Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - Other
Author Message
Dawg
RavenNuke(tm) Development Team


Joined: Nov 07, 2003
Posts: 910

PostPosted: Wed Feb 08, 2006 8:27 pm Reply with quote

Greetings All Knowable Folks,
I have a couple servers. On one of them I have a bunch of stuff that is "extra" stuff for my sites. Interactive Maps...Forecasting tools...downloads....that sort of stuff.

One of my members tonight directed me to another website that has I-Framed one of my Interactive Maps. I wish to block any and all servers from reaching any content from this server with the exception of sites I own. As far as I m concerned....there is noone in the world thathas any business on this server unless they come through an I-Frame from my sites. I would just assume ban the entire world except my sites and ME of coarse from accessing this server.

This brings me to htaccess. I have used tons of htaccess files over the years but never for something like this and I just want to make sure I do it right.....so of coarse to came to right place.


I did some reading....and there is tons on hotlinking and such but none that are really about what I am trying to do. Is this the way I want to do this or is there a better way.

Code:


<Limit GET>
order deny,allow
deny from all
allow Only registered users can see links on this board! Get registered or login!
</Limit>


Thank You for your time!

Dawg
 
View user's profile Send private message
kguske
Site Admin


Joined: Jun 04, 2004
Posts: 6383

PostPosted: Wed Feb 08, 2006 8:30 pm Reply with quote

Have you tried it? There are other ways, for example, to stop iframes.

_________________
I google, therefore I exist...
Only registered users can see links on this board! Get registered or login!
 
View user's profile Send private message
Dawg
PostPosted: Wed Feb 08, 2006 8:34 pm Reply with quote

The I-Frames are only one issue. I want to BLOCK everyone....except me and my admins and my sites.

Everyone else.....has no business on this server.

Dawg

PS...No I have not tried it yet. I wrote the admin of the other site a polite letter to stop it....but this just brought the issue to the forefront. So I figured I would fix it once and for all.
 
kguske
PostPosted: Wed Feb 08, 2006 8:38 pm Reply with quote

Including RSS feeds?
 
Dawg
PostPosted: Wed Feb 08, 2006 8:59 pm Reply with quote

Yep....There is nothing fo RSS on this thing....

Dawg
 
kguske
PostPosted: Wed Feb 08, 2006 9:03 pm Reply with quote

In that case, .htaccess might be the best way.
 
Dawg
PostPosted: Wed Feb 08, 2006 9:09 pm Reply with quote

Is there anything else I need to add to the code above to do the job?

Like I said....There are not many people looking to do this sort of thing so there is very docs out there about it.

Dawg
 
kguske
PostPosted: Wed Feb 08, 2006 9:13 pm Reply with quote

I think not. REALLY nice site, btw. Class all around.
 
Dawg
PostPosted: Wed Feb 08, 2006 9:21 pm Reply with quote

Thank You kguske, You guys have helped a LOT along the way.

Dawg
 
kguske
PostPosted: Wed Feb 08, 2006 9:33 pm Reply with quote

Maybe, but MAN, you put some work into THAT!
 
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9449
Location: Arizona

PostPosted: Thu Feb 09, 2006 5:40 am Reply with quote

Dawg, you could also add some javascript to your includes/javascript.php script to do something like this:

if (self.location != top.location)
top.location.href = 'www.yoursite.com';


This very simple javascript check should wipe out anybody's ability to iframe your site. Try it and see if it works... Wink

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
Dawg
PostPosted: Thu Feb 09, 2006 5:49 am Reply with quote

I Love This Site!

Montego,
I put that in this morning. Thank You.

I have not done the htaccess yet. I have a couple things I need to move off that server first but it is coming in the next couple days.

Thanks Guys!!!

Dawg
 
montego
PostPosted: Thu Feb 09, 2006 5:51 am Reply with quote

RavensScripts
 
Dawg
PostPosted: Thu Feb 09, 2006 6:18 am Reply with quote

Montego,

That knocked it off-line.....

