Is this bulletproof?

andrewteg

I have a site and I only want people who are on my site to access certain links so I created a dl.php file and put this in it:

<?php
if (stristr($HTTP_REFERER, $HTTP_HOST)) {
  Header ( "Content-Type: application/octet-stream");
  Header ( "Content-Length: ".filesize("downloads/$dl"));
  Header( "Content-Disposition: attachment; filename=$dl");
  readfile("downloads/$dl");
} else {
  header("Location:index.php");
  exit;
}
?>

Some people are reporting that after clicking on a link on my site they are getting sent to the index page and I can't figure out why or reproduce the problem... Any ideas?

Thanks,
Andrew

PS >> You can view it in actionhere.

drew010

it should work fine. some browsers give the option to hide or change the http referer, and some who may be using proxies or are behind certain internet firewalls either on school lan's or companies may experience problems with their network settings changing the referer.

crimaniak

1.
you have: "if referer exists and valid then download else redirect"
change to "if referer exists and invalid then redirect else download"
2. think about:
dl.php?dl=../../../etc/passwd
You need to check file path or just strip it if all files to download is in one directory.

Shrike

Better still don't rely on flakey methods of authenticating and have your users log in in order to download stuff.

bubblenut

andrewteg, your method will work with most cases, but it's far from the ideal. If you specifically don't want users to have to log in then I would suggest setting a session variable and then checking that this session has been set.

Is this purely to avoid hot-linking as I can't see any other benifit for it.