Fix CSRF vulnerabilities

[sql-web.git] / global.act.php

<?php
/*
	(c) 2005 Joe Presbrey
*/

require_once('mitsql.cfg.php');
require_once('mitsql.lib.php');

$msg = $err = $timings = array();

## PROCESS CERTIFICATE

$SSLCred = getSSLCert();
$SSLName = '';
$SSLEmail = '';
$SSLUsername = '';

if (isOnline()) {
	
## HANDLE SOME GLOBAL ACTIONS

	if (isset($i_ssl)) {
		if (isSSL() && $i_ssl==1) redirect(newQS('ssl'));
		if (!isSSL() && $i_ssl==0) redirect(newQS('ssl'));
		redirect2(flipSSL());
	}
	if (isset($i_reset)) { session_destroy(); session_start(); redirect(newQS('reset')); }

## SETUP SESSION VARS

	$UserId = sess('UserId');
	$Login = new Login($UserId);

	if (isSSL() || !isLoggedIn()) {
		$SSLName = $SSLCred['Name'];
		$SSLUsername = $SSLCred['Username'];
		$SSLEmail = $SSLCred['Email'];

		/*$LoginSSL = sess('LoginSSL');
		if (!is_a($LoginSSL, 'Login')) { $LoginSSL = new Login($SSLUsername); }*/
		$LoginSSL = new Login(getUsernameID($SSLUsername));
		$LoginSSL->update($SSLCred['Name'],$SSLCred['Email']);

		if (!isLoggedIn() && !$LoginSSL->exists()) {
			if (!empty($SSLName))
				addUser($SSLCred);
			$LoginSSL = new Login(getUsernameID($SSLUsername));
		}
	} else {
		unset($_SESSION['LoginSSL']);
	}

	/*
	if (isPost() || isset($i_refresh)) {
		if (!empty($UserId)) {
			checkQuotas($UserId);
		}
		isset($i_refresh) && redirect('main?r');
	}
	*/

} // isOnline()

?>