I will have a closer look at it later this morning...


Dawg
 
montego
PostPosted: Thu Feb 09, 2006 6:53 am Reply with quote

Dawg, you have to get the code right Wink Bang Head Sorry, should have provided the complete solution, including accurate j avascript code. Try this in javascript.php:


echo "<s cript type=\"text/j avascript\">\n";
echo "<!--\n";
echo "if (self.location != top.location) { top.location.href = 'www.yoursite.com'; }\n";
echo "//-->\n";
echo "</s cript>\n\n";


Obviously, you must make the s cript tags right...

This is working on my test domain. Also, go to that other site and check out the iframe after you add this code... they will be in for a surprise!
 
Dawg
PostPosted: Thu Feb 09, 2006 6:58 am Reply with quote

LOL.....I kind of figured that was what the deal was. I am about to walk out the door to take my kids to school.....figured I would dig into when I got back. Thank You for the help!


Dawg
 
evaders99
Former Moderator in Good Standing


Joined: Apr 30, 2004
Posts: 3221

PostPosted: Thu Feb 09, 2006 8:03 am Reply with quote

Javascript will only go so far. All someone has to do is disable Javascript in their browser.

Another approach is to use phpNuke's functions to check for a valid user - the is_user() function

_________________
- Only registered users can see links on this board! Get registered or login! -

Need help? Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
montego
PostPosted: Thu Feb 09, 2006 12:59 pm Reply with quote

evaders99, that is an interesting thought! However, if I take that through to its logical conclusion, are you sure that you would want to stop ALL anonymous access to your site?

I'll have to mull that one over... it is definitely an interesting approach idea...
 
Dawg
PostPosted: Thu Feb 09, 2006 1:24 pm Reply with quote

I do not wish to stop anonymous traffic....just traffic that comes from outside my site. Here is the deal.....Incorporating these widgets (mapserver, forecasting tools...etc) is WAY to much of a pain in the.....to do it through Nuke. So what I have done is create an Iframe in a Module and that is how the widgets are accessed. For the most part they look and feel just like they are part of the site. Am I wrong in saying that it is my domain server (where my main site is) that is calling the data from the widget server? So I simply need to allow access from my main domain. RIGHT?

Dawg
 
evaders99
PostPosted: Thu Feb 09, 2006 5:20 pm Reply with quote

Your server doesn't call anything. Using an iframe still relies on the client machine to load the page.

Iframe isn't a solution if you really want it integrated into your site. You have to integrate the code somehow. Using include, you could create a PHP script wrapper for that content and place it in a phpNuke module. It should work better than iframes for security
 
Dawg
PostPosted: Thu Feb 09, 2006 5:47 pm Reply with quote

Evaders, Do you know of a wrapper that I could look at as an example?

Dawg
 
Dawg
PostPosted: Thu Feb 09, 2006 6:24 pm Reply with quote

Also a question....How about referrers....Does an I-Frame generate a referrer and could i use that referrer to allow access?

Just a thought...

Dawg
 
kguske
PostPosted: Thu Feb 09, 2006 9:00 pm Reply with quote

Look at the NukeWrap module for an example of an iframe. It's not referers (yes, it's correctly spelled - because the people who coined the term mispelled it) you want to block - that's just other websites that link to yours. You've been talking about people who direct-link your content, which your htaccess code should handle.
 
Guardian2003
Site Admin


Joined: Aug 28, 2003
Posts: 6792
Location: Ha Noi, Viet Nam

PostPosted: Fri Feb 10, 2006 1:21 am Reply with quote

I just wanted to have my 2 cents on this as I have just got home and I want to upset the apple cart.
Why not, instead of looking at solutions completely block external sources from grabbing your data, why not make something of the situation - redirect them to a page of google ads instead!
 
View user's profile Send private message Send e-mail
evaders99
PostPosted: Fri Feb 10, 2006 2:04 pm Reply with quote

Quote:
Why not ... redirect them to a page of google ads instead

Because that would be against Googles TOS Smile
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - Other

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©