[WotC_Tech]

Originally Posted by Kier

The code you have there is potentially problematic - try replacing it with this:

PHP Code:

if (!empty($_POST['do']) AND strpos(strtolower($_SERVER['HTTP_REFERER']), strtolower($_SERVER['HTTP_HOST'])) === false)
{
print_no_permission();
} 


To prevent bypassing this mechanism it might be better to check only the "host" portion of the referer:

PHP Code:

$parsed_referer=parse_url($_SERVER['HTTP_REFERER']);
if ((!empty($_POST['do'])) AND
  (strtolower($parsed_referer['host']) != strtolower($_SERVER['HTTP_HOST'])))
{ print_no_permission(); } 


Otherwise an attacker could simply append the hostname of the forum server to the end of the URL.

-Mike