vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)
-   -   VERY quick avatar/attachment protector (https://vborg.vbsupport.ru/showthread.php?t=41065)

CJi 07-13-2002 10:00 PM
VERY quick avatar/attachment protector
 
This has probably been written before (I haven't checked), but I am beginning to get annoyed with people linking to my attachments/users avatars. It's quick, it's dirty, and it works. Installation time: 15 seconds per file. Number of files to edit: 2.

PHP Code:
$referers = array ('www.yourforums.com','yourforums.com','aaa.bbb.ccc.ddd'); 

function check_referer($referers){ 
   if (count($referers)){ 
      $found = false; 
      $temp = explode('/',getenv("HTTP_REFERER")); 
      $referer = $temp[2]; 
      for ($x=0; $x < count($referers); $x++){ 
         if (ereg ($referers[$x], $referer)) { 
            $found = true; 
         } 
      } 
      if (!$found){ 
      exit;
      } 
         return $found; 
      } else { 
         return true;
   } 
} 

check_referer($referers); 
Edit the $referers array with your details (DOMAINS and IP Addresses ONLY. Do NOT include path information or 'http://').

Place at the top of avatar.php and attachment.php just after:

PHP Code:
<?php
Hope this is of help to some people. :)

Boofo 07-14-2002 08:19 PM
I don't mean to sound ignorant, but exactly what does this do? :)

MrLister 07-14-2002 08:26 PM
It makes it so you can't link attachment URLs to different places.

Boofo 07-14-2002 09:14 PM
I guess I'm still not sure what it does. Sorry.

What will happen if someone DOES try to link to something then?

And what would you put in this line?

My site URL is http://www.bearfacts2.com/forum/

Is that what I would put here? :)

PHP Code:
$referers = array ('www.yourforums.com','yourforums.com','aaa.bbb.ccc.ddd'); 

Velocd 07-14-2002 10:15 PM
I'm guessing you read my thread that I posted yesterday of how I had this problem.

What he means to say Boofo is that its suppose to prevent hotlinking of your forums attachments or avatars from another site. If you hotlink an image attachment, every viewer who see's that attachment on that "other" site will come up on your forums as a guest, a very strange bug but I've had it happen to me.

I'll try this out later and see how it works ;)

CJi 07-14-2002 10:19 PM
Yup, anyone who tries to link to an image on your site (be it an avatar or an attachment) will just get a broken image/blank screen. It prevents bandwidth leeching/database slowness. Only sites listed in the $referer array will get the actual image/attachment/avatar requested.

Velocd 07-14-2002 10:20 PM
Quote:
Originally posted by Boofo

And what would you put in this line?

My site URL is http://www.bearfacts2.com/forum/

Is that what I would put here? :)
He stated plainly and clearly NOT to put the "http://" prefix.
Just put www.bearfacts2.com


I have a question about that line, this one here:
PHP Code:
$referers = array ('www.yourforums.com','yourforums.com','aaa.bbb.ccc.ddd'); 
Is it needed to state your domain twice as it shows above, just one is missing the www?

CJi 07-14-2002 10:21 PM
Quote:
Originally posted by Boofo


And what would you put in this line?

PHP Code:
$referers = array ('www.yourforums.com','yourforums.com','aaa.bbb.ccc.ddd'); 
You would put:

PHP Code:
$referers = array ('www.bearfacts2.com','bearfacts2.com','66.250.104.230'); 

CJi 07-14-2002 10:23 PM
Probably not with a bit more jiggery in the php, but like I said this was just a quicky. If you site is categorically only accessible via www., then it is not necessary to use the second entry without the www., and probably likewise for the IP address. I only did it that way for completeness.

Boofo 07-14-2002 10:59 PM
Ok, I see now. The 3 address are just in case someone tries to get around any one of the addresses to link to the files. It makes sense now. :) Thank you for the code, CJi. :)

Velocd, did it fix your problem? I haven't run into that yet, but it is always better to be prepared, I guess. :)

Quote:
Originally posted by CJi
Probably not with a bit more jiggery in the php, but like I said this was just a quicky. If you site is categorically only accessible via www., then it is not necessary to use the second entry without the www., and probably likewise for the IP address. I only did it that way for completeness.

Boofo 07-14-2002 11:04 PM
CJi, I forgot to ask in my last message...you can add more addresses to that, right, if you want some site to be able to link to it? But what would happen, if you did that, if someone linked to the extra site that you allowed in there? Is there any way to stop them from linking to that other site and bypassing it? I have a main site that I use for commercial purposes and I would maybe like to be able to links things to there. But if someone linked to my main site, this wouldn't do me any good, would it?

