Double-check auth in critical functions. Improve use of the global namespace.

web/includes/auth.php

@@ -4,7 +4,7 @@
 session_start();
 
 function login($username, $password) {
-	require 'config.php';
+	global $PAM_SERVICE;
 	$username = preg_replace('/\W/', '_', $username);
 
 	# Set the PAM service name
@@ -22,7 +22,8 @@ function login($username, $password) {
 }
 
 function login_redirect() {
-	$url = './';
+	global $MAIN_PAGE;
+	$url = $MAIN_PAGE;
 	if (isset($_GET['dest'])) {
 		$url = $_GET['dest'];
 	}
@@ -30,10 +31,10 @@ function login_redirect() {
 }
 
 function logout() {
-	require 'config.php';
+	global $MAIN_PAGE;
 	unset($_SESSION['USER']);
 	session_regenerate_id(true);
-	header('Location: ./');
+	header('Location: ' . $MAIN_PAGE);
 	exit();
 }
 
@@ -46,7 +47,7 @@ function authenticated() {
 }
 
 function require_authentication() {
-	require 'config.php';
+	global $LOGIN_PAGE;
 	if (!authenticated()) {
 
 		# Provide the current URL for post-auth redirect, if possible
@@ -68,4 +69,10 @@ function require_authentication() {
 	}
 }
 
+function die_if_not_authenticated() {
+	if (!authenticated) {
+		die('Failure: Auth');
+	}
+}
+
 ?>

web/includes/config.php

@@ -19,5 +19,6 @@ $CONTENT_FILES = array('must_match', 'search_name', 'excludes');
 ### Auth Config
 $LOGIN_PAGE  = 'login';
 $PAM_SERVICE = 'tv_web';
+$MAIN_PAGE = '/tv/';
 
 ?>

web/includes/season.php

@@ -80,6 +80,8 @@ function findSeasons($series) {
 
 # Save the search status for all seasons in a series
 function saveSeasons($series, $data, $series_last, $seasons_last) {
+	die_if_not_authenticated();
+
 	# Do nothing if we are or just were in "skip" mode
 	if ($data['skip'] || $series_last['skip']) {
 		return;
@@ -107,6 +109,7 @@ function saveSeasons($series, $data, $series_last, $seasons_last) {
 
 # Add the specified season folder
 function addSeason($series, $season) {
+	die_if_not_authenticated();
 
 	# Cheap validation
 	$season = intval($season);
@@ -138,6 +141,7 @@ function addSeason($series, $season) {
 
 # Remove the specified season folder, if possible (i.e. if empty)
 function delSeason($series, $season) {
+	die_if_not_authenticated();
 
 	# Ensure the series exists
 	if (!seriesExists($series)) {

web/includes/series.php

@@ -108,6 +108,8 @@ function readFlags($series) {
 
 # Parse and save all of the serires-level exists and content files
 function saveFlags($series, $data, $series_last, $seasons_last) {
+	die_if_not_authenticated();
+
 	global $EXISTS_FILES;
 	global $CONTENT_FILES;
 
@@ -165,6 +167,8 @@ function saveFlags($series, $data, $series_last, $seasons_last) {
 
 # Add a series as identified by TVDB URL or ID
 function addSeries($str) {
+	die_if_not_authenticated();
+
 	global $TVDB_LANG_ID;
 	$id     = false;
 	$lid    = false;

web/includes/tvdb.php

@@ -1,6 +1,5 @@
 <?
 
-require 'config.php';
 $TVDB_DOWNLOAD_TIME  = 0;
 $TVDB_DOWNLOAD_COUNT = 0;
 

web/includes/util.php

@@ -1,7 +1,5 @@
 <?
 
-require 'config.php';
-
 # Cleanup the provided series name
 # This does NOT provide comprehensively safe output,
 # it merely attempts to make names compatible with the filesystem and local convetions

web/includes/webloc.php

@@ -1,8 +1,8 @@
 <?
 
-require 'config.php';
-
 function writeWebloc($url, $path) {
+	die_if_not_authenticated();
+
 	$encoded_url = htmlspecialchars($url, ENT_XML1, 'UTF-8');
 
 	$str = '<?xml version="1.0" encoding="UTF-8"?>';