Fix CSRF vulnerabilities

[sql-web.git] / login.php

<?php
/*
	(c) 2005 Joe Presbrey
*/

require_once('mitsql.cfg.php');
require_once('mitsql.lib.php');

if (isSSL()) {
	if (is_null($SSLCred)) {
		$err[] = 'Please install a valid certificate.';
	}
}

if (isPost() && empty($err)) {

	if (isSSL()) {
		$Login = $LoginSSL;
	} else {
		$Login = new Login($i_u, $i_p);
	}
	
	if ($Login->exists() && !$Login->isEnabled()) {
		$err[] = 'Account not active.';
	} elseif (!$Login->exists()) {
		$err[] = 'Nonexistant account or invalid password.';
	} elseif (!$Login->canLogin()) {
		$err[] = 'That account is no longer valid. Please contact the staff (sql@mit.edu).';
	}

	if (empty($err)) {
		sess('UserId', $Login->getUserId());
		redirect('main?refresh');
	}

}

isLoggedIn() && redirect('main');

include 'tpl/login.php';

?>