Fix CSRF vulnerabilities

[sql-web.git] / main.php

<?php
/*
	(c) 2005 Joe Presbrey
*/

require_once('mitsql.cfg.php');
require_once('mitsql.lib.php');
require_once('proc.lib.php');

if (!isLoggedIn()) redirect('index');

if(!isset($_SESSION['csrf_token']))
{
	$n = rand(10e16, 10e20);
	$_SESSION['csrf_token'] = base_convert($n, 10, 36);
}

$err1 = $msg1 = array();

$User = new User($Login->getUserID());

if (isPost()) {
	if($_SESSION['csrf_token'] != $_POST['csrf_token'])
	{
		$err1[] = "CSRF token incorrect or not found. Try submitting again.";
	} else {
		if (isset($i_newdb)) {
			list($msg1, $err1) = proc::newdb($User, $i_newdb);
		}
		if (isset($i_drop)) {
			list($msg1, $err1) = proc::drop($User, $i_drop);
		}
	}
}

if (!count($err1)) {//&& !isset($i_r))
	checkQuotas($Login->getUserID());
	$User->refresh();
}

$myDBs = $User->getDBList();

include 'tpl/main.php';

?>