That looks pretty good - I got it work to create individual qr codes with token and save it temporary on the server and put 5 codes per page (with a "for"-function). Unfortunately "NewDirectRequest" does not work - I open a bug report...

400: Falsche Anfrage Der CSRF-Token konnte nicht verifiziert werden.

And could you post the code of your solution? Would be very helpful

evaluation2023 wrote:

That looks pretty good - I got it work to create individual qr codes with token and save it temporary on the server and put 5 codes per page (with a "for"-function). Unfortunately "NewDirectRequest" does not work - I open a bug report...

400: Falsche Anfrage Der CSRF-Token konnte nicht verifiziert werden.
 

No : it's not an issue
See www.limesurvey.org/manual/NewUnsecureRequest
 

Many thanks for your help, Dennis and Joffm! - unfortunately I tried to use "NewUnsecureRequest" - so in the function which shows the <form>- with an number-input and a send button i added the url which sends then to /plugins/unsecure ... but the viewed page then is blank with no code

So in my class now I have two functions, one is the "index-Function" which shows the <form> with <input number> and <button> and the other is the "create"-function which gets the <input number> and the survey id and then successfull generates the PDF with QR-Codes.... but just, when I access the url manually ...

My question: How can I get it work to call the create-function from the index-function without getting the CSRF-Errors ... I tried to understand your examples, but didn't get it to work...

Maybe I could get a look at Joffm's solution

I don't really understand the purpose of using NewDirectRequest , but if it work with NewDirectRequest : it work with NewUnsecureRequest : it's exactly the same fuinctoion except unsecure are ,not CRSF protected

BUT : since it's a plugin for admin : why not pluginhelper

www.limesurvey.org/manual/Add_new_menu_and_view_by_a_plugin

I tried for 4 hours to solve the problem. Now I just renamed the previous function to "public function NewUnsecureRequest" on a trial basis thanks to your hint and it works. Great.
Is it also "secure" to use this function or is the system then vulnerable?

One stupid question more (sorry...)

I want to add a "valid from" and "valid until" - Date Picker in the form of my plugin (using /admin/pluginhelper)

In my form I added the code: 
Then I get a 500-message:
"500: Interner Serverfehler Object of class DateTimePicker could not be converted to string"

Any ideas?