Geek Answers Handbook

Limit direct link to AJAX pages in a specific directory

I don’t want people to go directly to pages in the AJAX directory, but they still need to be served from their parent page. I tried many .htaccess lines, but they all block it from the main page. To summarize, I do not want people to be able to enter http://www.mysite.com/AJAX/page1.html and view it, but page1.html needs to be brought to its parent page through AJAX.

<LIMIT GET POST> Order deny, allow deny from all </LIMIT>

blocks all access

Can you define a flag in the parent define('IS_IN_SCRIPT',1); file define('IS_IN_SCRIPT',1); and check it out on AJAX pages? Will it work with AJAX pages or just PHP?

+4
source share
3 answers

PHP Referer Definition

Check if $_SERVER['HTTP_REFERER'] in your domain (or a list of valid domains)

Then redirect if not.

 if (!empty($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'yourdomain.com') !== false) { echo 'probably from your own site'; }
+3
source

You can always tweak something so that if any particular argument is not passed through GET or POST, the ajax page will simply redirect you to another location.

In php it will look like

 if(!isset($_POST['some_var'])) header('Location: somePage.html');
+1
source

$$ zoe_daemon

you need a "linker" file to open a personal file from the parent page via AJAX.

 /*this is simple "linker" file to open private file in folder named "private" from parent page via AJAX.*/ //begin linker.php <?php $link = $_GET["link"]; include "../private/$link.php"; ?> //end linker.php

and then the file in the "private" folder should check if the string "private" is contained in the request URI; this is not valid for a user who wants to use a private file directly. for axample, "login.php" inside a folder named "private" cannot be obtained directly if you put this code before entering the operating code that you want to put

 //begin login.php $count = 0; $test = str_replace("name_of_directory_cannot_directly","dummy_string",$_SERVER['REQUEST_URI'], $count ); //or if ($count > 0) { die "Ooouuuppppsss, you cannot access this file directly"); } /* //your code here.... */ //end login.php
0
source

More articles:


All Articles