Use PHP to determine what code is shown in "View Source" ...

OTrap

OTrap

Elite Member
Joined
Jul 12, 2008
Messages
2,314
Reaction score
1,064
I currently have a setup for page2.php that looks something like this:

Code: 
 <?
$referer = $_SERVER['HTTP_REFERER'];

if ( top != self && $referer == "http://www.website.com/randompage.html") {

    echo "Page 1";
    echo "$referer";

} else {
    echo "Page 2";
    echo "$referer";
}

?>

My understanding is that this means that unless a page is framed by http://www.website.com/randompage.html, it will show "Page 2."

However, it appears that if you use Chrome, and you go to http://www.website.com/randompage.html, find the source code, and find the framed page, and then they go to "view-source: http://www.website.com/page2.php," it will still show the "Page 1" source code.

Is there any way to side-step that?

Thanks.
 
Last edited:
Advertise on BHW
No it should not show both pages. PHP runs server side and based on the above code it will echo out only one of the two pages and not both.
 
My apologies. I didn't explain myself well.

My attempt above was to prevent people from being able to view the "Page 1" source code, and instead only showing them the "Page 2" source code.

However, it appears that if they visit the parent framing page first, they can view the "Page 1" source code by typing "view-source: http://www.website.com/page2.php" in Chrome.

I was curious if there was any way around this. Would preventing the cache or something of that sort do it?
 
Sure you can view-source:anywebpage.php you want. I think what I'm not understanding here is HOW would they know what page to view-source of?

Can you PM an example of what you are doing?
 
Last edited:
I'm going to try to mention this differently.

I have a page: index.php. It looks, more or less, like this:

Code: 
<html>
<head>
<title>Some page</title>
</head>
<body>
    <div>
        <iframe src="frame.php"></iframe>
    </div>
</body>
</html>

Now, on that "frame.php" page, I have this:

Code: 
<?
$referer = $_SERVER['HTTP_REFERER'];

if ( top != self && $referer == "index.php") { ?>

<html>
<head>
<title>Framed content</title>
</head>
<body>
    <div>
        Eat me.
    </div>
</body>
</html>

<? } else {
    echo "Don't eat me.";
    echo "$referer";
}

?>

What seems to happen is this: If someone first goes to the index.php page, and then they type this into the address bar:

view-source:http://mydomain.com/frame.php

They get this:

Code: 
<html>
<head>
<title>Framed content</title>
</head>
<body>
    <div>
        Eat me.
    </div>
</body>
</html>


But if they don't first go to index.php, then they get:

Code: 
1 Don't eat me


Is there any way to make it so that they get the latter any time they use the "view-source" feature on frame.php?
 
Dont you think everyone would hide his source code this way? :-)

You cant! All you can do is: Encrypt your source code.
 
I actually found a handy little workaround that hides it. Naturally, the debugging tool would still allow anyone to see the full source code, but I actually got it to work the way I wanted it to otherwise.
 
OTrap said:
I actually found a handy little workaround that hides it. Naturally, the debugging tool would still allow anyone to see the full source code, but I actually got it to work the way I wanted it to otherwise.
Click to expand...

Would you mind sharing it? I am trying to make something like it :)
 
Sure!

I'm out and about, but when I get home, I'll spell out what I'm doing. The page itself is this:

http://earnlike.us/

The gist of what I did was force another page to load the video page with the error in a small frame after the video has already loaded in the current page. So what is displayed on the current page will not show up if you actually go to the framed page.

It's a bit of a mess, so be warned. It's the sum total of my efforts, so it could probably be streamlined, but I'm not messing with it, since it seems to work apart from the debugging tool.
 
I am pretty sure that if you set the right permissions to your files, they won't be able to see the source code. Set the permissions of the php files that you don't want people to see the source code, just to execute only.
 
you mix php and js?
Code: 
top != self
this part is should be a js, you cannot detect if your page is iframed via php, you need to do it client-side using js
 
Last edited:
Ah, so the top != self part doesn't do anything, since it's not in js?

And thanks. I learned from one of the best.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top