RE: [PHP] HTTP_REFERER <-> Norton firewall

On 23-May-2003 Martin Christian Koch wrote: > Due to the fact that Norton firewall takes control of the value of > HTTP_REFERER, I want to find another way to secure data. > > This is the setup : > > picserver = apache server with PHP4 - acts as upload / output of jpeg > server > www = apache server with PHP4 - this is where the website runs from > > Now - on www I'm posting through a form a file upload directly to > picserver. > The receiving PHP-script checks the HTTP_REFERER - if it's NOT www, you > will > not be able to upload the picture. Now - under normal circumstances this > is > working fine, but NOT for users using Norton firewall, since > HTTP_REFERER is > altered. > > Outputting pictures is done like this : > > <a href=http://picserver/output.php?c=code> running on > www. > output.php contains a script which checks 'c' and outputs like this : > > if ($HTTP_REFERER == "www") { > header("Content-type: image/jpeg"); > readline("picture.jpg"); > exit; > } > > Now - under normal circumstances this works fine - but again - > HTTP_REFERER > is altered so Norton users are not able to view the pictures. > > How do I set security so that only www has access to picserver - so that > noone else are able to misuse the server. > add a secret (password) code: output.php?c=code&s=secret <?php function mksecret($salt) { $d=date('DdM'); // change once a day return(crypt($d, md5($salt))); } function cksecret($sec, $salt) { $calc=mksecret($salt); return ($sec == $calc); } $code='pic227.jpg'; $sec= mksecret($code); echo "$code =$sec= : ", (cksecret($sec, $code) ? 'ok' : 'nope'), '<P>'; $code='pic228.jpg'; echo "$code =$sec= : ", (cksecret($sec, $code) ? 'ok' : 'nope'), '<P>'; ?> ------ pic227.jpg =fbETv42yuurxQ= : ok pic228.jpg =fbETv42yuurxQ= : nope Regards, -- Don Read dread@texas.net -- It's always darkest before the dawn. So if you are going to steal the neighbor's newspaper, that's the time to do it.