Stop Users from Cross-linking Attachments

I've hacked my attachment.php script to prevent users from posting an attachment on my board, and then using the HTML to display it somewhere else. This prevents people from posting a pic on your board, then using your bandwidth to place that pic elsewhere. It is a tiny code change.

I've substituted my own logo, (LOL), but you can replace that with anything, or just use the "exit;" line to eliminate the pic entirely.

In attachment.php, right after:

PHP Code:

require("./global.php"); 


Add the following code:

PHP Code:

// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($_SERVER['HTTP_REFERER']); 
$checkurl = strtolower($url["host"]); 
if (! strstr($checkurl, "yourdomain")) {

    // Remove this code if you just want to break the image
    // Substitute my Logo
    header("Content-Type: image/gif"); 
    $filename = "/usr/public_html/grafix/logo.gif";
    $image = fread(fopen($filename,"r"),100000); 
    echo $image; 
    fclose($image);
    // End Substitute my Logo

    exit; 
} 


Change yourdomain to your actual domain name, and the logo URL to what you want to replace the cross-linked image with.

NOTE: Changed to use the full path in "$filename = ..." to get this to work on some servers.

ANOTHER: See this post in this thread for a modification that works on Win32 servers: https://vborg.vbsupport.ru/showthrea...895#post297895

AGAIN: If you modify avatar.php similarly, you can prevent people from cross-linking your avatars: https://vborg.vbsupport.ru/showthrea...893#post303893

UPDATE: The parse_url line is slightly different to use the new PHP syntax.

[BigCheeze]

Seems to work perfect in 2.28! Great hack! Thanks!!

[exTracT]

I run 2.28 and Cannot seem to get this to work with trilOByte's Welcome panel hack. the code works so i cannot hotlink the avatar, but in the welcome panel it also shows my logo instead of the users avatar. any help would be awsome! thanks

// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($HTTP_REFERER);
$checkurl = strtolower($url["host"]);
if (false === strpos($checkurl, "wpgrevscene") ||
false === strpos($checkurl, "winnipegrevscene")) {
// Remove this code if you just want to break the image
// Substitute my Logo
header("Content-Type: image/gif");
$filename = "/home/wpgrevsc/www/images/wpgrev.gif";
$image = fread(fopen($filename,"r"),100000);
echo $image;
fclose($image);
// End Substitute my Logo

exit;
}

[SpeedStreet]

Will this also work if you place it somewhere for smilies?

Where the heck would it go?

[Guru]

I have no clue for the last two questions. Anyone?

[FWC]

Originally posted by SpeedStreet
Will this also work if you place it somewhere for smilies?

Where the heck would it go?

An .htaccess file in the smilies directory would do the trick. Something along the lines of:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$ 
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com.* [NC] 
RewriteCond %{HTTP_REFERER} !^http://yourdomian.com.* [NC] 
RewriteCond %{HTTP_REFERER} !^http://youripaddress.* [NC] 
RewriteRule [^/]+.(gif|jpg)$ - [F]

[Guru]

After a brief amount of thought, of course smilies can't be protected by this code. They are individual files, served up by your host.

[SpeedStreet]

FWC,

That worked perfectly! Thanks for the help!

Does anyone know if there is a way to also protect an IIS server the same way, I don't use it for my vb server, but some of my web pages are hosted on Win2k.

[FWC]

Originally posted by SpeedStreet
FWC,

That worked perfectly! Thanks for the help!

Does anyone know if there is a way to also protect an IIS server the same way, I don't use it for my vb server, but some of my web pages are hosted on Win2k.

You're welcome.

I can't help you with IIS, though. Don't know of the equivalent to mod_rewrite.

[trainer]

is there a way to put a link at the top and bottom of the attachment...

Image Found at Mysite.com

or Visit Mysite.com

as part of the attachment

[350Chevy]

test