IP denying

mrxxlphp

I am relatively new to PHP but I know my way around now. I am having trouble with certain people on my web page. They are all from the same host and all have dynamically assigned IP addresses so I cant just block them. So for the past 2 weeks now I have used a .htacccess file to bar there hosts IP range which is great. But I am also on that host so I was wondering is there way to stop the .htaccess file applying if I have a cookie of making the program in PHP. I need it to be completely secure so it cant just forward them as they will fin out the real URL an just bypass the security. That is the advantage eof .htaccess.

Thanks, Stu

keith73

Originally posted by stuartbaggs
I am relatively new to PHP but I know my way around now. I am having trouble with certain people on my web page. They are all from the same host and all have dynamically assigned IP addresses so I cant just block them. So for the past 2 weeks now I have used a .htacccess file to bar there hosts IP range which is great.

OK, I'm with you so far.

But I am also on that host so I was wondering is there way to stop the .htaccess file applying if I have a cookie of making the program in PHP. I need it to be completely secure so it cant just forward them as they will fin out the real URL an just bypass the security. That is the advantage eof .htaccess.

This is where I'm not sure what you want, but I'll attempt to decipher.
you want to block IPs from a host, but not your IP.
IS your IP also dynamic?

If so, then you'd need to modify the .htaccess file every time your IP changes.

in .htaccess you probably have something like this right now

Order deny,allow
Deny from 12.345.678.

which allows all but denies from that IP block.

Order deny,allow
Deny from 12.345.678.
Allow from 12.345.678.90

by specifying deny,allow, the denied IPs are blocked, but everything that doesn't fall into that IP block is allowed. You would have to explicitly allow your IP.

check out apache.org
apache 2.0
http://httpd.apache.org/docs-2.0/howto/auth.html
or pre-2.0
http://httpd.apache.org/docs/howto/auth.html

it's pretty much the same anyway.

keith

mrxxlphp

That’s pretty much what I meant. My .htaccess file looks like that but when I ad mine to the allow section at the bottom it denies it.

allow from my.ip.address

it oesnt seem to work.

Is there nay way of doing the job of the htaccess file in php.

So I could put a <?php include (“blocker.php”); ?> in every page.

So when I load the page it will not allow the page to finish loading if it is in the banned ip range.

Then I could use a cookie to allow me.

Thanks, Stu

keith73

you could do that. include that file at the top of every page, before any html code, and have it redirect the blocked ip to some other page.

$_SERVER['REMOTE_ADDR'] will give you the viewer's IP. IF they aren't using a proxy to browse anonymously.

keith

mrxxlphp

Ok, I have managed to throw something to gether using cookies and .htaccess. Basically what happens is that when you enter the address (t-comuk.net) into your browser it checks for a cookie. If you have one it sends you to the site t-comuk.net/en but if you don’t then it will send you trough a .htaccess file to make sure you are not from the host I have disaloud. Then it sends you back to a file in the homes directory that gives you a cookie valid for 7 days. So you can only get a cookie if you are from a host I have aloud. Now I have made a small program that gives me a cookie so I can bypass the blocking .htaccess file. Clever or what. But one small.l problem I still have is that users csn still type www.t-comuk.net/en in there browser and then they bypass the blocking software. Is there anyway I can stop people typing the URL directly in there browser. I think there is a .htaccess file or something. I want it to redirect to another page when they try to access it directly. Thanks everyone

Stu

mrxxlphp

I have finished the system now. Following on from what I said before top combat the problem I have used a bit of PHP that detects the first cookie I set. So if they cant get in because they are blocked they cant get the cookie blocking them fro every page. I have also made it so that when a user gets in successfully it logs there IP so If I find a trouble some user when they log on using my system it checks there logged IP against a black list so it doesn’t matter of they redial or what because it relays on the there stored IP. Sounds complicated its taken me 7 days to put together anyway thanks for your help. Please visit my site to see if the system works don’t worry about the content www.t-comuk.net thanks.

