treasure hunt

chesksum_

I am trying to create a treasure hunt for a clients website - the visitors are given the URL of the login page and some clues to guess the username and password required to login and unlock the treasure.

The successful user logs in and is presented with instructions on how to claim their prize. Subsequent visitors are directed to a page informing them that they didn't quite make it on time.

The way I'm thinking of doing this relies on logging the IP of the first user to correctly input the username and password (the one and only winner). Their IP is written to a text file.

The treasure page then compares user IP with the first IP in the text file - if they match - user can proceed to collect the bounty - if not they are sent to a page informing them they arrived to late and have not won.

This is what I have written so far:

// try_your_luck.php


<form name="form" method="post" action="login.php">
	<ul>
		<li>User: <input type="text" size="20" name="user"></li>
		<li>Pass  <input type="password" size="20" name="pass"></li>
		<li><input type="submit" value="Login"></li>
	</ul>
 </form>

// login.php

<?php

$usercorrect=blah; 
$passcorrect=blah; 

 if ($user==$usercorrect && $pass==$passcorrect) {

$log_file = "ip.txt"; 
$ip = getenv('REMOTE_ADDR'); 
$fp = fopen("$log_file", "a");
fputs($fp, "$ip");
flock($fp, 3); 
fclose($fp);

 $goforth = "location: treasure.php";  // login correct - go forth and rejoice in thy treasure
 header($goforth);
 } elseif ($user!=$usercorrect || $pass!=$passcorrect) {
     header("location: try_again.php"); // login incorrect - access denied
 } else {
     break;
 }
?>

I only want one IP to be written to the file ip.txt - is this possible?

// treasure.php

<?php 

$ip = getenv('REMOTE_ADDR'); 

$winner = fopen the file ip.txt and parse the ip address - any pointers?

if ($ip!=$winner) {
	header("location: oh_well.php"); // user re-directed and informed that they have lost :(
	elseif ($ip==$winner) {

<html>

I'm faltering a bit now.

Does this interest anyone? 😛

sys4dm1n

i must say, this is interesting. but im not sure on what todo...try googling the question?

bradgrafelman

So you're saying you want to see if the user's IP is in the file? The exact IP? Well, load the file into an array and search for their IP:

<?PHP
$ip = getenv('REMOTE_ADDR');  

$ip_array = file('ip.txt');
$result = array_search($ip, $ip_array);

if($result === FALSE || $result === NULL) {
    header("location: oh_well.php"); // user re-directed and informed that they have lost
} else {
    // IP was in file, fill in appropriate code here
}

You used the 'a' flag on your fopen() call, so it looks like you're adding an IP onto the file every time. If this is NOT what you want, and you only want one IP to be in the file at all times, then use the 'w' flag which truncates the file to zero length after writing. To read more about the flags to use, look at the manual page for [man]fopen/man. If you still want to create an array of the multiple IP's in the file, you need to add a "\n" break after the user's IP ($ip) in your call to fputs().

chesksum_

Thanks Brad,

I just tried your code - also changed the flag to W

$fp = fopen("$log_file", "w");

However - it is still possible for other IP addresses to access the treasure page without being forwarded to oh_well.php

All I want to do is log the first IP to arrive at treasure.php - and all subequent IP's should be forwarded to oh_well.php

I'm sure there's an easier way of doing this without relying on IP's but alas I chose this route.

laserlight

Actually, you dont need to search the file for the IP.
You just need to store 1 IP, i.e. that of the user who first entered.

Place something like this on your treasure.php page:

<?php
$ip = trim(file_get_contents("ip.txt"));
if (strlen($ip) == 0 || $ip === $_SERVER['REMOTE_ADDR']) {
	$fp = fopen("ip.txt", "w");
	fwrite($fp, $_SERVER['REMOTE_ADDR']);
	fclose($fp);
	//display instructions on claiming prize
} else {
	header("Location: http://www.example.com/oh_well.php");
	exit;
}
?>

checksvm

Thanks Laserlight, this works

Amended login.php

<?php

$usercorrect=blah; 
$passcorrect=blah; 

 if ($user==$usercorrect && $pass==$passcorrect) {

 $goforth = "location: treasure.php";  // login correct - go forth and rejoice in thy treasure
 header($goforth);
 } elseif ($user!=$usercorrect || $pass!=$passcorrect) {
     header("location: try_again.html"); // login incorrect - access denied
 } else {
     break;
 }
?>

Amended treasure.php

<?php
$ip = trim(file_get_contents("ip.txt"));
if (strlen($ip) == 0 || $ip === $_SERVER['REMOTE_ADDR']) {
    $fp = fopen("ip.txt", "w");
    fwrite($fp, $_SERVER['REMOTE_ADDR']);
    fclose($fp);
    //display instructions on claiming prize
	echo "<br><br><div align=center>Congratulations! You are the first person to find the treasure and have won!</div>";
} else {
    header("Location: oh_well.php");
    exit;
}
?>

Only problem I have come across is - what if two or more people sharing the same internet connection enter the correct user and pass?
- they all get the winners page!

Is there a way to guarantee that the winning information can only be seen once and then in effect expires (even for the winner)?

checksvm

Could check to see if the textfile is empty -
If ip.txt is not empty - then re-direct to oh_well.php

sounds like a plan, does anyone have the code?
:p

laserlight

In that case, you dont need to bother with IP addresses at all.
When the first user enters the page, the script reads from the file.
If the file is blank (e.g. 0 length string read), then it prints the instructions and writes to the file.
Otherwise, it simply denies the instructions to the user.

checksvm

what does it write to the file?

laserlight

Anything, so long as it writes something.
Something like "1" would be a good choice.

checksvm

Is this along that right lines?

<?php
$text = trim(file_get_contents("text.txt"));
if (strlen($text) == 0 || $text="1") {
$file = fopen('text.txt', 'w', 1);
fwrite($file, $text);
fclose($file);
//display instructions on claiming prize
    echo "<br><br><div align=center>Congratulations! You are the first person to find the treasure and have won!</div>"; 
}
else {
    header("Location: oh_well.php");
    exit;
} 
?>

laserlight

Remove the:
|| $text="1"
part.

It should be:
|| $text=="1"
to begin with, but you dont even need it as you're not interested in what the file contains.
You're only interested in whether or not the file contains anything.

checksvm

Okay removed. I do need to specify what will be written though yep? ie: 1

So how about this:

<?php
$text = trim(file_get_contents("text.txt"));
if (strlen($text) == 0) {
$text="1";
$file = fopen('text.txt', 'w', 1);
fwrite($file, $text);
fclose($file);

//display instructions on claiming prize
    echo "<br><br><div align=center>Congratulations! You are the first person to find the treasure and have won!</div>";  

}
else {
    header("Location: oh_well.php");
    exit;
} 
?>

laserlight

Just try and see.

There's one minor problem though.
The location header accepts an absolute URI, so you'll need to use stuff like $_SERVER['HTTP_HOST'] to make it fully qualified.

checksvm

It bloody works!

incredible - thanks for your tutoring!

Terima kasih