+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] Secure You're Admin Pages Or Any Page With This Code! (/showthread.php?tid=4603028)
Secure You're Admin Pages Or Any Page With This Code! - Internet Security - Dec 26, 2014
I was searching the web and i found a few lines of code that ip lock a page to you're ip and redirect you to any link if you are not the owner.
Credits: Guinness
PHP Code
<?php
$ip = $_SERVER['HTTP_CLIENT_IP'];
if($ip!="IP Goes Here") {
Header("Location: http://google.com");
?>I don't know if this has been seen on hf but i had to share it just in case it wasn't :)
* - Ceanko - Dec 26, 2014
Honestly this is one of the worst methods you can use to protect yourself, or your server/software. The $_SERVER['HTTP_CLIENT_IP'] header can be spoofed by the client (browser). This isn't secure in any way. If you're going to be using this method I'd suggest rather using $_SERVER['REMOTE_ADDR'].
* - c00perzz - Dec 26, 2014
(Dec 26, 2014 03:34 AM)Ceanko Wrote: Honestly this is one of the worst methods you can use to protect yourself, or your server/software. The $_SERVER['HTTP_CLIENT_IP'] header can be spoofed by the client (browser). This isn't secure in any way. If you're going to be using this method I'd suggest rather using $_SERVER['REMOTE_ADDR'].
i agree that it can be spoofed but since its a whitelist you must know which IP is being allowed in order to spoof it :)
in any way, if either one is going to be used, it must be used as ADDITIONAL step and should not be used as the only method to secure a script.
* - Sakuto - Dec 26, 2014
Well, no job if you are not in your house, no IP modification allowed, this is not a good way to do it AT ALL
* - Internet Security - Dec 26, 2014
As i said i did not make this, I am just sharing it with you guys, Don't kill the user kill the guy that made it (Check credits)
* - Ilikeponies69 - Dec 26, 2014
(Dec 26, 2014 03:24 AM)Internet Security Wrote: I was searching the web and i found a few lines of code that ip lock a page to you're ip and redirect you to any link if you are not the owner.
Credits: Guinness
PHP Code
<?php
$ip = $_SERVER['HTTP_CLIENT_IP'];
if($ip!="IP Goes Here") {
Header("Location: http://google.com");
?>
I don't know if this has been seen on hf but i had to share it just in case it wasn't :)
Here's one better:
PHP Code
<?php
session_start();
// Check if hidden behind Cloudflare
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}
$ip = $_SERVER['REMOTE_ADDR'];
$allowed_ips = array('admin_home' => '255.255.255.255');
foreach($allowed_ips as $auth_name => $auth_ip) {
if($auth_ip != $ip) {
exit('You are not authorized to see this page.');
} else if($auth_ip == $ip) {
$_SESSION['auth_name'] = $auth_name;
$_SESSION['auth_ip'] = $auth_ip;
}
}
// Display page content down here, since we're authorized to see it.
?>Now, what if we're not at home?
PHP Code
<?php
$auth_keys = array('1234567890abcedefghijklmnopqrstuvwxyz');
$auth_attempt = $_GET['auth']; // using get, but easy change to $_POST
if(!in_array($auth_attempt, $auth_keys)) {
exit('You are not authorized to view this page.');
}
// Assumes we're authorized if we can still view page.
?>* - Idle cares - Dec 26, 2014
Alternative titles:
Geeks Hate This Programmer For This One Weird Trick
Watch This Code In Action Will Make You Amazed
This One Snippet Will Solve All Your Problems And It's EPIC!
Sorry, couldn't resist.
However if people actually searched through the HF PHP section instead of just making a new thread for every problem they have, a collection of snippet threads might be useful. But they do not and so it is not. Try helping out others on their threads :D
* - Han. - Dec 26, 2014
This is a god-awful method of protecting anything.
Anyone looking at this who doesn't realise it's shit, please DO NOT use this.
* - stackoverflowin - Dec 26, 2014
This is a terrible way, and the code is really bad as well.
* - Dula1 - Dec 26, 2014
lol that's an awful way indeed, HTTP_CLIENT_IP can be easily spoofed
* - Noire Dragon - Dec 27, 2014
Also don't just use header() add exit or die they can ignore the header location...
* - Internet Security - Dec 27, 2014
As i said it is not mine I just found it, I do not need to use protection for my site as it is already protected. I was only sharing it with you,