/* REFERRER CHECKING SCRIPT - JohnC - 2 Oct 2000
Checks the document.referrer, so all users MUST come to the page
only from specific URL(s) - therefore stops direct linking to the page. */
/* ######## USAGE AND SETTING UP - HERE'S HOW YOU USE THE SCRIPT !
FIRST - PUT A LINK TO THIS SCRIPT right at the top of your HTML page,
immediately after the tag and **before** etc :
<SCRIPT SRC="../check.js"></SCRIPT>
SECOND - TO STOP NON-JAVASCRIPT BROWSERS beating the system, place the
following META tag immediately below that, and set the URL to kick them to.
- note the wierd way the " are used in this - don't change their positions !
<NOSCRIPT><META HTTP-EQUIV="REFRESH" CONTENT="0; URL=kick_to.htm"></NOSCRIPT>
THIRD - TO STOP BROWSERS CACHING THE PAGE, put these 2 lines immediately below
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Cache-Control" CONTENT="no-cache">
LASTLY - CONFIGURE THE SCRIPT by following the instructions below... */
/* -----------------
STEP 1. WHAT SITES/PAGES ARE ALLOWED TO ACCESS THIS PAGE ?
Put the specific hostnames that you want to allow into the
MYSITES Array below. Put ' ' around each, commas between them...
You can be very specific and include path and page URL if you want.
- I recommend you do NOT include http:// or www at the start ! */
var MYSITES=new Array('gclubnet.com','warezslutz.com','site.com/path/page.htm');
/* ------------------
STEP 2. SET UP THE METHODS TO USE... for each one, set to one of the following :
'allow' -> do nothing, page will load normally
'kick' -> redirect immediately to a specific webpage
'message' -> show full screen message (as specified in BF_message below)
'fake404' -> makes a page that looks just like a "404 Not Found" */
// 2a. WHAT TO DO IF THE REFERRING PAGE IS *NOT* ONE OF THE ALLOWED ONES ?
var BANNED_REF_METHOD = 'fake404';
// 2b. WHAT TO DO IF THE REFERRER IS BLANK or NOT KNOWN ?
// eg: surfer is using proxy, OR a browser that strips referrer field, OR
// if they type the URL directly OR load page from a bookmark or history
var BLANK_REF_METHOD = 'message';
// 2c. WHAT TO DO IF THE BROWSER DOES NOT HANDLE REFERRER PROPERLY ?
// IE3 (and perhaps others too) return *this* page's URL rather than
// the referring page's - this would normally cause the script to fail
// Note if you set this to other than 'allow' then IE3 will be ALWAYS be banned !
var FALSE_REF_METHOD = 'message';
// 2d. WHAT TO DO IF THE PAGE IS OPENED FROM A FILE ?
// eg: If a lamer saves page to hard-drive then opens from there
// Note: If this is NOT set to 'allow' you will NOT be able to view page offline either
// - It's not much of a 'security' threat to leave this as 'allow', it's fun to
// let them edit/view offline but get an error when they publish the pages online :-)
// Also note even if set to 'allow' you will not be able to open page directly
// if BLANK_REF_METHOD is not also set to 'allow' (not recommended) !
var FILE_OPEN_METHOD = 'message';
/* -----------------
STEP 3. SET UP YOUR MESSAGES and/or KICK URLs (if you are using these methods)...
Note the way I add extra lines in the message fields below, you can
add extra lines by using a + and continuing on like I have done.
Each line must have ' ' around & variable must end with a ; character.
You can use HTML in messages, but you CANNOT use ' or ; characters */
// 3a. "BAD REFERRER" Redirect URL and/or MESSAGE...
var BAN_KickURL = 'http://www.elitetoplist.com/cgi-bin/topsites.cgi?wslutzz';
var BAN_Message = '<CENTER><H1>Sorry, Access Denied !</H1>'
+ 'Sorry, access via the previous site is not allowed !'
+ '<P>Please visit from legitimate source';
// 3b. "BLANK REFERRER" Redirect URL and/or MESSAGE...
var BLK_KickURL = 'http://www.elitetoplist.com/cgi-bin/topsites.cgi?wslutzz';
var BLK_Message = '<CENTER><H1>Sorry, Access Denied !</H1>'
+ 'You cannot open this page directly or from a bookmark'
+ '<P>Nor can you access using a browser or proxy server'
+ ' that strips out the referer field.'
+ '<P>Please use a normal web browser and/or'
+ ' access from a legitimate source';
// 3c. "FALSE REFERRER" Redirect URL and/or MESSAGE...
var FAL_KickURL = 'http://www.elitetoplist.com/cgi-bin/topsites.cgi?wslutzz';
var FAL_Message = '<CENTER><H1>Sorry, Access Denied !</H1>'
+ 'You cannot access this webpage because your browser'
+ ' is falsely reporting the referer field.'
+ '<P>Please update your web browser !';
// 3d. "FILE OPEN" Redirect URL and/or MESSAGE...
var FIL_KickURL = 'http://www.elitetoplist.com/cgi-bin/topsites.cgi?wslutzz';
var FIL_Message = '<CENTER><H1>Sorry, Access Denied !</H1>'
+ 'You cannot access this webpage offline !';
/* -----------------
STEP 4. IF YOU ARE USING ANY 'FAKE 404' MESSAGES - SET WHICH TYPE TO SHOW...
'apache' -> like used on Apache (most Unix) servers
'nt' -> like used on Microsoft PWS and IIS servers */
var Style_404 = 'apache';
/* -----------------
STEP 5. IF YOU ARE USING ANY 'CUSTOM' MESSAGES - SET UP HOW PAGE WILL LOOK... */
var Page_Color = '#000000';
var Font_Face = 'Arial';
var Font_Color = '#FFFFFF';
var Font_Size = '4';
// ######## END OF MAIN SET UP - LEAVE THE REST ALONE UNLESS YOU UNDERSTAND IT
function DW(it){document.write(it);}
var REF=document.referrer;
var SITE_OK;
var ERRORS_FOUND;
function KickThem(where) {
DW(" ");
if(document.images){top.location.replace(where);}
else{top.location.href=where;}
DW("</HEAD><BODY></BODY></HTML><NOSCRIPT>");
}
function MsgThem(what) {
var TheTitle = 'ACCESS DENIED !';
DW('<TITLE>' +TheTitle+ '');
DW('\n
');
DW('\n');
DW(what);
DW('\n