#31507 [NEW]: HTTP_REFERER missing this

From: motion_4u at hotmail dot com Operating system: all PHP version: 4.3.10 PHP Bug Type: URL related Bug description: HTTP_REFERER missing this Description: ------------ I see that there is a misunderstanding issue regarding the HTTP_REFERER. Please read thoroughly before you will automatically paste the phrase “but it is not a php bug…” It is not a bug, it is only a very important missing option. You have received hundreds of bug reports regarding the referrer and argument it that the problem is definitely due to the blocked communication of the browser since the REFERRER is returned from the browser. Here, there is something very important that you have neglected. Not only the browser calls a page. the server does it too! For example, what is the value of the HTTP_REFERER of an included in another one? There are many situations that a PHP file is included in another PHP file before it is parsed and sent to the browser. In this case the HTTP_REFERER is very well known by the SEVER or better to say by PHP! An included file MUST update the header with the URL of the caller which is already there. It might seem something not important but if someone would like to make sure that only one file is allowed to call and include another php file on the server, the only way to verify it is to call the HTTP_REFERER and check who called this file. Incase that it happens on the server the HTTP_REFERER must contain the URL. Example: A PHP file [referrer.php] includes a hidden value from the [hiddenphpfile.php] file. The [hiddenphpfile.php] would return the hidden value only if the referrer is known WHO IS THE REFERRER IN THIS CASE???? Yes, we all know that the file [referrer.php] is the referrer but PHP doesn’t know it and the value of the $referrer stays NOTHIG with your argumentation that the browser didn’t return anything. I hope that I could explain it better. [FILENAME: hiddenphpfile.php] $referrer=getenv('HTTP_REFERER'); if($referrer==“http://myurl/mypage.php“) { return (“ $SomeHiddenValue“); } [FILENAME referrer.php] $ref=include "refer.php"; echo $ref; Reproduce code: --------------- [FILENAME: hiddenphpfile.php] $referrer=getenv('HTTP_REFERER'); if($referrer==“http://myurl/mypage.php“) { return (“ $SomeHiddenValue“); } [FILENAME referrer.php] $ref=include "refer.php"; echo $ref; Expected result: ---------------- recieve the referrer value incase that including a php file within another one. Actual result: -------------- nothing -- Edit bug report at http://bugs.php.net/?id=31507&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=31507&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=31507&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=31507&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=31507&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=31507&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=31507&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=31507&r=needscript Try newer version: http://bugs.php.net/fix.php?id=31507&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=31507&r=support Expected behavior: http://bugs.php.net/fix.php?id=31507&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=31507&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=31507&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=31507&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=31507&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=31507&r=dst IIS Stability: http://bugs.php.net/fix.php?id=31507&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=31507&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=31507&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=31507&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=31507&r=mysqlcfg