deny access unless called from specific page.

[mastubbs]

Hi there,

 

Im using this code to call one php page into another:

 

<?php

define("INCLUDED", TRUE);  
if (file_exists($_GET['id'] . '.php')) {
  require($_GET['id'] . ".php");
} else {
  echo 'ERROR!! Please contact admin@mysite.com';
}

?>

 

I can call hello.php by typing url mysite.com/frame.php?id=hello

 

However, i dont want the pages being called (hello.php) to be accessible alone. Is there some code i can add to these pages to be redirected unless they are inside frame.php??

 

thanks,

 

Matt

[allworknoplay]

Well you can just check to see if $_GET is empty.

 

It's not really the best solution, but it's an easy solution to get you on your way until you can

come up with something more secure.

[bothwell]

Try this:

 

if(!$_GET['id'])
{
header('Location: frame.php')
}
else
{
do the other stuff you want
}

[runnerjp]

how about creating a session on one page ( where you want them to come from) then check that session?

 

[runnerjp]

thought i would show an exapmle seems im bored lol

 

1stpage.php

<?php
session_start();
$_SESSION['letmein'] = true;
?><a href="protected_page.php">Protected area</a>

 

then on our protected_page.php

 

<?php
session_start();
if (!$_SESSION['letmein']) {
    header('Location: 1stpage.php');
    echo 'Go through the <a href="1stpage.php">entry page</a> first.';
    exit();
}

// whatever happens to be at the protected page

 

 

hope this helps

[PFMaBiSmAd]

// detect direct access to included/required file
if(strtolower(basename($_SERVER["SCRIPT_NAME"])) == strtolower(basename(__FILE__))){
exit('No Direct Access');
}

[mastubbs]

Hey thanks everyone,

 

I'm trying all these suggestions but keep getting different problems. Runnerjp, i keep getting

 

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

when i put

 

<?php
session_start();
$_SESSION['letmein'] = true;
?>

 

any ideas why?

 

thanks

 

matt

[allworknoplay]

Hey thanks everyone,

 

I'm trying all these suggestions but keep getting different problems. Runnerjp, i keep getting

 

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

when i put

 

<?php
session_start();
$_SESSION['letmein'] = true;
?>

 

any ideas why?

 

thanks

 

matt

 

You're getting that error because you are outputting data or whitespace before you are calling the session.

 

If you are starting session in a include file, not the main parent file, it's not going to work.

The main frame file has to be the one starting the session from the top..

 

 

[bothwell]

Hey thanks everyone,

 

I'm trying all these suggestions but keep getting different problems. Runnerjp, i keep getting

 

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php:5) in /home/jasperss/public_html/cart3/lingerie/daring/prod/new7.php on line 6

 

when i put

 

<?php
session_start();
$_SESSION['letmein'] = true;
?>

 

any ideas why?

 

thanks

 

matt

 

You need to start a session before any other output on the page, including HTML. See here: http://www.phpfreaks.com/forums/index.php/topic,37442.0.html