else  
-	{  
-		if(inputtxt == '')
-			alert('Fill all mandatory fields.');
-		else
-			alert('Please enter numeric characters only');  
-		return false;  
-	}  
-}
-
-function gotoback() {
-	var currentURL = document.getElementById('current_url').value;
-	var set_assigned_step = currentURL.replace("uploadfile","mapping_settings");
-//	window.location.assign(set_assigned_step);
-}
-function export_module(){
-        var get_selected_module = document.getElementsByName('export');
-//      alert(get_selected_module);
-        for (var i = 0, length = get_selected_module.length; i < length; i++) {
-                if (get_selected_module[i].checked) {
-                        // do whatever you want with the checked radio
-                        //alert(get_selected_module[i].value);
-                        // only one radio can be logically checked, don't check the rest
-                        //break;
-                        return true;
-                }
-        }
-        showMapMessages('error', 'Please choose one module to export the records!');
-        return false;
-}
-function export_check(value) {
-	if( value == 'woocommerce' || value == 'wpcommerce' || value == 'marketpress' || value == 'users' || value == 'category' || value == 'tags' || value == 'customtaxonomy') { 
-		document.getElementById(value).checked = false;
-		document.getElementById('ShowMsg').style.display = "";
-		value = value.toUpperCase();
-		document.getElementById('warning-msg').innerHTML = value+' Feature is available only for PRO!.';
-		jQuery('#ShowMsg').delay(7000).fadeOut();
-	}
-}
-function choose_import_method(id) {
-        if(id == 'uploadfilefromcomputer') {
-                document.getElementById('boxmethod1').style.border = "1px solid #ccc";
-                document.getElementById('method1').style.display = '';
-                document.getElementById('method1').style.height = '40px';
-}
-}
-function choose_import_mode(id) {
-        if(id == 'importNow') {
-               document.getElementById('importrightaway').style.display='';
-               document.getElementById('reportLog').style.display='';
-               document.getElementById('schedule').style.display='none';
-         }
-        if(id == 'scheduleNow') {
-               document.getElementById('schedule').style.display='';
-               document.getElementById('importrightaway').style.display='none';
-               document.getElementById('reportLog').style.display='none';
-         }
-}
-function selectModules(id) {
-  var param = id ;
- if(param == 'checkallModules') {
-    document.getElementById('post').checked = true;
-    document.getElementById('page').checked = true;
-    document.getElementById('users').checked = true;
-    document.getElementById('comments').checked = true;
-    document.getElementById('custompost').checked = true;
- }
- else if(param == 'uncheckallModules') {
-
-    document.getElementById('post').checked = false;
-    document.getElementById('page').checked = false;
-    document.getElementById('users').checked = false;
-    document.getElementById('comments').checked = false;
-    document.getElementById('custompost').checked = false;
-  }
-}
-
diff --git a/lib/jquery-plugins/UploadHandler.php b/lib/jquery-plugins/UploadHandler.php
index 88f19d4..2cce255 100644
--- a/lib/jquery-plugins/UploadHandler.php
+++ b/lib/jquery-plugins/UploadHandler.php
@@ -7,14 +7,12 @@
  * https://blueimp.net
  *
  * Licensed under the MIT license:
  * http://www.opensource.org/licenses/MIT
  */
-
-require_once("../../../../../wp-load.php");
-require_once("../../includes/WPImporter_includes_helper.php");
-
+$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
+require_once($parse_uri[0]."wp-load.php");
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
 
 class UploadHandler
diff --git a/modules/comments/templates/index.php b/modules/comments/templates/index.php
index c725b5f..9a6b20d 100644
--- a/modules/comments/templates/index.php
+++ b/modules/comments/templates/index.php
@@ -32,15 +32,15 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 <div style="width:100%;">
 <div id="accordion">
-<?php $impCE = new WPImporter_includes_helper(); 
-?>
 <table class="table-importer">
 <tr>
 <td>
   <h3>CSV Import Options</h3>
   <div id='sec-one' <?php if($_REQUEST['step']!= 'uploadfile') {?> style='display:none;' <?php } ?>>
@@ -63,10 +63,11 @@
 		<!--<span class='importer_icon' style="float:left;"><img src = "<?php //echo WP_CONST_ULTIMATE_CSV_IMP_DIR;?>/images/Importicon_24.png"></span><span style="float:left;"><h2>Import CSV File</h2></span>-->
 	</div><form class="add:the-list: validate" style="clear:both;" method="post" enctype="multipart/form-data" onsubmit="return file_exist();">
 <div class="container">
   <?php echo $impCE->smack_csv_import_method(); ?>
 <input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 <?php $uploadDir = wp_upload_dir(); ?>
 <input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir['basedir'])) { echo $uploadDir['basedir']; }  ?>">
 <input type="hidden" id="uploadFileName" name="uploadfilename" value="">
         <input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -229,10 +230,11 @@ $allcustomposts.=$value.',';
    <input type="hidden" id="prevoptionindex" name="prevoptionindex" value=""/>
    <input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
    <input type='hidden' id='current_record' name='current_record' value='0' />
    <input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
    <input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
    <input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
    <!-- real uploaded filename -->
    <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
    <input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter; }  ?>" />
    <input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['__module'])) { echo $_REQUEST['step']; }  ?>' />
@@ -406,10 +408,11 @@ $mFieldsArr = substr($mFieldsArr, 0, -1);
                                 content and title                            </option>
                         </select><br>
                         <input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing                        <br>
                         <input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing                        <br>-->
 			<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 			<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 
 			 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>
                		<input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
diff --git a/modules/custompost/templates/index.php b/modules/custompost/templates/index.php
index 21f455e..d958109 100644
--- a/modules/custompost/templates/index.php
+++ b/modules/custompost/templates/index.php
@@ -34,10 +34,11 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
 
