DaveLinger Posted June 23, 2006 Share Posted June 23, 2006 Hello all! I've done a lot of PHP coding in the past, and have a "staff" section for the site I'm currently working on, which just has an HTML page which submits the user inputted password to a php file which says if the POST password = the password in the file then it echos the available links (add news, edit/delete news, upload a file, etc.) and when you click on a link, it links to the appropriate page. The problem is that if by chance the URL of a certain page (for instance, the "add a news article" page), they could bypass the password page to add news. The page with links to all of those locations is protected by the initial password, but how would I protect the other pages? I guess I could make an if statement at the beginning of each page I want protected that checks the refferer, like (excuse my ignorance of the php variable for refferrer)[code]if($PHP_REFER == http://www.PCritics.com/staff/go.php){echo "page contents";}ELSE{echo "Please login through the staff page to access this page."}[/code]Yeah? Whats the php variable for referrer, and what does it contain? Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/ Share on other sites More sharing options...
wildteen88 Posted June 23, 2006 Share Posted June 23, 2006 If you use sessions it'll be much better as the referer variabled can be spoofed and sometimes it is not set by the clients web browser.So if you have sessions you'll have this block of code:[code]<?phpsession_start();if(!isset($_SESSION['loggedIn'] || !$_SESSION['loggedIn'] == 1){ die("Please login you are not authorised to access this page");}// rest of code here[/code]WHen they login use this:[code]session_start();$_SESSION['loggedIn'] = 1;[/code]Thats is a far better way of doing what you want to do. Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48850 Share on other sites More sharing options...
DaveLinger Posted June 23, 2006 Author Share Posted June 23, 2006 ok I'll try that Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48858 Share on other sites More sharing options...
DaveLinger Posted June 23, 2006 Author Share Posted June 23, 2006 [code]Parse error: parse error, unexpected T_BOOLEAN_OR, expecting ',' or ')' in /home/content/D/l/i/Dlinger/html/modules/calendar/addevent.php on line 8[/code](thats the "if" line) Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48866 Share on other sites More sharing options...
jworisek Posted June 23, 2006 Share Posted June 23, 2006 [code]<?phpsession_start();if(!isset($_SESSION['loggedIn']) || !$_SESSION['loggedIn'] == 1){ die("Please login you are not authorised to access this page");}// rest of code here [/code]missing a paren after SESSION['loggedIn'] Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48868 Share on other sites More sharing options...
DaveLinger Posted June 23, 2006 Author Share Posted June 23, 2006 [code]Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/content/D/l/i/Dlinger/html/modules/calendar/addevent.php:4) in /home/content/D/l/i/Dlinger/html/modules/calendar/addevent.php on line 6[/code] Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48871 Share on other sites More sharing options...
jworisek Posted June 23, 2006 Share Posted June 23, 2006 you must have session_start before any headers are sent... place it at the very start of your script Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48877 Share on other sites More sharing options...
DaveLinger Posted June 23, 2006 Author Share Posted June 23, 2006 well, here's my code:[code]<?phpsession_start();if(!isset($_SESSION['loggedIn']) || !$_SESSION['loggedIn'] == 1){ die("Please login you are not authorised to access this page");}?><html><head><title>PCritics.com</title><?phpinclude('../../header.php');?>//the rest of my code here[/code]and when I access the file directly, it acts like before, like the code isnt there, lets me right in without starting the session =/actually scratch that it works, but how do I close the session when they're done? Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48881 Share on other sites More sharing options...
jworisek Posted June 23, 2006 Share Posted June 23, 2006 so that code is everything on your addevent.php page?I tried that same code on my server and it worked fine.[!--quoteo(post=387260:date=Jun 23 2006, 01:02 PM:name=DaveLinger)--][div class=\'quotetop\']QUOTE(DaveLinger @ Jun 23 2006, 01:02 PM) [snapback]387260[/snapback][/div][div class=\'quotemain\'][!--quotec--]well, here's my code:[code]<?phpsession_start();if(!isset($_SESSION['loggedIn']) || !$_SESSION['loggedIn'] == 1){ die("Please login you are not authorised to access this page");}?><html><head><title>PCritics.com</title><?phpinclude('../../header.php');?>//the rest of my code here[/code]and when I access the file directly, it acts like before, like the code isnt there, lets me right in without starting the session =/actually scratch that it works, but how do I close the session when they're done?[/quote] Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48883 Share on other sites More sharing options...
DaveLinger Posted June 23, 2006 Author Share Posted June 23, 2006 ends up I just already had the session in firefox, tried it in IE and it worked. Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-48888 Share on other sites More sharing options...
DaveLinger Posted June 26, 2006 Author Share Posted June 26, 2006 how would I END the session? Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-49706 Share on other sites More sharing options...
Orio Posted June 26, 2006 Share Posted June 26, 2006 Why do you need that?Anyway, it's done using session_destroy(), or when the browser window is being closed.Orio. Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-49713 Share on other sites More sharing options...
.josh Posted June 26, 2006 Share Posted June 26, 2006 by closing your browser. or, you can do this:[code]session_start();unset($_SESSION['blah']); //explicitly destroy the var$_SESSION = array(); //reset the entire session array for good measuresession_destroy(); //destroy the session[/code]though, i honestly don't know if this will work with tabbed browsing... Quote Link to comment https://forums.phpfreaks.com/topic/12740-security-php-referrer-variable/#findComment-49714 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.