Attachment and avatar hotlinking protection (1.0.1)

Support in this thread or by email (preferrably thread)

vBulletin 2.2.x (tested on 2.2.9)

Prevents people from linking to attachments and custom avatars on your forum from other sites.

Example:
Attachment hotlinking protection: Click and watch the redirection message. You are then taken straight to the post containing the attachment.

Custom avatar hotlinking protection: Click and watch the redirection message again. This time you are taken to the user's profile.

When the attachment is linked to via an img tag, it is shown as a red x in IE, or a torn paper in Mozilla.

Modifications:
2 file modifications
/forum/attachment.php
/forum/avatar.php
1 new template
redirect_wrongreferrer

Updates since 1.0:
Added custom avatar hotlinking protection

Modifications since last version:
2 file modifications
/forum/attachment.php
/forum/avatar.php
1 template modification
redirect_wrongreferrer

For upgrade instructions see the text file.

Note for people who have problems getting the avatar hotlinking protection to work: Try this code in the avatar.php modification instead of mine

[Sia Bani]

Hi again. I have another question...does anyone know how to make an advertisement of my site by replacing the image that is being hotlinked? Basically, instead of the x or the actual image they're trying to hotlink, how could I make an ad of my site come up? Anyone come up with this already?

[dennx]

Does this hack work in vB 2.3??

[phenom]

I installed this on 2.3.0 and it... sorta... works

The images don't seem to be able to be hotlinking, but instead of getting the message from the new template, I get this:

Parse error: parse error, unexpected T_STRING in /home/pcbaseb/public_html/forums/attachment.php on line 39

[fury]

dennx: It should

phenom: Show me your line 39, if you don't mind

[gmarik]

A great idea, just like Nuke has.

[ImportPassion]

Ok, i changed this around a bit cause i didn't work for me. Some ppl couldn't see the images in the forum.

PHP Code:

if (!$GLOBALS[HTTP_REFERER]) {
    $HTTPREFERER = "http://www.7thgencivic.com/";
} else {
    $HTTPREFERER = $GLOBALS[HTTP_REFERER];
}

$c_url = parse_url($HTTPREFERER);

if (!substr_count($c_url[host], "www.7thgencivic.com") || !substr_count($c_url[host], "7thgencivic.com")) {
  $redirectquery = $DB_site->query_first("SELECT postid,threadid FROM post WHERE attachmentid='".$attachmentid."'");
  $url = $bburl . "/showthread.php?s=".$session[sessionhash]."&threadid=".$redirectquery[threadid]."#post".$redirectquery[postid];
  $redirecttype = "post";
  eval("standardredirect(\"".gettemplate("redirect_wrongreferrer")."\",\"\$url\");");
} 


[Gutspiller]

Anybody using this hack gotten reports that it screws up if you have Windows NT or are behind a proxy? I have tried multiple hacks to protect avatars and attachments, but I have a few users they say the see the replacement image even when they are on the site viewing the image.

Any ideas? I think a .htaccess might work for me, but I don't know what I'm suppose to put in it.

[Andrus]

My question is this... One of my sites is a new site, and some are still entering the site through the IP right? So would you not want to have both the IP and the domain name listed, and if so could you simply seperate Domain, and IP with a comma in the code?