Prismatic Posted July 16, 2006 Share Posted July 16, 2006 On my forums i'm developing I dont want to allow anyone to send any POST data from any off-site sources. What would be the best method to thwart this? If it helps to check against these, my config holds the following information[code]//Cookie Settings$CookieDomain =".mysite.com";//Board Header Information.$SiteName = "MySite"; //Appears at the start of top links, IE. [Site Name] Board Name >> ...$SiteURL = "http://www.mysite.com"; //Link for SiteName$BoardName = "My Boards"; //Appears at the start of top links, IE. [Site Name] Board Name >> ...$BoardURL = "http://www.MySite.com/Boards/"; //Link for BoardName[/code] Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/ Share on other sites More sharing options...
trq Posted July 16, 2006 Share Posted July 16, 2006 Best option would be to make sure your users are logged in (session) before they can post. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-58825 Share on other sites More sharing options...
Prismatic Posted July 16, 2006 Author Share Posted July 16, 2006 I do that anyway, I just want to make sure they arn't sending a modified post from their own server.And when I say post, I mean $_POST[''], not post as in a message to the forums, as I might have implied in the origonal post. Modified origonal post to clarify. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-58826 Share on other sites More sharing options...
quimbo Posted July 16, 2006 Share Posted July 16, 2006 I thought your question to be intriguing so i checked it out under my own system. The solution I came up with was to check the variable $_SERVER["HTTP_REFERER"]this holds the senders urihope this helps. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-58839 Share on other sites More sharing options...
GingerRobot Posted July 16, 2006 Share Posted July 16, 2006 http_referer cannot be trusted, it can be spoofed. Also, some firewalls prevent the data from being sent and browsers can be setup to not send it too. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-58892 Share on other sites More sharing options...
Prismatic Posted July 17, 2006 Author Share Posted July 17, 2006 Any other ideas? Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59200 Share on other sites More sharing options...
CheesierAngel Posted July 17, 2006 Share Posted July 17, 2006 if a user logs in, and presses the button to reply, you can generate a random encrypted code. Only their message-post with this encrypted code should be accepted. It not fully waterproof, but it will keep away a lot of these 'off-site' posted data. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59203 Share on other sites More sharing options...
Prismatic Posted July 17, 2006 Author Share Posted July 17, 2006 Not sure what you mean by using the encrypted code, where/when do I check this code? and against what? Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59205 Share on other sites More sharing options...
ShogunWarrior Posted July 17, 2006 Share Posted July 17, 2006 When you generate the form, INSERT a row with a Unique MD5 Hash, their Member ID and the date. Put the MD5 Hash in a hidden field, aswell as the date.Then, on the receiving page, check that the Hash is valid, that it matches the User_id that created it and that too much time has not elapsed. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59214 Share on other sites More sharing options...
Prismatic Posted July 17, 2006 Author Share Posted July 17, 2006 Sounds good :) Thanks for the tip :) Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59225 Share on other sites More sharing options...
GingerRobot Posted July 17, 2006 Share Posted July 17, 2006 As was mentioned, this is still not a total solution; someone could easily look at the page's source and view the hidden field and its contents.Do not rely on these things to work, make sure you fully validate the information from the form. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59226 Share on other sites More sharing options...
Prismatic Posted July 17, 2006 Author Share Posted July 17, 2006 Oh of course, I always validate the info :)What do you think a good time would be to allow? Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59230 Share on other sites More sharing options...
CheesierAngel Posted July 17, 2006 Share Posted July 17, 2006 Depends on how many fields the user has to fill and how many text he has to write. Best is to test it for yourself and see how long it takes . Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59233 Share on other sites More sharing options...
GingerRobot Posted July 17, 2006 Share Posted July 17, 2006 If this is scripts where people are going to be posting a topic/reply, you'll want to make sure that the time limit is quite long. Also, i would make sure you dont just give an error, make sure you return their orginal text incase someone was typing something long and loses it. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59236 Share on other sites More sharing options...
ShogunWarrior Posted July 17, 2006 Share Posted July 17, 2006 It could be anything, it's just another restraint, not particularly neccessary. Link to comment https://forums.phpfreaks.com/topic/14738-check-where-post-data-came-from/#findComment-59240 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.