Re: Detecting posts from outside site
| From: | Chris Shiflett | Date: | Tue, 21 Jan 2003 18:45:16 +0000 |
| Subject: | Re: Detecting posts from outside site | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-132484@lists.php.net to get a copy of this message | ||
--- Liam.Gibbs@dfait-maeci.gc.ca wrote:
> If it's bulletproof, then I figured this could help
> some of you out. If not, I welcome comments (I'm a
> little bit hesitant of calling things 'bulletproof').
It's not bulletproof. :-)
> if((count($_POST) > 0) &&
> (!stristr($_SERVER["HTTP_REFERER"],
> $http_referer))) {
> unset($_POST);
> $evil = "postedfromoutsidepage";
> }
If this page is located at http://www.example.org/foo.php,
and you are trying to ensure that the data is being posted
from http://www.example.org/bar.php consider the
following:
--------------------
# telnet www.example.org 80
Trying 192.0.34.166...
Connected to www.example.org (192.0.34.166).
Escape character is '^]'.
POST /foobar.php HTTP/1.1
Host: www.example.org
Referer: http://www.example.org/bar.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 26
varname=any_value_i_choose
--------------------
Someone can use this method to bypass your Referer header
check and post any data they choose.
Chris