X-Git-Url: http://andersk.mit.edu/gitweb/sql-web.git/blobdiff_plain/e476b401d3b3b5c617d8a26fc58ec32671daa237..96f685938defc906144aa50fe129f7343e9c73ea:/tpl/main.php

diff --git a/tpl/main.php b/tpl/main.php
index 25d10ed..fc642dd 100644
--- a/tpl/main.php
+++ b/tpl/main.php
@@ -4,23 +4,25 @@ include 'head.php';
 
 if (isset($i_dropask)) {
 	$dropdbs = array_keys($i_dropask);
-	echo '<form method="post">';
+	echo '<form method="post" action="', $URI,'">';
 	foreach($dropdbs as $dbname) {
-		$msg1[] = 'Are you sure you want to drop `'.$dbname.'`? <input style="position:absolute; right:20px;" type="submit" name="drop['.$dbname.']" value="Yes">';
+		$msg1[] = 'Are you sure you want to drop `'.htmlentities($dbname).'`? <input style="position:absolute; right:20px;" type="submit" name="drop['.htmlentities($dbname).']" value="Yes">';
 	}
 	echo '</form>';
 }
 
 ?>
-<h2>Databases</h2>
+<h3>Databases</h3>
 
-<form method="post">
+<form method="post" action="<?=$URI?>">
+<input type='hidden' name='csrf_token' value='<?php echo $_SESSION['csrf_token']; ?>'>
 <?php printErrors($err1); ?>
 <?php printMsgs($msg1); ?>
 </form>
 
 <table width="100%">
-<form method="post">
+<form method="post" action="<?=$URI?>">
+<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
 <?php
 	$bytes = $User->getBytes();
 	$usage = $bytes['nBytes'];
@@ -33,9 +35,9 @@ if (isset($i_dropask)) {
 		if ($total>0)
 			$percentage = $db['nBytes']/$total;
 		else $percentage = 0;
-		echo printBar($percentage, $db['Name'], str_replace(' ', '&nbsp;', sprintSize($db['nBytes'])));
+		echo printBar($percentage, htmlentities($db['Name']), str_replace(' ', '&nbsp;', sprintSize($db['nBytes'])));
 		echo '</td><td>';
-		echo '<input type="submit" name="dropask[',$db['Name'],']" value="drop">';
+		echo '<input type="submit" name="dropask[',htmlentities($db['Name']),']" value="drop">';
 		echo '</td></tr>';
 	}
 	if ($total>0) {
@@ -53,13 +55,14 @@ if (isset($i_dropask)) {
 </form>
 </table>
 
-<form method="post">
-<p align="right"><span style="width: 150px;"><label for="p1">new database:</label></span> <input type="text" name="newdb">
+<form method="post" action="<?=$URI?>">
+<p align="right"><span style="width: 150px; font-style: italic;"><label for="p1">new database:</label></span> <?=$Login->getUsername()?>+<input type="text" name="newdb">
+<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">
 <input type=submit value="add"></p>
 </form>
 
-<h2>Manage Data</h2>
-<p>One interface we recommend for managing SQL data is <a href="/~sql/phpMyAdmin/" target="_blank">phpMyAdmin</a>. Feel free to use it after you've created your databases.</p>
+<h3>Manage Data</h3>
+<p>One interface we recommend for managing SQL data is <a href="https://scripts.mit.edu/~sql/phpMyAdmin/" target="_blank">phpMyAdmin</a>. Feel free to use it after you've created your databases.</p>
 
 <?php