]> andersk Git - sql-web.git/blob - main.php
Fix CSRF vulnerabilities
[sql-web.git] / main.php
1 <?php
2 /*
3         (c) 2005 Joe Presbrey
4 */
5
6 require_once('mitsql.cfg.php');
7 require_once('mitsql.lib.php');
8 require_once('proc.lib.php');
9
10 if (!isLoggedIn()) redirect('index');
11
12 if(!isset($_SESSION['csrf_token']))
13 {
14         $n = rand(10e16, 10e20);
15         $_SESSION['csrf_token'] = base_convert($n, 10, 36);
16 }
17
18 $err1 = $msg1 = array();
19
20 $User = new User($Login->getUserID());
21
22 if (isPost()) {
23         if($_SESSION['csrf_token'] != $_POST['csrf_token'])
24         {
25                 $err1[] = "CSRF token incorrect or not found. Try submitting again.";
26         } else {
27                 if (isset($i_newdb)) {
28                         list($msg1, $err1) = proc::newdb($User, $i_newdb);
29                 }
30                 if (isset($i_drop)) {
31                         list($msg1, $err1) = proc::drop($User, $i_drop);
32                 }
33         }
34 }
35
36 if (!count($err1)) {//&& !isset($i_r))
37         checkQuotas($Login->getUserID());
38         $User->refresh();
39 }
40
41 $myDBs = $User->getDBList();
42
43 include 'tpl/main.php';
44
45 ?>
This page took 0.063641 seconds and 5 git commands to generate.