HTTP_REFERER problem

[raider00321]

Hey, ive ran into a problem with the php function called HTTP_REFERER with a open source mmo called promisance. My problem is that the page just doesnt load properly.
Promisance.php

<?
include("const.php");
if ((stristr($HTTP_REFERER,$SERVER_NAME)) || ($action == "gameranks") || ($action == "top10") || ($action == "login") || ($action == "signup") || ($action == "count") || (($action == "game") && ($HTTP_REFERER)))
{
   if (!$link = @mysql_connect($dbhost,$dbuser,$dbpass))
   {
      include("html.php");
      HTMLbegincompact("Database Error!");
      print "The game database is currently unavailable. Please try again later.\n";
      HTMLendcompact();
      exit;
   }
   mysql_select_db($dbname);
   if ($action == "game")
      $action = "main";
   include("$action.php");
}
else
{
   include("html.php");
   HTMLbegincompact("Error!");
?>
<table>
<tr><th style="color:#00006F;background-color:#FFFF9F">Security Violation</th></tr>
<tr><td>We have determined that you are accessing the game the wrong way, or an error might have occurred.

<?
   if (!$HTTP_REFERER)
      print "You may NOT access in-game pages via bookmarks!

?>

\n";
   else   print "You attempted to view this page from $HTTP_REFERER, which is not on $SERVER_NAME.
\n";
?>
If this error persists take the following steps in the following order:

1) Return to <?=$config[home]?> and re-login.

2) Upgrade your internet browser.

3) Contact the game administrator at <?=$config[adminemail]?>

4) Contact your ISP.
</td></tr>
</table>
<?
   HTMLendcompact();
}
?>

this is the main file form which should load all the other pages

Index.php

<style type="text/css"><!--
body {
   background-color: #000000;
}
.Links {left:105px;
      top:60px;
      height:60px;
      width:1127px;
      background:#660000;
      border:2px;
      border-style:ridge;
      border-color:#621313;
      border-bottom-color:#999999;
      position:absolute;
}
.Main {left:105;
     top:119;
     height:330px;
     width:1127;
          background-color:#660000;
     border:2px;
     border-style:ridge;
     border-color:#621313;
     position:absolute
}

.Affiliates {top:438px;
         left:105px;
         height:100px;
         width:1127px;
         background-color:#660000;
         border:2px;
         border-style:ridge;
         border-top-color:#99000;
         border-color:#660000;
         position:absolute;
}
.Logo {left:5px;
     top:5px;
     height:210px;
     width:210px;
     background-color:#444444;
     border:1px;
     border-style:groove;
     position:absolute;
}
.Gameinfo {left:5px;
        top:223px;
        height:90px;
        width:210px;
        background-color:#444444;
        border:1px;
        border-style:groove;
        position:absolute;
        }
.gamename {left:315px;
         top:5px;
         height:30px;
         width:500px;

     position:absolute;
     }
.Aboutgame {left:315px;
         top:40px;
         height:200px;
         width:500px;
         background-color:#444444;
         border:1px;
         border-style:groove;
         position:absolute;



     }
.Quicklinks {left:918px;
         top:5px;
         height:308px;
         width:200px;
         background-color:#444444;
         border:1px;
         border-style:groove;
         position:absolute;
         }</style><font color="#990000" size="12">
<center>LAZY PRODUCTIONS ONLINE</center></font>
<div class="links">
<FONT>|</FONT><a href="/prominfo.php">Promisance[/url]<FONT>|</FONT>
<a href="/km2info.php">Kill Monster 2[/url]<FONT>|</FONT>
<a href="/foruminfo.php">Forums [/url]<FONT>|</FONT></div>
<div class="Main">
<div class="Logo"><IMG SRC="images/lazyproductionlogo.jpg" width="210px" height="210px"> </div>
<div class="Gameinfo">Site Admin: Raider00321/Raider Games Running: 2

Site Creation:17th June 2007 </div>
<div class="gamename"><font size="6">
<center>Lazy Productions Online</center></font></div>
<div class="Aboutgame">
<center>Welcome to Lazy Productions online.



Lazy Productions is still under construction. However we are offering fully operational MMORPG's.

Right now, Both Promisance and KM2 are fully operational.

If you wish to leave a message, you can do so in the forums as it is also operational.

I hope you enjoy your visit.

Your Admin, Raider00321</center></div>
<div class="Quicklinks"><a href="km2/">Kill Monster(Play Now!)[/url]



<a href="/promisance/promisance.php">promisance(Play Now!)[/url]



<a href="WOTA/">War of The Ages(In Construction)[/url]
<p></p>

</div></div>
<div class="Affiliates">
<center><img alt="MMORPG / MMOG Top 50 Games" src="[url]http://top50.onrpg.com/images/vote.jpg" border="0">[/url] <img alt="Ragnarok Online Server" src="[url]http://www.xtremeTop100.com/votenew.jpg" border="0">[/url]</center></div>

and thats my index page

Any help anyone could give would eb greatly appreciated as ive been struggling with it for a while now Smiley

[dagon]

its not a function its a global var, and its submitted by the browser but it has no obligation to do so, mine is disabled, you can't rely that it is set or accurate.

[dagon]

and you should be using $_SERVER['HTTP_REFERER'] not $HTTP_REFERER

[suntra]

As dagon said it, never rely on HTTP_REFERER, NEVER, NEVER, NEVER !

It's a header SENT by the CLIENT browser ! Anyone who can use sockets can change it !

[raider00321]

OK, So how could i change it so it would work without HTTP_REFERER? I realised that it was unreliable and if possible to change it, i tred t research into it, but was unsuccessfull, which is why im asking 🙁.

[bradgrafelman]

Been a very long time since I've seen Promisance scripts... used to love that game.

Anyway, personally, I would get rid of all of the referrer coding. If you really want to make sure they accessed the game from the proper page, set a session value on that page and check for that instead.

For the top script, you'd basically just remove the if() condition (and the opening braces, of course), but leave what's inside the statement (since this is what is normally executed). Then, get rid of everything inside the else {} bit.

If you follow my suggestion, and use session values to track where they came from instead, you can leave the exact same setup, just change the $HTTP_REFERER bits to reference the proper $_SESSION value.

[MarkR]

Never rely on HTTP_REFERER (as your code does above). It's not guaranteed to be sent at all, a large proportion of "personal firewall" products and other things will remove the header; moreover, in some browsers it can be turned off anyway.

Mark

[raider00321]

Ok, i edited it to this

<?
include("const.php");
$action == "gameranks";
$action == "top10";
$action == "login";
$action == "signup";
$action == "count";
$action == "game";
{
	if (!$link = @mysql_connect($dbhost,$dbuser,$dbpass))
	{
		include("html.php");
		HTMLbegincompact("Database Error!");
		print "The game database is currently unavailable. Please try again later.\n";
		HTMLendcompact();
		exit;
	}
	mysql_select_db($dbname);
	if ($action == "game")
		$action = "main";
	include("$action.php");
}
?>

but then i got this error message.

Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, [e-mail] and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

What can i do to fix this now??