in reply to Checking where my CGI is bing called from.
Although this provides a way to compare a few sites, there is a major security flaw (that I feel can be easily fixed) by allowing just $ENV{HTTP_REFERER} to match 'www.mysite.com'... You see, I might as well have an URL like "http://badsite.com/www.mysite.com/" and it would pass!my @friends = ( 'www.mysite.com', 'www.yoursite.com', 'www.hissite.com/mypage/' 'www.hersite.com/herpage/' ); foreach $site (@friends) { if ($ENV{'HTTP_REFERER'} =~ m/$site/i) { $isafriend = 1; } } if (!$isafriend) { # do the stuff here, Location, html, etc. }
|
|---|