RE: [PHP] PHP, JAVASCRIPT, NETSCAPE and IE

Hi, I guess Internet Explorer interprets a popup window as a new browser window and therefore not as a refered page. The only solution is to get the referer to that page is not to use popups. Another thought though is that when you're using the $HTTP_REFERER to verify the legitimate use of your sms send script it is still spoofable. I, for example, created a 'send free sms' page that uses another page to send sms. They also check the referer, but you can easily fake the http headers and create your own $HTTP_REFERER. The site will think the post vars were coming from index.php3 while they were actually generated by a php script on my server. To tackle both problems I think it might be better to include some kind of extra authorization function. For example in the sms-form (let's say index.php) you create put a random string in the form AND you put the same random string in a database. When the form input is posted you check the database for the random string and if it exists you allow the sms to be sent, otherwise you deny it (also make the random string expire in 5 minutes or something). There is no easy way to spoof an sms tool that works like that, and you also don't need to worry about checking HTTP_REFERER's. The only down side is that you create more database interactions which may slow down your server(s) if you have much traffic. Another Idea is to create a session when a user enters the 'index.php' page which holds the sms-form. In the session you set a session variable (for example $maySend=1;). After submitting to 'sms.php' the session still exists and you can check the '$maySend' variable. After sending the sms you destroy the session. The sessionid can be recreated by a spoofer but the environment in your session can't. Also if you destroy the session or perhaps unset the $maySend variable you can also disable unlegitimate use. Well, I hope this brainstorm has been of some help or inspiration, dowebwedo Jeroen Wesbeek .programming St. Jacobsstraat 16 Postbus 448 | 3500 AK Utrecht The Netherlands p 030 2348110 | f 030 2348605 [roses are red, violets are blue, I am schizophrenic and so am I ] -----Original Message----- From: Thomas Martins [mailto:pinkey@unix.za.net] Sent: donderdag 26 oktober 2000 11:28 To: php-general@lists.php.net Subject: [PHP] PHP, JAVASCRIPT, NETSCAPE and IE Hello there fellow php-coders... Problem: On my site, I send SMS (short messages on cellphones), but it is costing me money. Now I need to check that the function was actually called from my server, and not from some remote host.... I call a javascript function on the click of the SMS button, that opens a new window, that use my php file. something like this... function sms(id, username, desc) { wintoopen = "sms.php3?id=" + id + "&username=" + username + "&desc=" + desc; window.open(wintoopen, coords of new window to open...); } then in sms.php3 i include another file called sendsms.php3, which has a php function in it called sendsms($cellphonenum, $msg) in sendsms i do something like this... function sendsms($cellphonenum, $msg) { global $HTTP_REFERER; //check that mydomain.co.za is in HTTP_REFERER $fromwhere = strpos("HTTP_REFERER", "mydomain.co.za"); //if mydomain.co.za is not in the HTTP_REFERER, then exit... if ($fromwhere == false) { echo "Sorry, could not send sms"; exit; } //now send the sms.... code that sends sms... } Now, in Netscape (as per ususal) this works 100%, but in IE, it fails, $HTTP_REFERER is a null value. I experimented with IE, and you need to pass it as one of the arguments from the javascript function, which is pretty useless to me, sinse any idiot can write his own function like function sms(hisid, his msg, 'mydomain.co.za') { } If you have any suggestions, please mail me...I am clueless as to what to do. Regards Thomas Martins aka pinkey -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net