We got this part of code which is supposed to protect the script from working when invoked out of our own domain:

However....
#########
#Valid page

$DN=$ENV{'HTTP_REFERER'};
if ($DN eq "") {
print "Sorry You can't run this script from this page\n";
exit;
}

$DN =~ tr/A-Z/a-z/;

if ($DN =~ /nonsong.org/i) {
$stayin=1;
}
else {
print "Sorry You can't run this script from this page\n";
exit;
}
########

However, another person can simply load a page with name : nonsong.org.html
and is able to use our script.

Please let us know if you have fix to this.

Thank you for your time.

Have you tried $ENV{'SERVER_NAME'} instead of $ENV{'HTTP_REFERER'}? Example:


Hope this helps,
Chris



------------------
webmaster@racedaze.com

Thanks a lot Chris!

Problem, $ENV{SERVER_NAME} returns the name of the host server the script is running on, not the name of the server the user is on. Therefore, it will always return true and will not prevent access as is desired.


Try changing the line:


to read:


I hope this helps.

Funny thing, according to Bobsie, the code Chris gave should work no matter where my script is called from.

However when I tried Chris version it made the script unusable completely. EVEN when I was calling the script from my own server.

I tried Bobsie code and it works fine.

Now I am interested in knowing why Chris code totally prevents the script from being called ?

[This message has been edited by Hieu (edited May 25, 1999).]

The SERVER_NAME environment variable gets exactly that, the server name, but it's the server that the script is on. That's why you have to check HTTP_REFERER, which will be the page the user comes from.

Here's some sample code to check from an array of allowed referers. Your array should contain both "yourdomain.com" and "www.yourdomain.com", and any other domains that are allowed to use this script, like this:

referers = ("www.yourdomain.com","yourdomain.com","another.domain.com");

And here's the code:


You can lose the array altogether, using a regex to strip the "www.", and remove the foreach loop, but it's just as handy to leave it in, in case you wanted to add other allowed referer's later.

One point about using HTTP_REFERER in this capacity, users won't be able to bookmark your script. If they do, they won't have a valid referer, so they'll get the error message.

Cheers,
adam

[This message has been edited by dahamsta (edited May 25, 1999).]

Another point about HTTP_REFERER, it only prevents casual browsing. Since the referer is provided by the browser, you can't trust it to be accurate. It's very easy to forge a referer header and get access.

If you want to block, I would recommend using Apache and block by IP address or IP range.

Cheers,

Alex