Fix CSRF vulnerabilities

[sql-web.git] / tpl / main.php

<?php

include 'head.php';

if (isset($i_dropask)) {
	$dropdbs = array_keys($i_dropask);
	echo '<form method="post" action="', $URI,'">';
	foreach($dropdbs as $dbname) {
		$msg1[] = 'Are you sure you want to drop `'.htmlentities($dbname).'`? <input style="position:absolute; right:20px;" type="submit" name="drop['.htmlentities($dbname).']" value="Yes">';
	}
	echo '</form>';
}

?>
<h3>Databases</h3>

<form method="post" action="<?=$URI?>">
<input type='hidden' name='csrf_token' value='<?php echo $_SESSION['csrf_token']; ?>'>
<?php printErrors($err1); ?>
<?php printMsgs($msg1); ?>
</form>

<table width="100%">
<form method="post" action="<?=$URI?>">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
<?php
	$bytes = $User->getBytes();
	$usage = $bytes['nBytes'];
	$total = $bytes['nBytesHard'];
	if (!count($myDBs)) {
		echo '<tr><td width="100%"><em>You have no databases. Add one below.</em></td></tr>';
	} else
	foreach($myDBs as $db) {
		echo '<tr><td width="100%">';
		if ($total>0)
			$percentage = $db['nBytes']/$total;
		else $percentage = 0;
		echo printBar($percentage, htmlentities($db['Name']), str_replace(' ', '&nbsp;', sprintSize($db['nBytes'])));
		echo '</td><td>';
		echo '<input type="submit" name="dropask[',htmlentities($db['Name']),']" value="drop">';
		echo '</td></tr>';
	}
	if ($total>0) {
		$percentage = $usage/$total;
	} else {
		$percentage = 0;
	}
	echo '<tr><td colspan=2>';
	echo '<hr />';
	echo '</td></tr>';
	echo '<tr><td colspan=2>';
	echo printBar($percentage, '<b>TOTAL&nbsp;USED</b>', str_replace(' ', '&nbsp;', sprintSize($usage).' of '.sprintSize($total)));
	echo '</td></tr>';
?>
</form>
</table>

<form method="post" action="<?=$URI?>">
<p align="right"><span style="width: 150px; font-style: italic;"><label for="p1">new database:</label></span> <?=$Login->getUsername()?>+<input type="text" name="newdb">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
<input type=submit value="add"></p>
</form>

<h3>Manage Data</h3>
<p>One interface we recommend for managing SQL data is <a href="https://scripts.mit.edu/~sql/phpMyAdmin/" target="_blank">phpMyAdmin</a>. Feel free to use it after you've created your databases.</p>

<?php

include 'foot.php';

?>