disabling hotlinking [Archive] - ForumsHQ

[Raybdbomb]

I set this up for a site i'm working on, tell me if anyone sees a problem. the goal is to disable all hotlinking, because i have a very precise bandwidth limit, and all hell breaks loose if i go over that.



i have each file that is going to be downloaded go through get.php with the url of the file as the GET variable. i chmod'ed all files (that would be downloaded) at 600, that's read and write for user, nothing for everyone else. so when someone does /get.php?id=blarg.zip it will download zip because it's executed from the user (this works), but if someone goes to /blarg.zip they will get a forbidden message because they don't have read rights.



is there anything i'm missing or will that work properly?



also I want to redefine that Error 403 Forbidden page. anyone know how?

[syntax53]

I set this up for a site i'm working on, tell me if anyone sees a problem. the goal is to disable all hotlinking, because i have a very precise bandwidth limit, and all hell breaks loose if i go over that.



i have each file that is going to be downloaded go through get.php with the url of the file as the GET variable. i chmod'ed all files (that would be downloaded) at 600, that's read and write for user, nothing for everyone else. so when someone does /get.php?id=blarg.zip it will download zip because it's executed from the user (this works), but if someone goes to /blarg.zip they will get a forbidden message because they don't have read rights.



is there anything i'm missing or will that work properly?



also I want to redefine that Error 403 Forbidden page. anyone know how?

well, you could just put your files in a directory that people can't see, and your script would take the file name variable and attach the correct path in front of it (invisible to user). but, my question is what prevents them from just nabbing everything with the get script?

[Raybdbomb]

well, the get script doesn't allow downloads if the bandwidth is at the limit:





$errorMesg = "Unknown error";

function go(){

$tmp = substr($_SERVER['HTTP_REFERER'],0,30);

if($tmp != "http://s93518647.onlinehome.us"){

$errorMesg = "No hotlinking allowed, please.";

return false;

}

$sql = mysql_query("SELECT * FROM bandwidth WHERE month='$mon'");

$dbRow = mysql_fetch_assoc($sql);

$bw = $dbRow["size"];

if($bw >= 4500000000){ //if bw is more than 4.5 gigs

$errorMesg = "We are currently over our bandwidth limit. Please try again next month.";

return false;

}

return true;

}





when a file is downloaded, it executes this function:



function incrementBandwidth($in){

$mon = date("M");

$size = filesize($in);

$sql = mysql_query("SELECT * FROM bandwidth WHERE month='$mon'");

$dbRow = mysql_fetch_assoc($sql);

$bw = $dbRow["size"];

$newbw = $bw + $size;

$sql = mysql_query("UPDATE bandwidth SET size='$newbw' WHERE month='$mon'")

or die (mysql_error());

}



now that would be the MAXIMUM bandwidth used, because that would happen to increment the bandwidth used even if they click cancel anytime during the download

[Raybdbomb]

ah crap i just noticed that the files chmod'd like that don't allow me to do the filesize operation filesize("blah.zip") now returns an error. well crappity....

[Raybdbomb]

ah i found out the problem with that... i just chmod'd their directory which made it inaccessible to anyone (including me). needs to have +x, so 700 was the correct chmod for that