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
 	<table class="table-importer">
 	<tr>
@@ -60,10 +61,11 @@ $impCE = new WPImporter_includes_helper();
 	<div class="importfile" align='center'>
 	<div id='filenamedisplay'></div>
 	<div class="container">
           <?php echo $impCE->smack_csv_import_method(); ?>
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
         <input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -331,10 +333,11 @@ $impCE = new WPImporter_includes_helper();
 			<input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
 			<input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter; }  ?>" />
 			<input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['step'])) { echo $_REQUEST['step']; }  ?>' />
 			<input type='hidden' id='mappingArr' name='mappingArr' value='' />
@@ -535,10 +538,11 @@ $impCE = new WPImporter_includes_helper();
 		content and title                            </option>
 		</select><br>
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>
                 <input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
 		<input type="hidden" id="tmpcount" name="tmpcount" value="0" />
diff --git a/modules/eshop/templates/index.php b/modules/eshop/templates/index.php
index 89cb397..52b8342 100644
--- a/modules/eshop/templates/index.php
+++ b/modules/eshop/templates/index.php
@@ -34,10 +34,11 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
 require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY.'/includes/WPImporter_includes_helper.php');
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 $eshopObj = new EshopActions();
 $eshopObj->isplugin();
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
@@ -97,10 +98,11 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
 
 	<div class="container">
         <?php echo $impCE->smack_csv_import_method(); ?>
 
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
 	<input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -314,10 +316,11 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
 			<input type="hidden" id="prevoptionindex" name="prevoptionindex" value=""/>
 			<input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename;  }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) {   echo $uploaded_csv_name;  }  ?>" />
 			<input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter; }  ?>" />
 			<input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['step'])){ echo $_REQUEST['step']; }  ?>' />
@@ -519,10 +522,11 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
 		content and title                            </option>
 		</select><br>
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 		<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>
                 <input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
 		<input type="hidden" id="tmpcount" name="tmpcount" value="0" />
diff --git a/modules/page/templates/index.php b/modules/page/templates/index.php
index a5408c1..c56b7c6 100644
--- a/modules/page/templates/index.php
+++ b/modules/page/templates/index.php
@@ -34,10 +34,12 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
 
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
+
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
 	<table class="table-importer">
 	<tr>
@@ -60,10 +62,11 @@ $impCE = new WPImporter_includes_helper();
 	<div class="importfile" align='center'>
 	<div id='filenamedisplay'></div><!--<form class="add:the-list: validate" style="clear:both;" method="post" enctype="multipart/form-data" onsubmit="return file_exist();">-->
 	<div class="container">
            <?php echo $impCE->smack_csv_import_method(); ?>
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php  if(isset($uploadDir['basedir'])) {  echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
         <input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -271,10 +274,11 @@ $impCE = new WPImporter_includes_helper();
 			<input type="hidden" id="prevoptionindex" name="prevoptionindex" value=""/>
 			<input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; } ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name;  }  ?>" />
 			<input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter;  } ?>" />
 			<input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['step'])) { echo $_REQUEST['step'];  }  ?>' />
@@ -472,10 +476,11 @@ $impCE = new WPImporter_includes_helper();
 		content and title                            </option>
 		</select><br>
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?> <br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>
                 <input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
 		<input type="hidden" id="tmpcount" name="tmpcount" value="0" />
diff --git a/modules/post/templates/index.php b/modules/post/templates/index.php
index 64607db..10de858 100644
--- a/modules/post/templates/index.php
+++ b/modules/post/templates/index.php
@@ -33,11 +33,11 @@
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
 $impCE = new WPImporter_includes_helper();
-
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
 	<table class="table-importer">
 	<tr>
@@ -61,10 +61,11 @@ $impCE = new WPImporter_includes_helper();
 	<div id='filenamedisplay'></div><!--<form class="add:the-list: validate" style="clear:both;" method="post" enctype="multipart/form-data" onsubmit="return file_exist();">-->
 	<div class="container">
         <?php echo $impCE->smack_csv_import_method(); ?>
 
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' /> 
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
 	<input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -277,10 +278,11 @@ $impCE = new WPImporter_includes_helper();
 			<input type="hidden" id="prevoptionindex" name="prevoptionindex" value=""/>
 			<input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename;  }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) {   echo $uploaded_csv_name;  }  ?>" />
 			<input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter; }  ?>" />
 			<input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['step'])){ echo $_REQUEST['step']; }  ?>' />
@@ -481,10 +483,11 @@ $impCE = new WPImporter_includes_helper();
 		content and title                            </option>
 		</select><br>
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label><span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>	
                 <input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
 		<input type="hidden" id="tmpcount" name="tmpcount" value="0" />
diff --git a/modules/settings/templates/index.php b/modules/settings/templates/index.php
index 551f595..c80aa17 100644
--- a/modules/settings/templates/index.php
+++ b/modules/settings/templates/index.php
@@ -32,10 +32,14 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
+if(! wp_verify_nonce($nonce_Key, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 ?>
 <div style ='text-align:center;margin:0;color:red;font-size:smaller;'> Your Required Settings Configuration Please Select Security and Performance tab </div></br>
 <div id="ShowMsg" style="display:none;"><p id="warning-msg" class="alert alert-warning"><?php echo $skinnyData['plugStatus'];?></p></div>
 <?php if(isset($skinnyData['savesettings']) && $skinnyData['savesettings'] == 'done'){ ?>
 	<div id="deletesuccess"><p class="alert alert-success">Settings Saved</p></div>
@@ -380,18 +384,18 @@ global $wpdb; ?>
 <input type='checkbox' name='automapping' id='automapping' value='automapping'  checked disabled onclick="check_if_avail(this.id);" ><span id="align">Enable Auto Mapping</span></label>
 				</td></tr>
                                 <tr><td>
 					<label class=$utfsupport><input type='checkbox' name='rutfsupport' id='utfsupport' value='utfsupport' checked disabled onclick="check_if_avail(this.id);" ><span id="align">Enable UTF Support</span></label>
 				</td></tr>
-                                <tr class="databorder"><td>
+                                <!--<tr class="databorder"><td>
 					<label id="align">Export Delimiter
 					<select name="export_delimiter">
-						<option>;</option>
-						<option>,</option>
+						<option value = ";">;</option>
+						<option value = ",">,</option>
 					</select>
 					</label>
-				</td></tr>
+				</td></tr>-->
                                 <tr class="databorder"><td>
                                         <h3 id="innertitle">Debug Mode</h3>
                                         <label>You can enable/disable the debug mode.</label> </td><td>
                                         <label id="debugmode_enable" class="<?php echo $skinnyData['debugmode_enable']; ?>"><input type='radio' name='debug_mode' value='enable_debug' <?php echo $skinnyData['debugmode_enable']; ?> id="enabled" style="display:none" onclick="debugmode_check(this.id);" > On </label>
                                 <label id="debugmode_disable" class="<?php echo $skinnyData['debugmode_disable']; ?>"><input type='radio' name='debug_mode' value='disable_debug' <?php echo $skinnyData['debugmode_disable']; ?> id="disabled" style="display:none" onclick="debugmode_check(this.id);" > Off </label>
@@ -516,11 +520,12 @@ global $wpdb; ?>
                         <tr><td>memory_limit </td><td class='ini-configured-values'><?php echo ini_get('memory_limit') ?></td><td class='min-requirement-values'>99M</td></tr>
                         </table>
                         <h3 id="innertitle" colspan="2" >Required Loaders and Extentions:</h3>
                         <table class="table table-striped">
                         <?php $loaders_extensions = get_loaded_extensions();
-                              $mod_security = apache_get_modules();
+				if(function_exists('apache_get_modules'))
+                                   $mod_security = apache_get_modules();
                        ?>
                         <tr><td>IonCube Loader </td><td><?php if(in_array('ionCube Loader', $loaders_extensions)) {
                                         echo '<label style="color:green;">Yes</label>';
                                 } else {
                                         echo '<label style="color:red;">No</label>';
@@ -533,11 +538,11 @@ global $wpdb; ?>
                         <tr><td>Curl </td><td><?php if(in_array('curl', $loaders_extensions)) {
                                         echo '<label style="color:green;">Yes</label>';
                                 } else {
                                         echo '<label style="color:red;">No</label>';
                                 } ?></td><td></td></tr>
-                         <tr><td>Mod Security </td><td><?php if(in_array('mod_security.c', $mod_security)) {
+                         <tr><td>Mod Security </td><td><?php if(isset($mod_security) && in_array('mod_security.c', $mod_security)) {
                                         echo '<label style="color:green;">Yes</label>';
                                 } else {
                                         echo '<label style="color:red;">No</label>';
                                 } ?></td><td>
                                         <div style='float:left'>
diff --git a/modules/users/templates/index.php b/modules/users/templates/index.php
index 19a58d3..6a89c4c 100644
--- a/modules/users/templates/index.php
+++ b/modules/users/templates/index.php
@@ -40,10 +40,11 @@ require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY.'/includes/WPImporter_includes_
 
