Determine function caller

win95progman

Given the example below does anyone know if it is possible to determine who (e.g. domain name and file name) calls the function myfunction?

[file1.php]
<?PHP
class myclass
{
function myfunction()
{

}
}
?>

insane

you could define the function as

<?PHP 
class myclass 
{ 
function myfunction($sender_id) 
{ 

} 
}

so, you would have to call the function with ID 1 from one file, ID 2 from another file ... . Each file (or code section) would have such an ID and you would always know who called the function. It's more work for many functions, but i don't know if there's a simpler way to do this.

jimson

i am same thought on such function last time.
but not on OOP class, on procedural method.

my question is,
em.. i wish to know, why you want to have such function that can detect who is the caller.
(i wish to know if we have same mind, if true, i will post my solution then).

win95progman

Thanks for the replies.

The problem with having the $senderid as a passed parameter is not reliable.

I want to only allow this class/function to be called from pages on my site. This is why I wish to determine the caller.
$_SERVER['HTTP_REFERER'] is not reliable either, example:

Current location is a Google search results page.
Lets say one of the results is http://www.mydomain.com/test.php
Within http://www.mydomain.com/test.php is a script which calls myclass->myfunction() in file1.php.
The domain returned by $_SERVER['HTTP_REFERER'] within this call is 'www.google.com' not www.mydomain.com

The reason I need to know who exactly is calling this function is for security reasons. I do not want this function to be called outside of my site.

jimson

can u explain a bit on these

The problem with having the $senderid as a passed parameter is not reliable.

and

I want to only allow this class/function to be called from pages on my site

in ur Google eg.
it means the user can include ur file. am i right
and u want only the user who (registered/paid) to be able to call this function and not all users. am i correct.

win95progman

I do not want someone to be able to write their own script which in turn calls my script.

So, the problem with having the $senderid as a passed parameter being not reliable is that someone could write their own script passing in an acceptable value (www.mydomain.com).

I dont care who calls http://www.mydomain.com/test.php whether someone types it into their browser, search engine results etc., but I do not want anyone to have access to the secure file file1.php.

Here's the application:
[connect.php]
<?PHP
class connect
{
function OpenDB()
{
if (This function was called by a page on my web site)
{
open and return handle to databse
}
else
{
Do something else
}
}
}
?>

So, I can not have someone calling this script

jimson

first i am blur about ur problem...

ok,
if the test.php will have code that include the connect.php, then it will be called by anyone who access the test.php that have a function that call to OpenDB() in connect.php

the test.php will need to call the OPenDB() function to get the connection and display dynamic data in test.php (whenever any user access that page).

if u are assume by calling (just one time the OpenDB() function) script don't have to call it for the next display, then u are not right.

if u don't want people from outside to access file1.php, if u are using Apache as your web server, you can protect the file1.php by using the .htacess configuration file.

i felt hard to understand your problem. i try to help based on what i guess. if i am wrong, do reply and explain and i will try to help some more.

you are more Yoda than i .... 🙂

Weedpacket

Originally posted by win95progman
I do not want someone to be able to write their own script which in turn calls my script.

I don't think someone would be able to "write their own script which in turn calls my/your script" - unless their scripts are actually installed on the same server as yours. If they can do that then it's a whole 'nother matter of server security.

How are you picturing other people trying to call your scripts?

If you mean you want to prevent other people from viewing certain pages except through your own, then one option is to have the more sensitive files stored somewhere other than in your site's document tree. Your scripts can still include them if you tell them where they are, but because they're not in the site's document tree, there is no URL that someone can just enter and see the scripts' output.