login.php: Escape quotes in the referer field
[aur.git] / web / html / login.php
blobdf51705569d8319889c7184de4db0bf06293257c
1 <?php
2 set_include_path(get_include_path() . PATH_SEPARATOR . '../lib');
4 include_once("aur.inc.php");
6 $disable_http_login = config_get_bool('options', 'disable_http_login');
7 if (!$disable_http_login || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) {
8 $login = try_login();
9 $login_error = $login['error'];
12 html_header('AUR ' . __("Login"));
14 <div id="dev-login" class="box">
15 <h2>AUR <?= __('Login') ?></h2>
16 <?php if (isset($_COOKIE["AURSID"])): ?>
17 <p>
18 <?= __("Logged-in as: %s", '<strong>' . username_from_sid($_COOKIE["AURSID"]) . '</strong>'); ?>
19 <a href="<?= get_uri('/logout/'); ?>">[<?= __("Logout"); ?>]</a>
20 </p>
21 <?php elseif (!$disable_http_login || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])): ?>
22 <form method="post" action="<?= get_uri('/login') ?>">
23 <fieldset>
24 <legend><?= __('Enter login credentials') ?></legend>
25 <?php if (!empty($login_error)): ?>
26 <ul class="errorlist"><li><?= $login_error ?></li></ul>
27 <?php endif; ?>
28 <p>
29 <label for="id_username"><?= __('User name or email address') . ':'; ?></label>
30 <input id="id_username" type="text" name="user" size="30" maxlength="<?= max(config_get_int('options', 'username_max_len'), 254); ?>" value="<?php if (isset($_POST['user'])) { print htmlspecialchars($_POST['user'], ENT_QUOTES); } ?>" autofocus="autofocus" />
31 </p>
32 <p>
33 <label for="id_password"><?= __('Password') . ':'; ?></label>
34 <input id="id_password" type="password" name="passwd" size="30" />
35 </p>
36 <p>
37 <input type="checkbox" name="remember_me" id="id_remember_me" />
38 <label for="id_remember_me"><?= __("Remember me"); ?></label>
39 </p>
40 <p>
41 <input type="submit" class="button" value="<?php print __("Login"); ?>" />
42 <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a>
43 <?php if (in_request('referer') !== ""): ?>
44 <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars(in_request('referer'), ENT_QUOTES) ?>" />
45 <?php elseif (isset($_SERVER['HTTP_REFERER'])): ?>
46 <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" />
47 <?php endif; ?>
48 </p>
49 </fieldset>
50 </form>
51 <?php else: ?>
52 <p>
53 <?php printf(__("HTTP login is disabled. Please %sswitch to HTTPs%s if you want to login."),
54 '<a href="' . get_uri('/login', true) . '">', '</a>'); ?>
55 </p>
56 <?php endif; ?>
57 </div>
58 <?php
59 html_footer(AURWEB_VERSION);