Velocd 07-15-2002 12:26 AM
A quick check, would this be ok (for the DOMAIN parts):
PHP Code:
$referers = array ('www.mysite.com/forums','mysite.com/forums','aaa.bbb.ccc.ddd'); 

Brainmaster 07-15-2002 12:43 AM
Quote:
PHP Code:
$referers = array ('www.yourforums.com','yourforums.com','aaa.bbb.ccc.ddd'); 

function check_referer($referers){ 
   if (count($referers)){ 
      $found = false; 
      $temp = explode('/',getenv("HTTP_REFERER")); 
      $referer = $temp[2]; 
      for ($x=0; $x < count($referers); $x++){ 
         if (ereg ($referers[$x], $referer)) { 
            $found = true; 
         } 
      } 
      if (!$found){ 
      exit;
      } 
         return $found; 
      } else { 
         return true;
   } 
} 

check_referer($referers); 
In what kind of file must I add this code?

Velocd 07-15-2002 01:12 AM
From post#1:

Quote:
Originally posted by CJi

Place at the top of avatar.php and attachment.php just after:

PHP Code:
<?php

JJR512 07-15-2002 01:41 AM
Question: The instructions say to place right after <?php. There is a similar hack, but to prevent attachment stealing, here: https://vborg.vbsupport.ru/showthrea...threadid=35399 Now this hack says to place the code after require("./global.php");. Is there a difference between either placement? Should I change my installation of that hack to place the code right after <?php, instead of after require("./global.php");?

Actually, upon closer examination, it looks like this version and that version are pretty different. Which one is better? ;)

Boofo 07-15-2002 02:36 AM
Is there any way to have this hack also display a picture or file to the user who is trying to crosslink to let them know that we know they are trying to do it (like in the hack that JJR512 mentioned)?

Boofo 07-15-2002 03:10 AM
Would there also be any way to make this work site-wide or forum specific? I want tp put up a couple of forums with pictures the wife has made in various programs (Bryce 5, PhotShop, etc.) and we want to keep others from linking to them.

Velocd 07-15-2002 03:48 AM
Lol, whenever you post Boofo it's usually in the form of doublepost, try using the edit button :)

More importantly though, I'm more interested in this request as well:

Quote:
Originally posted by JJR512

Actually, upon closer examination, it looks like this version and that version are pretty different. Which one is better? ;)
Any thoughts about this CJi?

PS: And Boofo, in your post above there are options in the cpanel of your site to prevent image stealing or certain directory access, so it shouldn't have to do with vbulletin.

Boofo 07-15-2002 03:57 AM
First of all, how do you spell edit? If I can't spell it, how can I use it? :)

Quote:
Originally posted by Velocd
Lol, whenever you post Boofo it's usually in the form of doublepost, try using the edit button :)

More importantly though, I'm more interested in this request as well:



Any thoughts about this CJi?


But how would that prevent linking from other sites? :)

Quote:
PS: And Boofo, in your post above there are options in the cpanel of your site to prevent image stealing or certain directory access, so it shouldn't have to do with vbulletin.

CJi 07-15-2002 07:34 AM
Velocd: You can't put any path declarations in the array, only a domain or IP address. So you can't add say, www.forums.com/forums/, only www.forums.com.

Bofo: Yep, you can add more, just add more fields to the array seperated by a comma.

JJR512: I can't comment on the other hack, I'm at work at the minute so don't really have time to check over it at the moment, but I'm imagining that the other hack uses some database resources, whereas this one doesn't. By sticking the code right at the top of the script, it cuts out processing time and disk access, as there is no need to include global.php and parse it's contents. This script simply checks where the request comes from, if it isn't known, it bombs right out, if it is allowed, it then goes forth to process the rest of the script. :)

Hope that helps.

CJi 07-15-2002 07:36 AM
Other requests I'll deal with later :) Got to get back to work now.

wot-Mike 07-15-2002 08:41 PM
Well, one request I have:

in case somebody is hotlinking, could this script be made so that a default image is served instead of the one they want?

I like the idea of advertising my site for free ;)

CJi 07-17-2002 06:55 AM
You'd be better off doing that with htaccess files, but the script could be changed to do this I suppose, although that wasn't it's intended purpose. I apologise for being busy, I'll attempt to get everything sorted out at the weekend.

WebMasterAJ 07-29-2002 12:23 PM
Perhaps I am missing the point of this hack, but should the image below be blank? My server is hosting that image, yet it is still displaying that image. If I am using the wrong hack for what I want to do, can someone please re-direct me?
Thanks!

http://www.finheaven.com/boardvb2/im...s/bear1-sm.gif

Chris M 07-29-2002 01:32 PM
Thats because...

That image isnt stored in Avatar.php

Satan

WebMasterAJ 07-29-2002 02:44 PM
This is gonna sound really stupid, and probably makes no sense.... but how do you store it in Avatar.php?

The only reason why I'm asking is because a lot of people are using my avatars for avatars on other message boards... and this isn't just one or two peopel... its more than 10...

