Stop Users from Cross-linking Attachments

I've hacked my attachment.php script to prevent users from posting an attachment on my board, and then using the HTML to display it somewhere else. This prevents people from posting a pic on your board, then using your bandwidth to place that pic elsewhere. It is a tiny code change.

I've substituted my own logo, (LOL), but you can replace that with anything, or just use the "exit;" line to eliminate the pic entirely.

In attachment.php, right after:

PHP Code:

require("./global.php"); 


Add the following code:

PHP Code:

// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($_SERVER['HTTP_REFERER']); 
$checkurl = strtolower($url["host"]); 
if (! strstr($checkurl, "yourdomain")) {

    // Remove this code if you just want to break the image
    // Substitute my Logo
    header("Content-Type: image/gif"); 
    $filename = "/usr/public_html/grafix/logo.gif";
    $image = fread(fopen($filename,"r"),100000); 
    echo $image; 
    fclose($image);
    // End Substitute my Logo

    exit; 
} 


Change yourdomain to your actual domain name, and the logo URL to what you want to replace the cross-linked image with.

NOTE: Changed to use the full path in "$filename = ..." to get this to work on some servers.

ANOTHER: See this post in this thread for a modification that works on Win32 servers: https://vborg.vbsupport.ru/showthrea...895#post297895

AGAIN: If you modify avatar.php similarly, you can prevent people from cross-linking your avatars: https://vborg.vbsupport.ru/showthrea...893#post303893

UPDATE: The parse_url line is slightly different to use the new PHP syntax.

[Savant]

test
http://www.procreatica.com/forum/att....php?postid=88

[Link14716]

Beautiful.

[high]* Link14716 installs.
[/high]

http://www.vggmn.com/forums/attachme...?s=&postid=148

[Sweet Cheeks]

Very cool, works great on 2.2.9 :banana:

[Sweet Cheeks]

Ack!!! Could this be due to Firewalls people have installed on their machines? aranoid:


So far I have had 3 users that are getting the replacement image (the one that says you arent supposed to link outside the site) on the avatar areas and for anything that is attached

This is very strange, any ideas? Here's the entire code I am using:





// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($HTTP_REFERER);
$checkurl = strtolower($url["host"]);
if (! strstr($checkurl, "belliesandbabies.com")) {

// Remove this code if you just want to break the image
// Substitute my Logo
header("Content-Type: image/gif");
$filename = "http://www.belliesandbabies.com/bandwidtherror.gif";
$image = fread(fopen($filename,"r"),100000);
echo $image;
fclose($image);
// End Substitute my Logo

exit;
}

[zootsuit]

test

http://www.talkhardonline.com/forum/...p?postid=97785

[zootsuit]

sweet.

[Guru]

Originally posted by ~*Julie*~
Ack!!! Could this be due to Firewalls people have installed on their machines? aranoid:


So far I have had 3 users that are getting the replacement image (the one that says you arent supposed to link outside the site) on the avatar areas and for anything that is attached

This is very strange, any ideas? Here's the entire code I am using:
<snip>

As far as I can determine, this happens with IE 6.0 users only. And, it may be fixed in a service pack. I think it's because this version of IE doesn't submit the "REFERER" header correctly. Does anyone know the answer?

[Sweet Cheeks]

Originally posted by Guru


As far as I can determine, this happens with IE 6.0 users only. And, it may be fixed in a service pack. I think it's because this version of IE doesn't submit the "REFERER" header correctly. Does anyone know the answer?

We troubleshooted this and anyone on my site using the Norton Firewall had to disable the "Script Blocking" part of the firewall, now everything is working great :

[Francis96se]

test

[Gutspiller]

I can't get this to work, can somebody give me the exact code if my website were http://www.TheForumz.com and my image was in http://www.TheForumz.com/images/bandwidth_stealer.gif