Fix CSRF vulnerabilities

[sql-web.git] / mitsql.cfg.php

diff --git a/mitsql.cfg.php b/mitsql.cfg.php
index 8d2c911a2e4f96db3d4dfe2079fd22ebf43b823f..0ef46c1c1337224eead0e1e38e0cff11f100dfe0 100755 (executable)
--- a/mitsql.cfg.php
+++ b/mitsql.cfg.php
@@ -2,44 +2,70 @@
 /*
     mitsql.cfg.php
        (c) 2005 Joe Presbrey
-       written for SIPB/MIT SQL service
 */
 
 $CWD = getcwd();
 chdir(dirname(__FILE__));
 
+file_exists('/etc/sql-mit-edu.cfg.php') && require('/etc/sql-mit-edu.cfg.php');
+file_exists('/usr/local/etc/sql-mit-edu.cfg.php') && require('/usr/local/etc/sql-mit-edu.cfg.php');
 file_exists('server.cfg.php') && require('server.cfg.php');
 defined('DEBUG') || define('DEBUG', 0);
 defined('DEVEL') || define('DEVEL', 0);
+defined('OFFLINE') || define('OFFLINE', 0);
 
-define('VER', '0.3');
+define('VER', '1.2');
 if (DEVEL) {
        define('VERSION', VER.'-dev');
+       defined('BASE_URL') || define('BASE_URL', '/dev/');
 } else {
        define('VERSION', VER);
+       defined('BASE_URL') || define('BASE_URL', '/main/');
 }
+defined('BASE_HTTP') || define('BASE_HTTP', 'http://sql.mit.edu');
+defined('BASE_HTTPS') || define('BASE_HTTPS', 'https://sql.mit.edu');
+defined('SIGNUP_URL') || define('SIGNUP_URL', BASE_HTTPS.BASE_URL.'do/batch/signup');
 
 define('DELIMETER', '+');
 defined('DBHOST') || define('DBHOST', 'sql.mit.edu');
-defined('BASE_URL') || define('BASE_URL', '/~sql/main/');
 defined('ADMINUSER') || define('ADMINUSER', 'root');
-defined('ADMINPASS') || define('ADMINPASS', base64_decode('TXlCZWF0c1Bvc3RA'));
+defined('ADMINPASS') || die('Please email sql@mit.edu');
 defined('ADMINDB') || define('ADMINDB', 'mitsql');
 
 $BASE_PATH = dirname(__FILE__).'/';
+define('BASE_PATH', $BASE_PATH);
+defined('TEMP_PATH') || define('TEMP_PATH', '/tmp');
+$URI = (isset($_SERVER["REDIRECT_URL"])?$_SERVER["REDIRECT_URL"]:'');
+if (empty($URI) && isset($_SERVER['REQUEST_URI'])) {
+       if (empty($_SERVER['QUERY_STRING'])) {
+               $URI = $_SERVER['REQUEST_URI'];
+       } else {
+               $URI = substr($_SERVER['REQUEST_URI'], 0, -strlen($_SERVER['QUERY_STRING'])-1);
+       }
+}
+define('URI', $URI);
+$THIS_PAGE = str_replace(BASE_URL, '', URI);
+define('THIS_PAGE', $THIS_PAGE);
 
 set_time_limit(0);
 ignore_user_abort(1);
 import_request_variables('cgp', 'i_');
+!DEVEL && ini_set('display_errors', 0);
 DEVEL && ini_set('display_errors', 1);
-DEVEL && error_reporting(E_ALL);
+error_reporting(E_ALL);
 set_include_path(get_include_path() . PATH_SEPARATOR . $BASE_PATH . 'lib/' . PATH_SEPARATOR . $BASE_PATH);
 
 require_once('defaults.cfg.php');
 
-$cxn = mysql_connect(DBHOST, ADMINUSER, ADMINPASS);
-mysql_select_db(ADMINDB,$cxn);
-if (mysql_error()) die(mysql_error());
+if (!OFFLINE) {
+       $cxn = mysql_connect(DBHOST, ADMINUSER, ADMINPASS);
+       mysql_select_db(ADMINDB,$cxn);
+       if (mysql_error()) {
+               require_once('errorhandler.lib.php');
+               trigger_error(mysql_error(),E_USER_ERROR);
+       }
+}
 
 chdir($CWD);
+
 ?>