PDA

View Full Version : Specific access from a page


gildash2
02-24-2004, 11:17 PM
hello, i got a pretty simple question, with probably a simple answer... i was wondeirng, could any of u experts help me with finding a way to check if a user comes to a certain page from another page, and if he doesnt, he wouldnt be authroized? know wat i mean jelly bean? in other words, he isnt allowed acess to a specific page unless he comes from exactly this one:confused:

ucm
02-25-2004, 04:05 AM
the best way would be to use server side scripting like php...

you could could have the server side script ( on the page that they want to get to ) look at what page the user came from and if it was the one that they were supposed to login from THEN the php script ( on the page that they want to get to ) would show the rest of the page...

here's what you need, try it out:
1.php:
-----
<?
print $_SERVER['HTTP_REFERER'];
?>
<br>
<a href="2.php">dude man</a>
2.php:
-----
<?
print $_SERVER['HTTP_REFERER'];
?>





I have included several excerps from the php manual (http://www.php.net/manual/en/reserved.variables.php#reserved.variables.server) below:

'HTTP_REFERER'
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.


jrg45 at pantheon dot yale dot edu
10-Jul-2002 02:14
Note that $_SERVER["HTTP_REFERER"] may not include GET data that was included in the referring address, depending on the browser. So if you rely on GET variables to generate a page, it's not a good idea to use HTTP_REFERER to smoothly "bounce" someone back to the page he/she came from.

verdy_p at wanadoo dot fr
26-May-2001 10:47
Note also that the URL shown in $HTTP_REFERER is not always the URL of the web page where the user clicked to invoke the PHP script.
This may instead be a document of your own web site, which contains an HTML element whose one attribute references the script. Note also that the current page fragment (#anchor) may be transmitted or not with the URL, depending on the browser.
Examples:
<FRAME src="your-page-script.php"8>
<IMAGE src="your-image-script.php">

In such case, browsers should transmit the URL of the container document, but some still persist in using the previous document in the browser history, and this could cause a different $HTTP_REFERER value be sent when the user comes back to the document referencing your script. If you wanna be sure that the actual current document or previous document in the history is sent, use client-side JavaScript to send it to your script:

<SCRIPT language="JavaScript"><!--
document.writeln('<FRAME src="your-page-script.php?js=1&amp;ref=' +
document.location + '">');
--></SCRIPT><NOSCRIPT>
<FRAME src="your-page-script.php?js=0">
</NOSCRIPT>

And then check the value of $js in your page script to generate appropriate content when the remote user agent does not support client-side scripts (such as most index/scan robots, some old or special simplified browsers, or browsers with JavaScript disabled by their users).

claude_minette at hotmail dot com
30-Jul-2003 05:00
if you need, (for a reason or another), to get back the query as variables in your new page, use this... ;-)

$origin=$_SERVER["HTTP_REFERER"];
$tab=parse_url($origin);
$query=$tab["query"];
$variables=explode("&",$query);
for ($i=0;$i<=count($variables);$i++){
$tab=explode("=",$variables[$i]);
$$tab[0]=$tab[1];
}

It seems to be working... ;-)

Min's
"inerte" is my hotmail.com username
10-Oct-2003 10:35
Regarding claude_minette at hotmail dot com note about variables from a previous page, here's an easier way:

$tab = parse_url($_SERVER['HTTP_REFERER']);
parse_str($tab['query']);


dasa at dowling dot edu
30-Nov-2003 10:13
This is a IIS specific version of http://shat.net/php/404/ - The variables mentioned in that script had to be slightly modified to work with IIS. The script traps 404 "page not found" errors and allows the site to notify webmasters, and present a graceful exit to the user


$resource = str_replace("404;", "", $_SERVER['QUERY_STRING']);
if (isset($_SERVER['HTTP_REFERER'])) {
$from = $_SERVER['HTTP_REFERER'];
} else {
$from = "Directly Entered";
}

