Stop Users from Cross-linking Attachments

I've hacked my attachment.php script to prevent users from posting an attachment on my board, and then using the HTML to display it somewhere else. This prevents people from posting a pic on your board, then using your bandwidth to place that pic elsewhere. It is a tiny code change.

I've substituted my own logo, (LOL), but you can replace that with anything, or just use the "exit;" line to eliminate the pic entirely.

In attachment.php, right after:

PHP Code:

require("./global.php"); 


Add the following code:

PHP Code:

// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($_SERVER['HTTP_REFERER']); 
$checkurl = strtolower($url["host"]); 
if (! strstr($checkurl, "yourdomain")) {

    // Remove this code if you just want to break the image
    // Substitute my Logo
    header("Content-Type: image/gif"); 
    $filename = "/usr/public_html/grafix/logo.gif";
    $image = fread(fopen($filename,"r"),100000); 
    echo $image; 
    fclose($image);
    // End Substitute my Logo

    exit; 
} 


Change yourdomain to your actual domain name, and the logo URL to what you want to replace the cross-linked image with.

NOTE: Changed to use the full path in "$filename = ..." to get this to work on some servers.

ANOTHER: See this post in this thread for a modification that works on Win32 servers: https://vborg.vbsupport.ru/showthrea...895#post297895

AGAIN: If you modify avatar.php similarly, you can prevent people from cross-linking your avatars: https://vborg.vbsupport.ru/showthrea...893#post303893

UPDATE: The parse_url line is slightly different to use the new PHP syntax.

[amsch]

again

[Guru]

If you post or send me the code snippet that you added, I'll try to help you figure out what is wrong.

[Guru]

This substitutes my logo, as it should, with my browser:

[Lionel]

I replaced the http with full filepath and it is working.
thanks.testing

[Remi]

How do you use this nice hack if you have four different domain names

and is it posible to add your IP to the domains list

Thanks

[merk]

you can modify this, and just

PHP Code:

echo "this image can only be linked from yourdomain.com";
exit; 


takes up less bandwidth than using an image

[Guru]

Originally posted by Remi
How do you use this nice hack if you have four different domain names

and is it posible to add your IP to the domains list

Thanks

PHP Code:

if (false === strpos($checkurl, "firstdomain") || 
    false === strpos($checkurl, "seconddomain")) { 


IPs would require a different test...

[Remi]

Thank you very much Guru, is that the right way to add a third domain, Please correct me.

if ((false === strpos($checkurl, "firstdomain") ||
(false === strpos($checkurl, "seconddomain") ||
(false === strpos($checkurl, "thirddomain")) {

Sorry I don't know PHP

[Guru]

Originally posted by Remi
Thank you very much Guru, is that the right way to add a third domain, Please correct me.

if ((false === strpos($checkurl, "firstdomain") ||
(false === strpos($checkurl, "seconddomain") ||
(false === strpos($checkurl, "thirddomain")) {

Sorry I don't know PHP

That should work for as many domains as you want to include.

[dyt4]

just testing too

http://forum.dyt4concept.com/attachment.php?postid=5117