 <div style="width:100%;">
 <div id="accordion">
 <?php 
 $impCE = new WPImporter_includes_helper(); 
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 <table class="table-importer">
 <tr>
 <td>
   <h3>CSV Import Options</h3>
@@ -64,10 +65,11 @@ $impCE = new WPImporter_includes_helper();
   <div class="importfile" align='center'>
 	<div id='filenamedisplay'><!--<span class='importer_icon' style="float:left;"><img src = "<?php //echo WP_CONST_ULTIMATE_CSV_IMP_DIR;?>/images/Importicon_24.png"></span><span style="float:left;"><h2>Import CSV File</h2></span>--></div><form class="add:the-list: validate" style="clear:both;" method="post" enctype="multipart/form-data" onsubmit="return file_exist();">
 <div class="container">
    <?php echo $impCE->smack_csv_import_method(); ?>
 <input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 <?php $uploadDir = wp_upload_dir(); ?>
 <input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir['basedir'])) { echo $uploadDir['basedir']; }  ?>">
 <input type="hidden" id="uploadFileName" name="uploadfilename" value="">
         <input type = 'hidden' id = 'uploadedfilename' name = 'uploadedfilename' value = ''>
         <input type = 'hidden' id = 'upload_csv_realname' name = 'upload_csv_realname' value =''>
@@ -227,10 +229,11 @@ $allcustomposts.=$value.',';
    <input type="hidden" id="prevoptionindex" name="prevoptionindex" value=""/>
    <input type="hidden" id="prevoptionvalue" name="prevoptionvalue" value=""/>
    <input type='hidden' id='current_record' name='current_record' value='0' />
    <input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
    <input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
    <input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
    <!-- real uploaded filename -->
    <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
    <input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) {  echo  $delimeter; } ?>" />
    <input type='hidden' id='stepstatus' name='stepstatus' value='<?php if(isset($_REQUEST['step'])) {  echo $_REQUEST['step']; }  ?>' />
@@ -403,10 +406,11 @@ $mFieldsArr = substr($mFieldsArr, 0, -1);
                                 content and title                            </option>
                         </select><br>
                         <input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing                        <br>
                         <input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing                        <br>-->
 			<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 			<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 
 			 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>	
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>
                         <input type="hidden" id="currentlimit" name="currentlimit" value="0"/>
diff --git a/templates/import.php b/templates/import.php
index eed5859..456099a 100644
--- a/templates/import.php
+++ b/templates/import.php
@@ -32,11 +32,14 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$noncevar = isset($_POST['postdata']['wpnonce']) ? $_POST['postdata']['wpnonce'] : '';
+if(!wp_verify_nonce($noncevar, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
+
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
 require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY . 'lib/skinnymvc/core/base/SkinnyBaseActions.php');
 require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY . 'lib/skinnymvc/core/SkinnyActions.php');
@@ -44,11 +47,11 @@ $skinnyObj = new CallWPImporterObj();
 $curr_action = $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['selectedImporter'];
 $importedAs = Null;
 $inserted_post_count = 0;
 $noofrecords = '';
 if ($curr_action != 'post' && $curr_action != 'page' && $curr_action != 'custompost') {
-	require_once(plugin_dir_path(__FILE__) . '../modules/' . $curr_action . '/actions/actions.php');
+	require_once(WP_CSVIMP_PLUGIN_BASE . '/modules/' . $curr_action . '/actions/actions.php');
 }
 if ($curr_action == 'post' || $curr_action == 'page' || $curr_action == 'custompost') {
 	$importObj = new WPImporter_includes_helper();
 	if ($curr_action == 'post') {
 		$importedAs = 'Post';
diff --git a/templates/layout.php b/templates/layout.php
index d0b5ffb..3e59a3c 100644
--- a/templates/layout.php
+++ b/templates/layout.php
@@ -32,10 +32,14 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 ?>
 
 <style> #ui-datepicker-div { display:none } </style>
 <div id = 'notification_wp_csv'> </div>
 <?php
diff --git a/templates/menu.php b/templates/menu.php
index 0298404..a0c6910 100644
--- a/templates/menu.php
+++ b/templates/menu.php
@@ -4,10 +4,14 @@
  * Unauthorized copying of this file, via any medium is strictly prohibited
  * Proprietary and confidential
  * You can contact Smackcoders at email address info@smackcoders.com.
  *******************************************************************************************/
 //require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
 