$errortime = (date("d M Y h:m:s"));
$message = "";
$message .= "404 Error Report\n\nA 404 error was encountered by " .$_SERVER['REMOTE_ADDR'];
$message .= "\n\n on $errortime\n";
$message .= "The URI which generated the error is: \n" . $resource ."\n\n";
$message .= "The referring page was:\n" .$from ."\n\n";
$headers = "From: auser@yourcompany.com\nDate: $errortime \n";
$subject = "404 Error: " . $resource;

mail("user@yourdomain", $subject, $message, $headers);

echo "<div class=\"title\">Requested Page Not Found</div>";
echo "<p>The page you requested, <b>";
echo $resource. ",</b> doesn't exist on this server. ";
echo "The details of this error have automatically been mailed to the webmaster.
We apologize for the inconvenience, and offer you the following choices for
your consideration:</p><ul class=\"list\">";
echo "<li> <a href=\"/\">Visit our Homepage</a><br>&nbsp;<br></li>";
echo "<li> <a href=\"/forms/contact.asp?ID=website\">Ask us a Question</a><br>&nbsp;<br></li>";
echo "<li> <a href=\"javascript:history.back(1)\">Return to the linking page</a><br>&nbsp;<br></li>";

gildash2
02-25-2004, 07:24 AM
yeah thanx for all the advise but i havnt resorted to using php yet and ive written many o fthe same scriptS(login ones for example) maybe like when the page is loading the one ur supposed to access you could have something like htis
onload="check()"

then down here u got
<script>
function check()
if (history(0).src="the webpage your supposed to acess.html")
{
window.location.src="same wbesite but minus the check function.html";
</script>

something like that, the history thing,, im not sure if i wrote it correctly but its typically used for foward and backward buttons. if you could poplsih this up for me i would really appreciate it. the code above bascially does wat i want. if you could polsih it up ide appreciate it thank you.

Willy Duitt
02-25-2004, 07:48 AM
Here's a javascript solution. But please note. Not all servers send a document.referrer so you will need to check if this will work on your host.

<html>
<head>
<title>Check document.referrer</title>

<script type="text/javascript">
<!--//
function goodUrl() {
a = location.href;
if(document.referrer.indexOf("http://YOUR_PAGE_URL.html") > -1){
a = a;
}
}

function badUrl() {
if(document.referrer.indexOf("http://YOUR_PAGE_URL.html") == -1){
agree = (confirm("You have come here from outside of the Domain.\nClick Yes to proceed to our Main Entrance Page.\nClick Cancel to return to wence you came from.") ? "yes" : "no")
}
if(document.images && agree == "yes"){
location.replace("http://YOUR_DOMAIN/index.html")
}
if(document.images && agree == "no"){
history.go(-1);
}
}

function chkUrl(){
goodUrl();
badUrl();
}
window.onLoad=chkUrl();
//-->
</script>
</head>

<body >
document.referrer test
</body>
</html>

.....Willy

gildash2
02-25-2004, 07:55 AM
man thanx.. how much experience do u have to have to be able to make this stuff up? wow

gildash2
02-25-2004, 08:20 AM
<title>Check document.referrer</title>

<script type="text/javascript">
<!--//
function goodUrl() {
a = location.href;
if(document.referrer.indexOf("http://www.geocities.com/guild_es/index.html") > -1){
a = a;
}
}

function badUrl() {
if(document.referrer.indexOf("http://www.geocities.com/guild_es/index.html") == -1){
agree = (confirm("You have come here from outside of the Domain.\nClick Yes to proceed to our Main Entrance Page.\nClick Cancel to return to where you came from.") ? "yes" : "no")
}
if(document.images && agree == "yes"){
location.replace("http://www.geocities.com/guild_es/index.html")
}
if(document.images && agree == "no"){
history.go(-1);
}
}

function chkUrl(){
goodUrl();
badUrl();
}
window.onLoad=chkUrl();
//-->
</script>
</head>
often when i use a script, i prefer to understand it, and within ur script, i odnt understand the >-1 and the ==-1
wats sets the value of -1 and how does == and > have nething to do if you came from the website written in the code or not, i can understand the == if the website url is equal to the past website in the history, but thats placed in the bad url and if u didnt enter form the correct webpage

agent002
02-25-2004, 08:30 AM
Originally posted by Willy Duitt
Here's a javascript solution. But please note. Not all servers send a document.referrer so you will need to check if this will work on your host.
Oh? I have always thought it's the client sending the HTTP_REFERRER, not the server. At least I know some people's firewalls prevent scripts from seeing the HTTP_REFERRER, which causes problems especially with formmail scripts.