[Resolved] How to prevent users from viewing pages?

bodzan

I am building a system that uses require and include functions to include multiple files all over the place...

First question is: is that wise or should I avoid using these functions this way?

More important second question: How to prevent users from seeing these pages solo i.e when they type in an URL of that page I'm using as an include or require page of another?

To make it more clear:
I have a page inde.php and I include in it page called leftContent.php. How can I prevent users from seeing leftContent.php by itself?

Thanks in advance for any help...

kidsleep

you can put this bit of code at the top of your index page


define("LOCATION", "index");

and this bit in your left content page


if(!defined('LOCATION'))    {

die();

}

that would prevent people from viewing the leftcontent page by itself

bodzan

Thanx for the reply and the idea
kidsleep...

Never came across of this one. I will keep this thread open for a while just to make sure if there are other ideas as well...

ShawnK

The way I do is like this:

<?php

$thisFile = "page.php";

if(eregi($thisFile, $_SERVER['PHP_SELF']))
{
     die("<b>Error: </b> You cannot access this page directly!");
}

?>

bodzan

Thanx ShawnK...

This is getting interesting... 😃

bodzan

I did it this way, by combining both kidsleep's and ShawnK's solutions:

On a page in which I include files I added the line:

define("LOCATION", "index");

Than on the pages that are intended to be included:

if(!defined('LOCATION'))    {
     header("Location:index.php")
     die();
}

$thisFile = "page.php";

if(eregi($thisFile, $_SERVER['PHP_SELF'])){
     header("Location:index.php");
     die();
}

I added the header part in both solutions so the user won't see the blank page if he gotten there by mistake...

Are there any more good ideas or maybe a piece of advice on this?

paulnaj

Hi guys,

Just a thought ... if the include only contains functions, then no code will actually run, so the user won't see anything anyway.

Paul.

bodzan

Hi paulnaj thanx for the response...

Unfortunatelly there are pages that serve content and perform rious calculations from MySQL database to do so... If I remove this code the page won't display anything except some pieces of code and the warning of failing to connect to the database...

I figured that it might have some security impacts...

ShawnK

The reason you want to use this is because if someone has a configuration file that has passwords you don't want to have someone reading the variables.

id10t

Do you have control over the server? You can use a directive to not allow the requesting of a file with particular exensions. So name all your include files like foo.inc bar.inc, etc. and block the server from sending *.inc

Of course one of the above suggestions about using the header to re-locate the user is good to use as well for its own reasons (no partial content pages).

bodzan

I would surely do what you suggest id10t (funny nick 😃), but I have no control over the server...

So my header/location directives makes sense after all? I'm glad that I can come up with an idea or two of my own... 😃

I was wondering though: can some of it be done using .htaccess file?

Weedpacket

Originally posted by bodzan
Hi paulnaj thanx for the response...

Unfortunatelly there are pages that serve content and perform rious calculations from MySQL database to do so... If I remove this code the page won't display anything except some pieces of code and the warning of failing to connect to the database...

This is one good reason to use functions, or rather to localise all your output functionality, rather than have it scattered across multiple files, so that the only files that can produce output when you run them directly are those that should.

So for example a file that consists entirely of

<?php
// Example only - I wouldn't do this
// with this sort of data in real life.
$database_name = 'foo';
$database_user = 'bar';
$database_password = 'wibble';
?>

doesn't produce any output, so if anyone tried requesting it directly they would, as paulnaj says, get a blank page. They would also get a blank page if the file contained something like

<?php
function footer()
{
?><div style='width:100%;font-family:sans-serif;font-size:8pt;color:lightgrey;text-align:centre;'>Copyright &amp;amp;copy;<?php echo date('Y');?> IniTech Corporation.</div>
</body></html>
<?php
}
?>

Because there is nothing in that page that actually calls the footer() function.

bodzan

Hi Weedpacket thanx for reply. I'm lost in your reply though.

Originally posted by Weedpacket
This is one good reason to use functions, or rather to localise all your output functionality, rather than have it scattered across multiple files, so that the only files that can produce output when you run them directly are those that should.

My file that I'm trying to prevent from seeing without the file that includes it does something like this:

<?php
//simplified sample
$sql = "SOME QUERY HERE";
$result = my_query($sql);//function that connects to the database and performs a query which is defined elsewhere

echo "<table>"
while($row = mysql_fetch_assoc($sql)){
     echo "<tr><td>".$row['fieldName']."</td></tr>";
}
echo "</table>";
?>

Clearly it produces nothing more than a table populated with database table content. The function wouldn't do because this layout for data works for this page almost exclusivelly.

All other page layout items that I have (including navigation menu and such) are defined elsewhere and therefore if a user sees this page he doesn't have a clue where to go from there and that's what I'm trying to prevent...

I figure there are not much consequences when a user sees this message:

Fatal error: Call to undefined function: my_query() in path/to/page.php on line 9

Or is there? Because if I don't use code proposed by kidsleep and ShawnK I get that or simillar error on those pages...

Weedpacket

Originally posted by bodzan
Clearly it produces nothing more than a table populated with database table content. The function wouldn't do because this layout for data works for this page almost exclusivelly.

Well, "Nothing more than..." isn't the same as "nothing", but we'll see...

I figure there are not much consequences when a user sees this message:
Fatal error: Call to undefined function: my_query() in path/to/page.php on line 9
Or is there?
[/b]

You shouldn't have display_errors turned on on your live site (though you're by no means alone...). Quite apart from the fact that they're butt-ugly, what you're offering if you have them turned on is what amounts to an "attack debugger". People can try all sorts of silly things to see what sort of error messages they get; and from those deduce things about your directory structure, what functions you're using, .... just take a good sample of the error messages you've seen and you can get an idea of the sort of information about your site you could potentially advertise to the world.

Because if I don't use code proposed by kidsleep and ShawnK I get that or simillar error on those pages...

Well, the page that uses my_query() could include the definition of the my_query() function, but you wouldn't want to do that, because then you really would be trying to run it. You've got all those echo statements sitting around waiting to be executed by anyone who wanders along.

I don't really have any problems with kidsleep's solution, but it does put the burden on you of making sure that every file that might get included has an appropriate check to see if it being included in a suitable file, for every file that it might be included in.

bodzan

You have cleared a lot of foggy things to me...

That error message I showed you is the one I get on my machine where I develop with E_ALL turned on to seee if I make some clumsy mistakes...
I'm not even sure how the hosting server will act! I guess they have it set up at E_ERROR but I just don't know it yet...

I did the job like both kidsleep and ShawnK suggested because so far I don't intend to make this site so huge that I can't implement it on every page I need it on... I'm just at the beggining of the job so it would be easy to implement it on every new page that I need to include in the main page...

I don't really have any problems with kidsleep's solution, but it does put the burden on you of making sure that every file that might get included has an appropriate check to see if it being included in a suitable file, for every file that it might be included in.

I can take the burden on this one as long as it is safer for me to do it rather than not to...