Fix CSRF vulnerabilities

[sql-web.git] / mitsql.cfg.php

diff --git a/mitsql.cfg.php b/mitsql.cfg.php
index 6a5acfda080832a5c119e6d8905b3129491fad0c..0ef46c1c1337224eead0e1e38e0cff11f100dfe0 100755 (executable)
--- a/mitsql.cfg.php
+++ b/mitsql.cfg.php
@@ -17,11 +17,14 @@ defined('OFFLINE') || define('OFFLINE', 0);
 define('VER', '1.2');
 if (DEVEL) {
        define('VERSION', VER.'-dev');
-       defined('BASE_URL') || define('BASE_URL', '/~sql/dev/');
+       defined('BASE_URL') || define('BASE_URL', '/dev/');
 } else {
        define('VERSION', VER);
-       defined('BASE_URL') || define('BASE_URL', '/~sql/main/');
+       defined('BASE_URL') || define('BASE_URL', '/main/');
 }
+defined('BASE_HTTP') || define('BASE_HTTP', 'http://sql.mit.edu');
+defined('BASE_HTTPS') || define('BASE_HTTPS', 'https://sql.mit.edu');
+defined('SIGNUP_URL') || define('SIGNUP_URL', BASE_HTTPS.BASE_URL.'do/batch/signup');
 
 define('DELIMETER', '+');
 defined('DBHOST') || define('DBHOST', 'sql.mit.edu');
@@ -31,8 +34,15 @@ defined('ADMINDB') || define('ADMINDB', 'mitsql');
 
 $BASE_PATH = dirname(__FILE__).'/';
 define('BASE_PATH', $BASE_PATH);
+defined('TEMP_PATH') || define('TEMP_PATH', '/tmp');
 $URI = (isset($_SERVER["REDIRECT_URL"])?$_SERVER["REDIRECT_URL"]:'');
-$URI = ((empty($URI) && isset($_SERVER['REQUEST_URI']))?$_SERVER['REQUEST_URI']:$URI);
+if (empty($URI) && isset($_SERVER['REQUEST_URI'])) {
+       if (empty($_SERVER['QUERY_STRING'])) {
+               $URI = $_SERVER['REQUEST_URI'];
+       } else {
+               $URI = substr($_SERVER['REQUEST_URI'], 0, -strlen($_SERVER['QUERY_STRING'])-1);
+       }
+}
 define('URI', $URI);
 $THIS_PAGE = str_replace(BASE_URL, '', URI);
 define('THIS_PAGE', $THIS_PAGE);