Thanks for your help...

Chris M 07-29-2002 02:51 PM
By stored, i mean...

You havent linked that image from your avatar in your posts...

https://vborg.vbsupport.ru/avatar.ph...ine=1023286012

A link to my avatar at vB.org...

http://www.darkblazes.com/forums/ava...ine=1027536317

A link to my avatar at DarkBlazes.com (my forums)...

It get stored when you upload it as your avatar...Just like an attachment link from DarkBlazes.com wont work here...

You have to have actually requested that image/attachment from your board, not your server...

Satan

omniweapon 10-20-2002 08:50 PM
I installed this hack, but users are complaining saying they can't see the images even when they're on the forum. And I've put these in the referrers array:

www.ppgworld.com , ppgworld.com , 206.126.4.17

The forums are located on forums.ppgworld.com

NTLDR 10-20-2002 08:57 PM
Then you'll need to add forums.ppgworld.com too as your blocking that domain.

omniweapon 10-23-2002 04:58 PM
Did. Still caused problems with users. Had to uninstall it. :(

Mr_P 10-24-2002 03:24 AM
Quote:
Originally posted by omniweapon
I installed this hack, but users are complaining saying they can't see the images even when they're on the forum. And I've put these in the referrers array:

www.ppgworld.com , ppgworld.com , 206.126.4.17

The forums are located on forums.ppgworld.com
easy answer tell em to allow your site though their firewall not sure how it works but thats all i did and it works.

Before nobodys avator showed up so allowed pass on firewall and they all show now.

SWFans.net 10-31-2002 08:10 AM
I like the array set up of this one over how the other hot link prevention hack functions, but this hack just doesn't work for me, even with no firewall. No matter what, I get the echoed text I added so I could see what was going on.
PHP Code:
$referers = array ('www.sw-fans.net','sw-fans.net','swforums.net','www.swforums.net'); 

function check_referer($referers){ 
   if (count($referers)){ 
      $found = false; 
      for ($x=0; $x < count($referers); $x++){ 
      $temp = explode('/',getenv("HTTP_REFERER")); 
      $referer = $temp[2];
         if (ereg ($referers[$x], $referer)) { 
            $found = true; 
         } 
      } 
      if (!$found){
      echo "No hot linking allowed"; 
      exit;
      } 
         return $found; 
      } else { 
         return true;
   } 
} 

check_referer($referers); 

Boofo 12-29-2002 09:15 PM
You moved this line up a few lines from the original code, that is probably why you can get it to work.

Code:
for ($x=0; $x < count($referers); $x++){

Gutspiller 01-25-2003 05:14 PM
I can't get this hack to work over multiple domains. I tested it using one and it worked for me, so I now know it's working, but when I add a second domain like this:

PHP Code:
$referers = array ('www.theforumz.com','theforumz.com','209.197.232.166','www.3dnewz.com','3dnewz.com'); 
It still doesn't work from 3dNewz.com. I didn't add the ip of 3dnewz.com because 3dnewz.com just redirects to TheForumz.com

Can somebody help me on how to get this to work with multiple domains? I have about 5 I need to add to this hack. Please help.

smestas 01-31-2003 03:53 PM
CJi,

Thank you for this hack. It worked perfect firt time!

Thanks!

laycomp 03-24-2003 04:54 PM
Very much help indeed, THANK YOU CJi!! :knockedout:

laycomp 03-25-2003 03:54 PM
I am having some problems.

I am using vb 2.3, I cannot get link protection for either avatar or attachment.

The avatars appear in my forum as typical "miising image" icons, I have worked with many perl/php scripts and well aware on entering referers for protection, I however, cannot get this too work. As far as attachments, when someone clicks, from the forum, an attachment link, he goes into a blank page.

I have tried my domain, my IP...you name it.

I do have a router.

Any suggestions please?

Regards,

LC

CJi 04-27-2003 09:07 PM
To be honest, for ultimate protection it's best to use htaccess. What you need to bear in mind is users can choose to withold, or even warp referrers, so hacks like this will never work. It's annoying, but 'one of those things'

NanoEntity 04-28-2003 12:41 AM
There is a very simple way, you can do it with .htaccess, even diplay an image of your choice on a website that is linking your image.

Can protect whole domain or just 1 folder.

Anyways, nicely done :)

Boofo 04-28-2003 12:46 AM
Quote:
Today at 08:41 PM NanoEntity said this in Post #39
There is a very simple way, you can do it with .htaccess, even diplay an image of your choice on a website that is linking your image.

Can protect whole domain or just 1 folder.

Anyways, nicely done :)
How would you do that?


All times are GMT. The time now is 09:31 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.02935 seconds
  • Memory Usage 1,863KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (11)bbcode_php_printable
  • (10)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete