[topcmm]

Originally Posted by hqarrse

A final note. I strongly recommend that you protect chat_login.php from access by any IP except the chat server. The script allows rapid unrestricted testing of username/password pairs and is therefore a major security weakpoint. I have posted this on the 123Flashchat forums and hope they will include this in their docs or protect the script in some way.

That's a great idea! thank you. but it only works for apache web server, and it will be a little bit complicated to configure the web server, to edit .htaccess or httpd.conf ,
and here is a solution to resolve it, just add the code below in the beginning of login_chat.php

PHP Code:

$sAllowedIPs = "127.0.0.1"; // Set allowd ip addresses, config sample: $sAllowedIPs = "127.0.0.1, 1.2.3.4";
if (trim($sAllowedIPs))
{
    $aAllowedIPs = array_map("trim", explode(',',$sAllowedIPs));
    $sIP = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
    if(!in_array($sIP, $aAllowedIPs)) exit;
}