 $post = $page = $custompost = $categories = $users = $customtaxonomy = $comments = $eshop = $wpcommerce = $woocommerce = $settings = $support = $dashboard = $export = $mappingtemplate = $filemanager = $schedulemapping = $marketpress = $customerreviews = '';
diff --git a/templates/readfile.php b/templates/readfile.php
index 6727cbd..ec513e5 100644
--- a/templates/readfile.php
+++ b/templates/readfile.php
@@ -32,17 +32,18 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-
-require_once('../includes/WPImporter_includes_helper.php');
+$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
++require_once($parse_uri[0]."wp-load.php");
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
-
-require_once('../../../../wp-load.php');
+$noncevar = isset($_REQUEST['wpnonce']) ? $_REQUEST['wpnonce'] : '';
+if(! wp_verify_nonce($noncevar, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 
 $requested_module = "";
 if(isset($requested_module))
 $requested_module = $_REQUEST['checkmodule'];
 $post_url = admin_url() . 'admin.php?page=' . WP_CONST_ULTIMATE_CSV_IMP_SLUG . '/index.php&__module=' . $requested_module . '&step=mapping_settings';
diff --git a/templates/versioncheck.php b/templates/versioncheck.php
index 8512a9b..5174ba5 100644
--- a/templates/versioncheck.php
+++ b/templates/versioncheck.php
@@ -32,11 +32,14 @@
  * WP Ultimate CSV Importer copyright notice. If the display of the logo is
  * not reasonably feasible for technical reasons, the Appropriate Legal
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
 
 global $wpdb;

Vulnerable code: === Import a CSV with Ultimate CSV Importer ===
Stable tag: 3.7.2
Version: 3.7.2
Import a CSV with Ultimate CSV Importer as posts, pages, eshop products, custom posts with custom fields in few simple clicks 
Import a CSV as wordpress posts made very simple and easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.2 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
** Now stable version 3.7.2 available to download with hot linked featured image fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
//pieStats();
//lineStats();


		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule;
    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule;
        var importlimit = document.getElementById('importlimit').value; 
	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,}
jQuery( document ).ready(function() {
      jQuery('.dropdown-toggle').dropdown('toggle');
   var checkmodule = document.getElementById('checkmodule').value;
        if(checkmodule != 'dashboard' && checkmodule != 'filemanager') {
                var get_log = document.getElementById('log').innerHTML;
                   if (!jQuery.trim(jQuery('#log').html()).length) {      
                  document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
                }
       
pieStats();
lineStats();


 }
if(checkmodule=='custompost')
{
	var step = document.getElementById('stepstatus').value;
        if(step == 'mapping_settings') {
        var cust_post_list_count = document.getElementById('cust_post_list_count').value;
        if(cust_post_list_count=='0')
        document.getElementById('cust_post_empty').style.display='';
	}
}	
var checkfile = document.getElementById('checkfile').value;
var uploadedFile = document.getElementById('uploadedFile').value;
var select_delimeter=document.getElementById('select_delim').value;
var select_delim=document.getElementById('select_delim').value;
var get_log = document.getElementById('log').innerHTML; 
if (!jQuery.trim(jQuery('#log').html()).length) {	
document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
}
	if(checkfile != ''){
		uploadedFile = checkfile;
	}
	if(select_delimeter!='')
	{
	select_delim=select_delimeter;
	}
        var doaction = 'record_no=1&file_name='+uploadedFile+'&selected_delimeter='+select_delim;
        var tmpLoc = document.getElementById('tmpLoc').value;
                jQuery.ajax({
                        url: tmpLoc+'templates/readfile.php',
                        type: 'post',
                        data: doaction,
                        dataType: 'json',
                        success: function(response){ 
                                var totalLength = response.length;
				var setHeight = (parseInt(totalLength)*30)+250;
				//document.getElementById('sec-two').style.height = setHeight+'px';
                        }
                });
});
function goto_mapping(id){
if(id == 'importfile'){
var currentURL = document.URL; 
var go_to_url = currentURL.replace("uploadfile","mapping_settings");
window.location.assign(go_to_url);
document.getElementById('sec-one').style.display='none';
document.getElementById('sec-two').style.display='';
}
}

function gotoelement(id) {
    var gotoElement = document.getElementById('current_record').value;
    var no_of_records = document.getElementById('totRecords').value;
    var uploadedFile = document.getElementById('uploadedFile').value;
    var delim = document.getElementById('select_delimeter').value;
    if (id == 'prev_record') {
        gotoElement = parseInt(gotoElement) - 1;
    }
    if (id == 'next_record') {
        gotoElement = parseInt(gotoElement) + 1;
    }
    if (gotoElement <= 0) {
        gotoElement = 0;
    }
    if (gotoElement >= no_of_records) {
        gotoElement = parseInt(no_of_records) - 1;
    }
    if (id == 'apply_element') {
        gotoElement = parseInt(document.getElementById('goto_element').value);
        if (isNaN(gotoElement)) {
            showMapMessages('error', ' Please provide valid record number.');
        }
        if (gotoElement <= 0) {
            gotoElement = 0;
            showMapMessages('error', ' Please provide valid record number.');
        } else {
            gotoElement = gotoElement - 1;
        }
        if (gotoElement >= no_of_records) {
            gotoElement = parseInt(no_of_records) - 1;
            showMapMessages('error', 'CSV file have only ' + no_of_records + ' records.');
            return false;
        }
    }
    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim;
    var tmpLoc = document.getElementById('tmpLoc').value;
    jQuery.ajax({
        url: tmpLoc + 'templates/readfile.php',
        type: 'post',
        data: doaction,
        dataType: 'json',
        success: function (response) {
            var totalLength = response.length;
            for (var i = 0; i < totalLength; i++) {
                if ((response[i].length) > 32) {
                    document.getElementById('elementVal_' + i).innerHTML = response[i].substring(0, 28) + '...';
                } else {
                    document.getElementById('elementVal_' + i).innerHTML = response[i];
                }
            }
        var displayRecCount = gotoElement + 1;
            document.getElementById('preview_of_row').innerHTML = "Showing preview of row #" + displayRecCount;
            document.getElementById('current_record').value = gotoElement;
        }
    });
}

function showtemplatediv_wpuci(checked, div)
{
	if(checked)
		jQuery('#'+div).show();
	else
		jQuery('#'+div).hide();
}

function showtemplatediv_edit(checked, value)
{
	if(value == 'saveas')
		jQuery('#showtemplate_edit_div').show();
	else
		jQuery('#showtemplate_edit_div').hide();
}


function selectpoststatus()
{
	var ps = document.getElementById("importallwithps");
	var selectedpsindex = ps.options[ps.selectedIndex].value;
	if(selectedpsindex == 3){
		document.getElementById('globalpassword_label').style.display = "block";
		document.getElementById('globalpassword_text').style.display = "block";
	}
	else{
                document.getElementById('globalpassword_label').style.display = "none";
                document.getElementById('globalpassword_text').style.display = "none";
	}
	var totdropdown= document.getElementById('h2').value;
	var total = parseInt(totdropdown);
	if(selectedpsindex=='0')
	{

		for(var i=0;i < total;i++)
		{

			dropdown = document.getElementById("mapping"+i);
			var option=document.createElement('option');
			option.text="post_status";
			dropdown.add(option);

		}

	}
	else {
		for(var i=0;i < total;i++)
		{

			dropdown = document.getElementById("mapping"+i);

			var totarr = dropdown.options.length;

			for(var j=0;j<totarr;j++)
			{

				if(dropdown.options[j].value=='post_status')
				{

					dropdown.options.remove(j);
					totarr--;
				}
			}

		}
	}
}



// Function for add customfield

function addcustomfield(myval, selected_id) { 
    var a = document.getElementById('h1').value;
    var importer = document.getElementById('selectedImporter').value;
    var aa = document.getElementById('h2').value;
    var selected_dropdown = document.getElementById('mapping' + selected_id);
    var selected_value = selected_dropdown.value; 
    var prevoptionindex = document.getElementById('prevoptionindex').value;
    var prevoptionvalue = document.getElementById('prevoptionvalue').value;
    var mappedID = 'mapping' + selected_id;
    var add_prev_option = false;
    if(mappedID == prevoptionindex){
	    add_prev_option = true;	
    }
    for (var i = 0; i < aa; i++) {
	    var b = document.getElementById('mapping' + i).value; 
	    var id = 'mapping' + i;
	    if(add_prev_option){
		    if(i != selected_id){	
			    jQuery('#'+id).append( new Option(prevoptionvalue,prevoptionvalue) );
		    }
	    }
	    if(i != selected_id){
		    var x=document.getElementById('mapping' + i);
		    jQuery('#'+id+' option[value="'+selected_value+'"]').remove();
	    }
	    if (b == 'add_custom' + i) {
		    document.getElementById('textbox' + i).style.display = "";
		    document.getElementById('customspan' + i).style.display = "";
	    }
	    else {
		    document.getElementById('textbox' + i).style.display = "none";
		    document.getElementById('customspan' + i).style.display = "none";
	    }
    }
    document.getElementById('prevoptionindex').value = 'mapping' + selected_id;
    var customField = selected_value.indexOf("add_custom");
    if(selected_value != '-- Select --' && customField != 0){
	    document.getElementById('prevoptionvalue').value = selected_value;
    }
}


function clearMapping()
{
	var total_mfields = document.getElementById('h2').value; 
	var mfields_arr = document.getElementById('mapping_fields_array').value;
	var n=mfields_arr.split(",");
	var options = '<option id="select">-- Select --</option>';
	for(var i=0;i<n.length;i++){
		options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
	}
	for(var j=0;j<total_mfields;j++){
		document.getElementById('mapping'+j).innerHTML = options;
		document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
		document.getElementById('textbox'+j).style.display = 'none';
		document.getElementById('customspan'+j).style.display = 'none';
	}	
}

function clearmapping()
{
        var total_mfields = document.getElementById('h2').value;
        var mfields_arr = document.getElementById('mapping_fields_array').value;
        var n=mfields_arr.split(",");
        var options = "<option id='select'>-- Select --</option>";
        for(var i=0;i<n.length;i++){
                options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
        }
        for(var j=0;j<total_mfields;j++){
                document.getElementById('mapping'+j).innerHTML = options;
                //document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
                document.getElementById('textbox'+j).style.display = 'none';
                document.getElementById('customspan'+j).style.display = 'none';
        }
}

function shownotification(msg, alerts)
{
        var newclass;
        var divid = "notification_wp_csv";

        if(alerts == 'success')
                newclass = "alert alert-success";
        else if(alerts == 'danger')
                newclass = "alert alert-danger";
        else if(alerts == 'warning')
                newclass = "alert alert-warning";
        else
                newclass = "alert alert-info";

        jQuery('#'+divid).removeClass()
        jQuery('#'+divid).html(msg);
        jQuery('#'+divid).addClass(newclass);
        // Scroll
        jQuery('html,body').animate({
                scrollTop: jQuery("#"+divid).offset().top},
        'slow'); 
}

function import_csv() 
{
	// code added by goku to check whether templatename
	var mapping_checked = jQuery('#mapping_templatename_checked').is(':checked');
	var mapping_tempname = jQuery('#mapping_templatename').val();
	var mapping_checked_radio = jQuery('input[name=tempaction]:radio:checked').val();
	if(mapping_checked || mapping_checked_radio == 'saveas')	
	{
		if(mapping_checked_radio == 'saveas')
			mapping_tempname = jQuery('#mapping_templatename_edit').val();

		if(jQuery.trim(mapping_tempname) == '')	
		{
			alert('Template name is empty');
			return false;
		}
		else
		{
			// check templatename already exists
			jQuery.ajax({
		                type: 'POST',
                		url: ajaxurl,
				async: false,
		                data: {
                		    'action'       : 'checktemplatename',
		                    'templatename' : mapping_tempname,
		                },
                		success:function(data) 
				{
					if(data != 0)
					{
						jQuery('#mapping_templatename').val('');
					}
        	        	},
		                error: function(errorThrown){
        	        	        console.log(errorThrown);
        		        }
		        });		
		}
	}
	var mapping_tempname = jQuery('#mapping_templatename').val();
	if(mapping_checked_radio == 'saveas')
        	//mapping_tempname = jQuery('#mapping_templatename_edit').val();

