a bunch of stuff happened. I'll do better next commit...

classes/SignIn.php

@@ -40,7 +40,7 @@ class SignIn extends Base {
 
             case "prompt":
 
-                $XSLParms["BTN_SUBMIT"]     = "main.php?action=SignIn.login&step=authenticate";
+                $XSLParms["BTN_SUBMIT"]     = "main.php";
                 $XSLParms["INVALID_SIGNIN"] = "FALSE";
 
                 echo $this->applyXSL("", $this->getXSL("signIn"), $XSLParms);
@@ -50,10 +50,15 @@ class SignIn extends Base {
 
             case "authenticate":
 
+                if (!$this->validAuthRequest()) {
+                    http_response_code(403);
+                    exit('Invalid authentication request. Reload the sign-in page.');
+                }
+
                 $user_name     = trim(filter_input(INPUT_POST, "user_name") ?: "");
                 $user_password = filter_input(INPUT_POST, "user_password")  ?: "";
 
-                $XSLParms["BTN_SUBMIT"]     = "main.php?action=SignIn.login&step=authenticate";
+                $XSLParms["BTN_SUBMIT"]     = "main.php";
                 $XSLParms["INVALID_SIGNIN"] = "TRUE";
 
                 $user = (new Users())->getUserByUserName($user_name);
@@ -102,14 +107,14 @@ class SignIn extends Base {
 
                 (new Users())->updateLogin();
 
-                header("Location: ./");
+                header("Location: main.php");
                 exit();
 
                 break;
 
             default:
                 // User NOT Validated.
-                header("Location: ./");
+                header("Location: main.php");
                 exit();
         }
     }