I'm trying to protect files on my server from being downloaded by scripts. My team lead wants me to make it so that when a file is being downloaded by curl they only get an empty file, but i am unsure of how to set it up. I understand that this may not be the most secure solution, so i am also curious of the downsides if there are any
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
but the goal is not to determine whether or not the term "curl" is in the url, the goal is to prevent the page from being remotely accessed from a script that may or may not be using curl. also if i were to use curl commands in a file named foo.php, the remote download will still work because curl is not the url of the referer. plus the php script could use curl or something like it to send out an incorrect referer.
> ...the goal is not to determine whether or not the term "curl" is in the url,...
The script that I posted is not to determine if the term "curl" is in the url but to check the user-agent string. The user-agent string contains information such as which browser program and operating system is used (http://en.wikipedia.org/w
The only way to do it is via user-agent string (we are not talking about url of the referer but the user-agent string here). There are quite a lot of user-agent string out there (http://www.user-agents.or
1) If you know what user-agent string that the automated download script you want to block (you can check it from the server log), then use that user-agent string to block it.
2) If you don't know what user-agent string, you may want to only allow those that you know (i.e. mozilla, internet explorer, firefox, safari, opera, googlebot etc).
3) You may want to put a robot.txt (http://www.robotstxt.org/
However, having said that, any program such as curl can send any type of user-agent string to your server to spoof it.
curl is a very powerful tool, and can mimic any useragent, as has been stated. your best bet would be to put an image verification prior to downloading. http://www.php-mysql-tutor
-Matt
A turing key or CAPTCHA is a randomly generated image of letters that the user needs to input in order to proceed to the next step ... machines can not (or at least the software spammers have at this moment in time) recognise the letters in the image so they can not proceed to the next step .....
have a look at http://viebrock.ca/code/10
Business Accounts
Answer for Membership
by: slyongPosted on 2007-06-04 at 20:52:48ID: 19214301
You can use the User-Agent string of curl to detect it:
if (preg_match('/curl/i', $_SERVER['HTTP_USER_AGENT'
die();
}
However, you have to include or require that into all your php files, the simpler way is to use Apache's mod_setenvif:
setenvif user-agent ^curl goaway
<Limit GET POST>
Order Allow,Deny
Allow from all
Deny from env=goaway
</Limit>