Fix CSRF vulnerabilities

[sql-web.git] / signup.php

<?php
/*
	(c) 2005 Joe Presbrey
*/

require_once('mitsql.cfg.php');
require_once('mitsql.lib.php');

if (!isSSL())
	redirect('signup',true);

if (isLoggedIn()) {

	redirect('index');

} else {
	
	if (is_null($SSLCred)) {
		$err[] = 'Please install a valid certificate.';
	} else {
		if (isPost() && $LoginSSL->canSignup()) {
			if (empty($i_p1)) {
				$err[] = 'Your password may not be blank.';
			} elseif ($i_p1 != $i_p2) {
				$err[] = 'Your confirmation password does not match.';
			} else {
				$u = new User($LoginSSL->getUserId());
				$u->signup($i_p1);
                // TODO: missing function call, replace?
				// $LoginSSL->refresh();
				redirect('login', true);
			}
		} elseif (isPost()) {
			$err[] = 'You may not signup.';
		}
	}
}

include 'tpl/signup.php';

?>