	if(mapping_tempname == '' && (mapping_checked || mapping_templatename_edit == 'saveas'))
	{
		alert('Template Name already exists');return false;
	}
	// code ends here on checking templatename

    var importer = document.getElementById('selectedImporter').value;
    var header_count = document.getElementById('h2').value;
    var array = new Array();
    var val1, val2, val3, val4, val5, val6, val7, error_msg, chk_status_in_csv, post_status_msg;
    val1 = val2 = val3 = val4 = val5 = val6 = val7 = post_status_msg = post_type = 'Off';
    for (var i = 0; i < header_count; i++) {
        var e = document.getElementById("mapping" + i);
        var value = e.options[e.selectedIndex].value;
        array[i] = value;
    }
//alert(array.length);
    if (importer == 'post' || importer == 'page' || importer == 'custompost') { 
	if(importer == 'custompost') {
        	var getSelectedIndex = document.getElementById('custompostlist');
	        var SelectedIndex = getSelectedIndex.value;
			//var t=getSelectedIndex.options[getSelectedIndex.selectedIndex];
			if( SelectedIndex != 'select')
			post_type='On';
			//alert(t+'---'+SelectedIndex);
	}

        chk_status_in_csv = document.getElementById('importallwithps').value;
        if (chk_status_in_csv != 0)
            post_status_msg = 'On';

        for (var j = 0; j < array.length; j++) {
            if (array[j] == 'post_title') {
                val1 = 'On';
            }
            if (array[j] == 'post_content') {
                val2 = 'On';
            }
            if (post_status_msg == 'Off') {
                if (array[j] == 'post_status')
                    post_status_msg = 'On';
            }
        }
        if (importer != 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On') {
		return true;
        }
	else if (importer == 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On' && post_type=='On') {
                return true;
        }
        else {
            error_msg = '';
            if (val1 == 'Off')
                error_msg += " post_title,";
            if (val2 == 'Off')
                error_msg += " post_content,";
	    if(importer == 'custompost') {
	            if (SelectedIndex == 'select')
        	        error_msg += " post_type,";
	    }
            if (post_status_msg == 'Off')
                error_msg += " post_status";
            showMapMessages('error', 'Error: ' + error_msg + ' - Mandatory fields. Please map the fields to proceed.');
            return false;
        }
    }

// validation starts
else if(importer == 'comments'){
        //var getSelectedIndex1 = document.getElementById('selectPosts');
        //var SelectedIndex1 = getSelectedIndex1.options[getSelectedIndex1.selectedIndex].text;
                for(var j=0;j<array.length;j++){
                        if(array[j] == 'comment_author'){
                                val1 = 'On';
                        }
                        if(array[j] == 'comment_author_email'){
                                val2 = 'On';
                        }
                        if(array[j] == 'comment_content'){
                                val3 = 'On';
                        }
			if(array[j] == 'comment_post_ID'){
                                val4 = 'On';
                        }


                }
                if(val1 == 'On' && val2 == 'On' && val3 == 'On' && val4 == 'On') {
                 return true;
                }
                else{
                 showMapMessages('error',' "Post Id", "Comment Author", "Comment Author Email" and "Comment Content" should be mapped.');
                 return false;
                }

	
		showMapMessages('error',header_count);return false;
	}
	else if(importer == 'users'){
		//var getSelectedIndex = document.getElementById('userrole');
		//var SelectedIndex = getSelectedIndex.options[getSelectedIndex.selectedIndex].text;
		for(var j=0;j<array.length;j++){
			if(array[j] == 'user_login'){
				val1 = 'On';	
			}
			if(array[j] == 'user_email'){
				val2 = 'On';
			}
			if(array[j] == 'role'){
				val3 = 'On';
			}
		}
		if(val1 == 'On' && val2 == 'On' && val3 == 'On') {
	   	 return true;
		}
		else{
		 showMapMessages('error','"role", "user_login" and "user_email" should be mapped.');
		 return false;
		}
	}
// validation ends
}


function showMapMessages(alerttype, msg) {
    jQuery("#showMsg").addClass("maperror");
    document.getElementById('showMsg').innerHTML = msg;
    document.getElementById('showMsg').className += ' ' + alerttype;
    document.getElementById('showMsg').style.display = '';
    jQuery("#showMsg").fadeOut(10000);
}

function importRecordsbySettings(siteurl)
{
        var importlimit = document.getElementById('importlimit').value; 
        var get_requested_count = importlimit; 
        var tot_no_of_records = document.getElementById('checktotal').value;
        var importas = document.getElementById('selectedImporter').value;
        var uploadedFile = document.getElementById('checkfile').value;
       // var no_of_columns = document.getElementById('h2').value;
        var step = document.getElementById('stepstatus').value;
        var mappingArr = document.getElementById('mappingArr').value;
	var dupContent = document.getElementById('duplicatecontent').checked;
	var dupTitle = document.getElementById('duplicatetitle').checked;
	var currentlimit = document.getElementById('currentlimit').value;
	var tmpCnt = document.getElementById('tmpcount').value;
	var no_of_tot_records = document.getElementById('tot_records').value;
        var get_log = document.getElementById('log').innerHTML;
         document.getElementById('reportLog').style.display = '';
         document.getElementById('terminatenow').style.display = '';
        if(get_requested_count != '') {
                //return true;
        } else {
                 document.getElementById('showMsg').style.display = "";
                 document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';			jQuery("#showMsg").fadeOut(10000);
                 return false;
        }
	if(parseInt(get_requested_count) <= parseInt(no_of_tot_records)) {
                document.getElementById('server_request_warning').style.display = 'none';
        } else {
                document.getElementById('server_request_warning').style.display = '';
                return false;
        }
	if(get_log == '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>'){
		document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">Your Import Is In Progress...</p>';
		document.getElementById('startbutton').disabled = true;
	}
	document.getElementById('ajaxloader').style.display="";
        var tempCount = parseInt(tmpCnt);
        var totalCount = parseInt(tot_no_of_records);
        if(tempCount>totalCount){
		document.getElementById('ajaxloader').style.display="none";
		document.getElementById('startbutton').style.display="none";
		document.getElementById('importagain').style.display="";
                document.getElementById('terminatenow').style.display = "none";
		return false;
	}

	var postdata = new Array();
	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,}

