vb.org Archive - Admin CP & $_SERVER['HTTP

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - Admin CP & $_SERVER['HTTP_REFERER'] (https://vborg.vbsupport.ru/showthread.php?t=223613)

James Birkett

09-19-2009 10:21 PM

Admin CP & $_SERVER['HTTP_REFERER']

Is there a method of making the only means of accessing the admincp and modcp directories via a referrer from that direct URL?

PHP Code:


		
			
if($_SERVER['HTTP_REFERER'] != "http://www.example.com/*"){

header("location: http://www.example.com/");

}

Is this method reliable? Do vBulletin send referring headers by default? and can you use wildcards (like I did above)?

Adrian Schneider

09-19-2009 11:13 PM

For security?

It's easy to spoof the referrer, so it's not reliable at all. AFAIK not all browsers send the header either (though most do).

If you wanted a wildcard, you could use another function like strpos.

PHP Code:


		
			
if (strpos($_SERVER['HTTP_REFERER'], 'http://www.example.com') !== 0) {
    
}

Translates to, if referer string does NOT start with "http://www.example.com" then...

Anyway, not recommended if this is a preemptive strike for security.

James Birkett

09-20-2009 01:27 AM

It was just as a basic attempt to stop people directly linking to our admin CPs (i.e. having to log in first, then I would create a script to stop users & mods getting to the admin CP.

All times are GMT. The time now is 11:19 PM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01120 seconds Memory Usage 1,714KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (3)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: