Gossamer Forum
Home : Products : Links 2.0 : Customization :

Dealing with stolen add.cgi

Quote Reply
Dealing with stolen add.cgi
As an addition to the Refereer Check mod, I have made this simple little script to tell those who steal our add.cgi's to stop doing so - my Links site (about webmasters resources) is getting a lot of additions about cheesecakes instead of cookies, green tea instead of java-beans, homebusiness administration instead of website administration, and so on ...

I tracked down SubmitEasy from http://www.fluid3d.com/ as the "sinner". I mailed the owner, but he just said he got the address from somewhere else, and wouldn't tell me where ...

So, I hacked the add.cgi to become this simple "reminder service", sending him an email each time someone uses the add.cgi. Of course, I changed the original add.cgi to another name (in the links.cfg as well as the actual filename).

#!/usr/bin/perl5
#
# John Gotze's nasty add.cgi ========================================================

$db_mail_path = "/usr/bin/sendmail -t";

print "Content-Type: text/html\n\n";
print "DON'T USE THIS SCRIPT!\n";
print "$ENV{'REMOTE_HOST'} and more has been logged, and your mom has been told!";

{
open (MAIL, "|$db_mail_path");
print MAIL "To: tommy\@fluid3d.com, john\@gotzespace.dk\n";
print MAIL "From: john\@gotzespace.dk\n";
print MAIL "Subject: \n\n";
print MAIL "This mail is sent automatically as a consequence of someone using your software.\n";
print MAIL "Someone from $ENV{'REMOTE_HOST'} has used your submit-system with an illegal site, namely mine.\n";
print MAIL "Please update your list of sites!\n";
print MAIL "A copy has been sent to john\@gotzespace.dk, the owner of http://www.gotzespace.dk/links/\n";
print MAIL "which is the site to be removed from your software - as you promised earlier.\n";
close MAIL;
}

I set it to send a copy of the mail to myself, so I can see whether someone uses it (someone did, I got a mail just an hour after setting up the script ...).

John

[This message has been edited by gotze (edited December 12, 1998).]
Quote Reply
Re: Dealing with stolen add.cgi In reply to
Hi John,

cool idea. I had a laugh. But, the name of your new add.cgi will soon be found out. So this kind of protection will not last very long.

Anyway, it's nice really.

Best wishes

Michael
Quote Reply
Re: Dealing with stolen add.cgi In reply to
Can you kindly explain how or why this happens?

Someone uses your script to add categories to your site?

Dont you have to validate them first before they are added?
Quote Reply
Re: Dealing with stolen add.cgi In reply to
Hi RobC,

the submit urls to his site. Remotely. He don't want that, even though they have to be validated, you have to work on it. At least you have to delete them, check out if they had been added on his own web-site or not etc. If lot's of submissions come from remote submission services, this can be hard. Especially if you don't want that.

That's it, if I'm right.

Take care


Michael
Quote Reply
Re: Dealing with stolen add.cgi In reply to
Yes, that's it, Zoul!
It wouldn't be a problem if it were relevant links, but since they aren't, it is indeed annoying with the validation process, where I have to delete stuff.

John
Quote Reply
Re: Dealing with stolen add.cgi In reply to
I also had a problem with site submissions by SubmitEasy and took care of the problem a different way. In add.cgi, I did the following:

# Modified 7/23/98: Added Referer Check to Add A Link script
if
(($ENV{'HTTP_REFERER'} !~ /$good_referer/i) | | ($ENV{'HTTP_USER_AGENT'} =~ "SubmitEasy"))
{
print "Content-type: text/html\n\n";
$output = qq|
<html>
[.. Lots of HTML code excluded ...]
<blockquote>
You are attempting to access <b>Bob's Good Stuff Lists: Add A Link</b> from a site that is not part of Bob's Good Stuff Lists or are using a submission robot. This is not permitted. You may add links <b>ONLY</b> by accessing this script from any of Bob's Good Stuff Lists pages.
<p>
If you are using Netscape Navigator, use <a href="http://www.orphanage.com/goodstuff/add.cgi">Add A Link</a> to enter.
<p>
If you are using the Microsoft Internet Explorer or Lynx browsers, you will need to close and restart your browser and then use the <b>"Add A Link"</b> located at <b>http://www.orphanage.com/goodstuff/</b> since these browsers will just continuously load this error notice. Other browsers may have similar problems.
</blockquote>
[.. Much HTML code excluded ...]
</html>
|;
print $output;
exit;

It works well. Since I did it, not one SubmitEasy submission has been detected.

The code was added to add.cgi between the "eval" and "if ($@)" lines.

$good_referer is defined in my links.cfg as:
$good_referer = 'orphanage.com';

------------------
Bob Connors
bobsie@orphanage.com
www.orphanage.com/goodstuff/
goodstufflists.home.ml.org/


[This message has been edited by Bobsie (edited December 14, 1998).]
Quote Reply
Re: Dealing with stolen add.cgi In reply to
Nice, Bob. However, SubmitEasy is not using a webbrowser, so your page is never shown to the people who use it. Anyway, it does the job (of not polluting your database).

John
Quote Reply
Re: Dealing with stolen add.cgi In reply to
You know, you are probably right. On that basis, all that would need to be done is change the top of what I posted to read as follows:

if ($ENV{'HTTP_USER_AGENT'} =~ "SubmitEasy"))
{ exit; }
elsif ($ENV{'HTTP_REFERER'} !~ /$good_referer/i)
print "Content-type: text/html\n\n";
etc....

That would do the same thing without displaying (or trying to display) the error page.

------------------
Bob Connors
bobsie@orphanage.com
www.orphanage.com/goodstuff/
goodstufflists.home.ml.org/