Hot linking blocking in attatchment.php?

[krohnathlonman]

I've been thinking about looking into this... If anybodies already done it please hook me up with it I've been using the VB attatchment system for all of my articles and now the article images are getting hotlinked fairly often.

[Zachery]

Originally Posted by krohnathlonman

I've been thinking about looking into this... If anybodies already done it please hook me up with it I've been using the VB attatchment system for all of my articles and now the article images are getting hotlinked fairly often.

I think the simpilest thing to do is not allow guests to view attachments

[alan92rttt]

PHP Code:

$url=parse_url($HTTP_REFERER);
if(!empty($url["host"])&&strpos($url["host"],'vbulletin.org')==0){
    echo "Error 500-invalid server call - ".$url["host"]." - Remote linking Denied";
    exit;
} 


Just change vbulletin.org to your site.

This only works of the browser is providing referer.

Then echo can be totally removed.

[Andreas]

@alan92rttt
This will not work, as the user can set the referrer to any value he wants.

[Jolten]

Originally Posted by Zachery

I think the simpilest thing to do is not allow guests to view attachments

True.. but not always possible. My site is geared towards guests seeing images, letting them hot link is another matter.

.htaccess does a pretty good job though.

[dstruct2k]

Originally Posted by KirbyDE

@alan92rttt
This will not work, as the user can set the referrer to any value he wants.

How desperate are people getting if they're altering their referrer just to see one image?

[eoc_Jason]

Using a .htaccess file to prevent hotlinking works on the same principle as the code posted above. Because of the session-less design of HTTP, there are really only 2 ways you can prevent hotlinking. 1 - referrer url or 2 - user authentication.

[JBMoney]

.htaccess won't protect attachments though, will it? It won't keep someone from using a img src tag to post an attachment from your Forum to where ever they want to. How can that be done?