        var tmpLoc = document.getElementById('tmpLoc').value;
	jQuery.ajax({
		type: 'POST',
		url: ajaxurl,
		data: {
		    'action'   : 'importByRequest',
		    'postdata' : postdata,
		    'siteurl'  : siteurl,
		},
		success:function(data) {
                        if(parseInt(tmpCnt) == parseInt(tot_no_of_records)){
                                document.getElementById('terminatenow').style.display = "none";
                        } 
        	        if(parseInt(tmpCnt) < parseInt(tot_no_of_records)){
				var terminate_action = document.getElementById('terminateaction').value;
				if(terminate_action == 'continue'){
					currentlimit = parseInt(currentlimit)+parseInt(importlimit);
					document.getElementById('currentlimit').value = currentlimit;
					console.log('impLmt: '+importlimit+'totRecds: '+tot_no_of_records);
					document.getElementById('tmpcount').value = parseInt(tmpCnt)+parseInt(importlimit);
					setTimeout(function(){importRecordsbySettings()},0);
				} else {
					document.getElementById('log').innerHTML += "Import process has been terminated.</br>";
					return false;
				}
	                }else{
				document.getElementById('ajaxloader').style.display="none";
		                document.getElementById('startbutton').style.display="none";
		                document.getElementById('importagain').style.display="";
        	                return false;
	                }
			document.getElementById('log').innerHTML += data+'<br/>';
				
		},
		error: function(errorThrown){
			console.log(errorThrown);
		}
	});
}

// Terminate import process
function terminateProcess(){
	document.getElementById('terminateaction').value = 'terminate';
}


// Enable/Disable WP-e-Commerce Custom Fields
function enablewpcustomfield(val){
	if(val == 'wpcustomfields'){
		document.getElementById('wpcustomfieldstr').style.display = '';
	}
	else{
		document.getElementById('wpcustomfields').checked = false;
		document.getElementById('wpcustomfieldstr').style.display = 'none';
	}
}

function saveSettings(){ //alert('dd');
//document.getElementById('ShowMsg').style.display = '';
jQuery(document).ready( function() {
        jQuery('#ShowMsg').delay(2000).fadeOut();
      });
}

function Reload(){
window.location.reload();
}

function  check_if_avail(val){
	var proModule = new Array();
	proModule[0] = 'categories';
	proModule[1] = 'customtaxonomy';
	proModule[2] = 'eshop';
	proModule[3] = 'marketpress';
	proModule[4] = 'woocommerce';
	proModule[5] = 'wpcommerce';
	proModule[6] = 'cctm';
	proModule[7] = 'types';
	proModule[8] = 'acf';
	proModule[9] = 'Customerreviews';
	proModule[10] = 'WP-Members';
	proModule[11] = 'yoastseo';
	proModule[12] = 'caticonenable';
	proModule[13] = 'custompostuitype';
	proModule[14] = 'wpcustomfields';
	proModule[15] = 'recommerce';
	proModule[16] = 'automapping';
	proModule[17] = 'utfsupport';
        
	
	var warning_name = new Array();
	warning_name['categories'] = 'Categories/Tags';
	warning_name['customtaxonomy'] = 'Custom Taxonomy';
	warning_name['eshop'] = 'Eshop';
	warning_name['marketpress'] = 'Market Press Lite';
	warning_name['woocommerce'] = 'WooCommerce';
	warning_name['wpcommerce'] = 'WP e-Commerce';
	warning_name['cctm'] = 'CCTM';
	warning_name['types'] = 'Types';
	warning_name['acf'] = 'ACF';
	warning_name['Customerreviews'] = 'Customer Reviews';
	warning_name['WP-Members'] = 'WP-Members';
	warning_name['aioseo'] = 'All-in-SEO';
	warning_name['yoastseo'] = 'Yoast SEO';
	warning_name['caticonenable'] = 'Category Icons';
	warning_name['custompostuitype'] = 'Custom Post Type UI';
	warning_name['automapping'] = 'Auto Mapping';
	warning_name['utfsupport'] = 'UTF Support';

	var result = inArray(val, proModule);
	if(result == true){

		if(val == 'eshop' || val == 'wpcustomfields' || val == 'wpcommerce' || val == 'woocommerce' || val == 'marketpress'){
			if(val == 'wpcommerce' || val == 'wpcustomfields') {
				document.getElementById('wpcustomfieldstr').style.display = '';
			} else {
				document.getElementById('wpcustomfieldstr').style.display = '';
			}
			//			document.getElementById('wpcustomfieldstr').style.display = 'none';
			document.getElementById('nonerecommerce').checked = true;
		}
		if(val == 'cctm' || val == 'acf'){
			document.getElementById('nonercustompost').checked = true;
		}
		if(val == 'aioseo' || val == 'yoastseo'){
			document.getElementById('nonerseooption').checked = true;
		}
		if(val == 'caticonenable'){
			document.getElementById('caticondisable').checked = true;
		}
		document.getElementById(val).checked = false;
		document.getElementById('ShowMsg').style.display = "";
		document.getElementById('warning-msg').innerHTML = warning_name[val]+' feature is available only for PRO!.';
		jQuery('#ShowMsg').delay(7000).fadeOut();
	}
}

function inArray(needle, haystack) {
    var length = haystack.length;
    for(var i = 0; i < length; i++) {
        if(typeof haystack[i] == 'object') {
            if(arrayCompare(haystack[i], needle)) {
		 return true;
	    }
        } else {
            if(haystack[i] == needle) {
		 return true;
	    }
        }
    }
    return false;
}

function import_again(){
	var get_current_url = document.getElementById('current_url').value;
	window.location.assign(get_current_url);
}
function sendemail2smackers(){
//	var useremail = document.getElementById('usermailid').value;
	var message_content = document.getElementById('message').value;
	var firstname = document.getElementById('firstname').value;
	var lastname = document.getElementById('lastname').value;
	if(message_content != '' && firstname != '' && lastname != '')
		return true;
	else
		document.getElementById('showMsg').style.display = '';
		document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';
		jQuery("#showMsg").fadeOut(10000);
		return false;
}


function check_allnumeric(inputtxt)  
{  
	var numbers = /^[0-9]+$/;  
	if(inputtxt.match(numbers))  
	{  
		return true;
	}  
	else  
	{  
		if(inputtxt == '')
			alert('Fill all mandatory fields.');
		else
			alert('Please enter numeric characters only');  
		return false;  
	}  
}