iceiceboom

Warning: Cannot add header information - headers already sent by (output started at /home/t-comuk/public_html/en/index.php:4) in /home/t-comuk/public_html/en/index.php on line 161

I suggest you fix that unless you want all of your visitors seeing that. 🙂

mrxxlphp

Can you check againi think i have fixe it. Thanks a bunch

mrxxlphp

Can anyone please tell me if they can gain access to the site. www.t-comuk.net

mrxxlphp

please be aware that people who have already been blcoked have a cookie on there computer. Please clear out your cookies so you an try again. or visit :

www.t-comuk.net/phpclear?pass=1234
to lear out the blocking cookie.

Thanks

iceiceboom

I still can't get in...

mrxxlphp

That should just about do it. The problem is I am on the same host I am trying to block so I am having to use multiple machines and ISP on my network so its taking some time. If its still not working then I will have to re-configure the hole thing. Oh and by the way I am trying to make a script that can write PHP code into a file. It looks like this:

<?
$file = "blocklist.php";
$fp = fopen($file,"w");
fclose($fp);

$file = "blocklist.php";
@$open = fopen( $file, "a" ) or die ( "Operation Failed!" );
fputs( $open, "<?php $blocked = "$IP1" or "$IP2"; ?>" );
fclose( $open );
?>

Now I am train to write a file with the variable $blocked in it but it thinks that the phrase:

<?php $blocked = "$IP1" or "$IP2"; ?>"

is part of the script that writes the file itself ?? Any ideas on how to write PHP to a file without it taking part in the script itself.

Thanks, Stuart

mrxxlphp

Ill show you how it works. The main root index.php looks like this (remember I am a novice programmer any improvements please tell me):

<?php
if($cookieblock==goodtogo) header("Location: http://www.t-comuk.net/en/\n\n");
else
header("Location: http://www.t-comuk.net/auth/index.php?pass=******");
?>

The password above is to stop people typing the address into the browser directly bypassing the system.

It checks if you have a “goodtogo” cookie, if not it sends you thought “t-comuk.net/auth” which has a .htaccess file in it to deny access to people I don’t like and don’t wont on the site. Now the clever part is that if you if you reach the blocked page you are permanently denied, as you have cookie set and IP, browser info taken to distinguish you from others.

One problem I had thought was that I am on the same ISP as the ISP I want to block (that’s why I cant just have .htaccess file protecting the hole domain as it would block me as well) it only sends you thought the .htaccess file if you don’t have a cookie so if I manually install the cookie on my machine via my homemade cookie control panel then I bypass the system.

What stops you just typing www.t-comuk.net/en in the browser?? Well there is this line of code in every page in the “en” directory

<?php
include(“basicauth.php”);
?>

Basic auth is a file that’s checks to see if you have a “goodtogocookie” and that you have not had a bar placed against your cookie. When you get a cookie it records your IP address at the time of getting it so when I look at my stats in my homemade cookie manager I can place a block/bar against an IP address then even if they redial it doesn’t matter because the cookie still holds there old IP. It has taken me weeks to do and there are still bugs and improvements to do but its coming along. I am planning on building a system were other sites can join and point the index files at my server it checks fro a blocked ID/Cookie then send them back to the $HTTP_referrer/index2.php.

Thanks, Stu

mrxxlphp

is it working

iceiceboom

I'll moderate it, but I'm not going to get you new users. 🙂

mrxxlphp

what abou tnow!

shareaweb

hi stuart.. no problem accessing from the Philippines, but you should .htaccess out your admin.php page to all but your ip also..

Looks pretty secure even from a querystring attack, but your probably better off logging to the database than to a flat file.

Re writing phpcode to a file.. see below example:

$cq = 63;
$vo = sprintf("<%cphp\n", $cq);
$vo = sprintf("%s%c>\n", $vo, $cq);
$vfp = fopen("foofile", "w");
if ($vfp)
{
fwrite($vfp, $vo, strlen($vo));
fclose($vfp);
}