Stop Users from Cross-linking Attachments

I've hacked my attachment.php script to prevent users from posting an attachment on my board, and then using the HTML to display it somewhere else. This prevents people from posting a pic on your board, then using your bandwidth to place that pic elsewhere. It is a tiny code change.

I've substituted my own logo, (LOL), but you can replace that with anything, or just use the "exit;" line to eliminate the pic entirely.

In attachment.php, right after:

PHP Code:

require("./global.php"); 


Add the following code:

PHP Code:

// Cross-link hack by Guru 2/24/2002
// Check that we aren't linked somewhere else
$url = parse_url($_SERVER['HTTP_REFERER']); 
$checkurl = strtolower($url["host"]); 
if (! strstr($checkurl, "yourdomain")) {

    // Remove this code if you just want to break the image
    // Substitute my Logo
    header("Content-Type: image/gif"); 
    $filename = "/usr/public_html/grafix/logo.gif";
    $image = fread(fopen($filename,"r"),100000); 
    echo $image; 
    fclose($image);
    // End Substitute my Logo

    exit; 
} 


Change yourdomain to your actual domain name, and the logo URL to what you want to replace the cross-linked image with.

NOTE: Changed to use the full path in "$filename = ..." to get this to work on some servers.

ANOTHER: See this post in this thread for a modification that works on Win32 servers: https://vborg.vbsupport.ru/showthrea...895#post297895

AGAIN: If you modify avatar.php similarly, you can prevent people from cross-linking your avatars: https://vborg.vbsupport.ru/showthrea...893#post303893

UPDATE: The parse_url line is slightly different to use the new PHP syntax.

[opus]

how would i add this to work with my avatars?

[Guru]

Avatars are attachments, as far as I know...

[lifesourcerec]

Originally posted by Guru
Avatars are attachments, as far as I know...

I like the http redirect better which works for me. Just upgraded to v2.2.4 and forgot the line for it. What's the code for thr http?

[xug]

test

http://www.xboxusersgroup.com/forums...=&postid=35322

http://www.xboxusersgroup.com/forums...ine=1018936815

[SaintDog]

Nice hack, here is a test of what shows on mine, just for anyone that wishes to view it.

http://www.bbaddons.com/forums/attac...p?s=&postid=37

SaintDog

[Tommy Boy]

Nice hack! Please correct me if I'm wrong though, if you have set that only registered users can view attachments on your board, then most people would get the login screen anyway, right?

[JTMON]

Originally posted by Tommy Boy
Nice hack! Please correct me if I'm wrong though, if you have set that only registered users can view attachments on your board, then most people would get the login screen anyway, right?

This hack seems very cool except for the above statement, plus, isn't putting a different picture that gets served up just like the other one would defeating the purpose a little?

[Guru]

Nobody wants to steal the bandwidth to serve an ad for my site...

[Guru]

Originally posted by Tommy Boy
Nice hack! Please correct me if I'm wrong though, if you have set that only registered users can view attachments on your board, then most people would get the login screen anyway, right?

Is that a standard option?

[JTMON]

Originally posted by Guru

Is that a standard option?

Yes, it is.

BTW Mods, quoting a post with a quote seems not to work?