function gotoback() {
	var currentURL = document.getElementById('current_url').value;
	var set_assigned_step = currentURL.replace("uploadfile","mapping_settings");
//	window.location.assign(set_assigned_step);
}
function export_module(){
        var get_selected_module = document.getElementsByName('export');
//      alert(get_selected_module);
        for (var i = 0, length = get_selected_module.length; i < length; i++) {
                if (get_selected_module[i].checked) {
                        // do whatever you want with the checked radio
                        //alert(get_selected_module[i].value);
                        // only one radio can be logically checked, don't check the rest
                        //break;
                        return true;
                }
        }
        showMapMessages('error', 'Please choose one module to export the records!');
        return false;
}
function export_check(value) {
	if( value == 'woocommerce' || value == 'wpcommerce' || value == 'marketpress' || value == 'users' || value == 'category' || value == 'tags' || value == 'customtaxonomy') { 
		document.getElementById(value).checked = false;
		document.getElementById('ShowMsg').style.display = "";
		value = value.toUpperCase();
		document.getElementById('warning-msg').innerHTML = value+' Feature is available only for PRO!.';
		jQuery('#ShowMsg').delay(7000).fadeOut();
	}
}
function choose_import_method(id) {
        if(id == 'uploadfilefromcomputer') {
                document.getElementById('boxmethod1').style.border = "1px solid #ccc";
                document.getElementById('method1').style.display = '';
                document.getElementById('method1').style.height = '40px';
}
}
function choose_import_mode(id) {
        if(id == 'importNow') {
               document.getElementById('importrightaway').style.display='';
               document.getElementById('reportLog').style.display='';
               document.getElementById('schedule').style.display='none';
         }
        if(id == 'scheduleNow') {
               document.getElementById('schedule').style.display='';
               document.getElementById('importrightaway').style.display='none';
               document.getElementById('reportLog').style.display='none';
         }
}
function selectModules(id) {
  var param = id ;
 if(param == 'checkallModules') {
    document.getElementById('post').checked = true;
    document.getElementById('page').checked = true;
    document.getElementById('users').checked = true;
    document.getElementById('comments').checked = true;
    document.getElementById('custompost').checked = true;
 }
 else if(param == 'uncheckallModules') {

    document.getElementById('post').checked = false;
    document.getElementById('page').checked = false;
    document.getElementById('users').checked = false;
    document.getElementById('comments').checked = false;
    document.getElementById('custompost').checked = false;
  }
}


require_once("../../../../../wp-load.php");
require_once("../../includes/WPImporter_includes_helper.php");

<?php $impCE = new WPImporter_includes_helper(); 
?>

                                <tr class="databorder"><td>
						<option>;</option>
						<option>,</option>
				</td></tr>
                              $mod_security = apache_get_modules();
                         <tr><td>Mod Security </td><td><?php if(in_array('mod_security.c', $mod_security)) {
//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
	require_once(plugin_dir_path(__FILE__) . '../modules/' . $curr_action . '/actions/actions.php');

require_once('../includes/WPImporter_includes_helper.php');

require_once('../../../../wp-load.php');
//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
Fixed code: === Import CSV made simple with Ultimate CSV Importer ===
Stable tag: 3.7.3
Version: 3.7.3
Import CSV made simple with Ultimate CSV Importer to import/export posts, pages, eshop products, custom posts with custom fields in few simple clicks 
Import CSV data to wordpress is made very easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.3 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
** Now stable version 3.7.3 available to download with security issue fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
= 3.7.3 =
*Fixed: Vulnarablility security issue fix. 

= 3.7.3 =
* Upgrade now for Vulnarability fix.

	function create_nonce_key(){
		return wp_create_nonce('smack_nonce');
	}
        
	 var dir_path = jQuery('#dirpathval').val();
	 var noncekey = jQuery('#nonceKey').val();
		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule+'&temloc=' + tmpLoc+'&dir_path=' + dir_path + '&wpnonce=' + noncekey;
    var dir_path = jQuery('#dirpathval').val();
    var noncekey = document.getElementById('nonceKey').value;
    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule+ '&dir_path=' + dir_path + '&wpnonce=' + noncekey;
        var importlimit = document.getElementById('importlimit').value;
	var noncekey = document.getElementById('wpnoncekey').value; 
	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,'wpnonce':noncekey}
		else if(id == 'getdatawithdelimeter'){
			document.getElementById('delimeter').style.display = '';			
		}
		else if(id == 'getdatawithdelimeter'){
                        document.getElementById('delimeter').style.display = 'none';
                }
$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
require_once($parse_uri[0]."wp-load.php");
$impCE = new WPImporter_includes_helper();
$nonce_Key = $impCE->create_nonce_key();
<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$nonce_Key = $impCE->create_nonce_key();
	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$nonce_Key = $impCE->create_nonce_key();
	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$nonce_Key = $impCE->create_nonce_key();

	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$nonce_Key = $impCE->create_nonce_key();
	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' /> 
			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$impCE = new WPImporter_includes_helper();
$nonce_Key = $impCE->create_nonce_key();
if(! wp_verify_nonce($nonce_Key, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');
                                <!--<tr class="databorder"><td>
						<option value = ";">;</option>
						<option value = ",">,</option>
				</td></tr>-->
				if(function_exists('apache_get_modules'))
                                   $mod_security = apache_get_modules();
                         <tr><td>Mod Security </td><td><?php if(isset($mod_security) && in_array('mod_security.c', $mod_security)) {
$nonce_Key = $impCE->create_nonce_key();
<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
$noncevar = isset($_POST['postdata']['wpnonce']) ? $_POST['postdata']['wpnonce'] : '';
if(!wp_verify_nonce($noncevar, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');

	require_once(WP_CSVIMP_PLUGIN_BASE . '/modules/' . $curr_action . '/actions/actions.php');
$impObj = new WPImporter_includes_helper();
$nonceKey = $impObj->create_nonce_key();
if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');
$impObj = new WPImporter_includes_helper();
$nonceKey = $impObj->create_nonce_key();
if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');
$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
+require_once($parse_uri[0]."wp-load.php");
$noncevar = isset($_REQUEST['wpnonce']) ? $_REQUEST['wpnonce'] : '';
if(! wp_verify_nonce($noncevar, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');
$impObj = new WPImporter_includes_helper();
$nonceKey = $impObj->create_nonce_key();
if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
die('You are not allowed to do this operation.Please contact your admin.');