SV: [PHP] Re: HTTP_REFERER <-> Norton firewall

Gee - thanks mate - that really helped ... or maybe not. Anybody knows a solution to the problem ? Martin -----Oprindelig meddelelse----- Fra: Merlin [mailto:news.groups@web.de] Sendt: 24. maj 2003 18:02 Til: php-general@lists.php.net Emne: [PHP] Re: HTTP_REFERER <-> Norton firewall HTTP_REFERER is set by the browser, so you can not rely on that! cheers, Merlin "Martin Christian Koch" <martin@koch.dk> schrieb im Newsbeitrag news:000801c32162$8f90d0d0$0100a8c0@koch... > Due to the fact that Norton firewall takes control of the value of > HTTP_REFERER, I want to find another way to secure data. > > This is the setup : > > picserver = apache server with PHP4 - acts as upload / output of jpeg > server > www = apache server with PHP4 - this is where the website runs from > > Now - on www I'm posting through a form a file upload directly to > picserver. > The receiving PHP-script checks the HTTP_REFERER - if it's NOT www, you > will > not be able to upload the picture. Now - under normal circumstances this > is > working fine, but NOT for users using Norton firewall, since > HTTP_REFERER is > altered. > > Outputting pictures is done like this : > > <a href=http://picserver/output.php?c=code> running on > www. > output.php contains a script which checks 'c' and outputs like this : > > if ($HTTP_REFERER == "www") { > header("Content-type: image/jpeg"); > readline("picture.jpg"); > exit; > } > > Now - under normal circumstances this works fine - but again - > HTTP_REFERER > is altered so Norton users are not able to view the pictures. > > How do I set security so that only www has access to picserver - so that > noone else are able to misuse the server. > > Thanks for any advice, > Martin > > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php