Fix CSRF vulnerabilities

[sql-web.git] / global.act.php

diff --git a/global.act.php b/global.act.php
index 6c4b54067814c0060fd84cef64f759954948487b..ee34748a31ab6385433813a80b9ed737c6935eb8 100644 (file)
--- a/global.act.php
+++ b/global.act.php
@@ -1,20 +1,64 @@
 <?php
+/*
+       (c) 2005 Joe Presbrey
+*/
 
+require_once('mitsql.cfg.php');
 require_once('mitsql.lib.php');
 
-if (isset($i_reset)) { session_destroy(); session_start(); redirect(newQS('reset')); }
+$msg = $err = $timings = array();
 
-## SESSION VARS
+## PROCESS CERTIFICATE
 
-$timings = array();
-$UserId = 0;
-$Login = sess('Login');
+$SSLCred = getSSLCert();
+$SSLName = '';
+$SSLEmail = '';
+$SSLUsername = '';
 
-if (is_a($Login,'Login')) {
-    $UserId = $Login->getUserId();
-       $Name = $Login->getName();
-       $Email = $Login->getEmail();
-       $UL = $Login->getUL();
-}
+if (isOnline()) {
+       
+## HANDLE SOME GLOBAL ACTIONS
+
+       if (isset($i_ssl)) {
+               if (isSSL() && $i_ssl==1) redirect(newQS('ssl'));
+               if (!isSSL() && $i_ssl==0) redirect(newQS('ssl'));
+               redirect2(flipSSL());
+       }
+       if (isset($i_reset)) { session_destroy(); session_start(); redirect(newQS('reset')); }
+
+## SETUP SESSION VARS
+
+       $UserId = sess('UserId');
+       $Login = new Login($UserId);
+
+       if (isSSL() || !isLoggedIn()) {
+               $SSLName = $SSLCred['Name'];
+               $SSLUsername = $SSLCred['Username'];
+               $SSLEmail = $SSLCred['Email'];
+
+               /*$LoginSSL = sess('LoginSSL');
+               if (!is_a($LoginSSL, 'Login')) { $LoginSSL = new Login($SSLUsername); }*/
+               $LoginSSL = new Login(getUsernameID($SSLUsername));
+               $LoginSSL->update($SSLCred['Name'],$SSLCred['Email']);
+
+               if (!isLoggedIn() && !$LoginSSL->exists()) {
+                       if (!empty($SSLName))
+                               addUser($SSLCred);
+                       $LoginSSL = new Login(getUsernameID($SSLUsername));
+               }
+       } else {
+               unset($_SESSION['LoginSSL']);
+       }
+
+       /*
+       if (isPost() || isset($i_refresh)) {
+               if (!empty($UserId)) {
+                       checkQuotas($UserId);
+               }
+               isset($i_refresh) && redirect('main?r');
+       }
+       */
+
+} // isOnline()
 
 ?>