[utaka]

Now(Ver1.6) referrer check is too severe.

Example:
Real URL : http://www.myurl.com/search.php?id=100
Use mod_rewite
http://www.myurl.com/search/100.html

This Case $referrer != $page_url
$referrer = http://myurl.com/search.php
$page_url : http://myurl.com/search/100.html To BAN!

comments/includes/app/processor.php

PHP Code:

<?php 

    /* Check Referrer */

    if ($settings->check_referrer) {

        if (isset($_SERVER['HTTP_REFERER'])) { //if referrer available

            $referrer = cmtx_clean_url($_SERVER['HTTP_REFERER']); //get and clean referrer

            $page_url = cmtx_clean_url(cmtx_get_page_url()); //get and clean page URL

            if (!preg_match('/\.[0-9]+\./i', $page_url)) { //if URL is not an IP address

                if ($referrer != $page_url) { //if referrer does not match page URL

                    cmtx_ban(CMTX_BAN_REASON_INCORRECT_REFERRER); //ban user for incorrect referrer

                }

            }

        } else {

            cmtx_error(CMTX_ERROR_MESSAGE_NO_REFERRER); //reject user for no referrer

        }

    } 

[Steven]

Hi,

Thanks for your suggestion. I will change it for v1.7. This is another way:

PHP Code:

<?php 

/* Check Referrer */

    if ($settings->check_referrer) {

        if (isset($_SERVER['HTTP_REFERER'])) { //if referrer available

            $referrer = parse_url(cmtx_clean_url($_SERVER['HTTP_REFERER']), PHP_URL_HOST); //get and clean referrer

            $page_url = cmtx_clean_url(cmtx_get_page_url()); //get and clean page URL

            if (!preg_match('/\.[0-9]+\./i', $page_url)) { //if URL is not an IP address

                if (!stristr($page_url, $referrer)) { //if page URL does not contain host of referrer

                    cmtx_ban(CMTX_BAN_REASON_INCORRECT_REFERRER); //ban user for incorrect referrer

                }

            }

        } else {

            cmtx_error(CMTX_ERROR_MESSAGE_NO_REFERRER); //reject user for no referrer

        }

    }