We are having a continuing problem with script kiddies exploiting
holes in PHPnuke 6.0. They are often able to pass variables to the
admin.php file. I'd like add another line of security by using
.htaccess to block "hotlinking" of admin.php. That is, all requests to
"admin.php?op=" must be referred from within our domain name. I
understand there would be many ways to defeat this (that is, the
browser itself might be able to spoof the referrer code), but it
appears our ?hackers? are usually script kiddies looking to exploit
the largest number of sites in the least amount of time

My own attempt at writing the .htaccess code is as follows, but it
isn't working (as I have very little programming background), however
it may help communicate what I?d like to do:

RewriteCond %{HTTP_REFERER} !^http://www.example.com/.*$ [NC]
RewriteRule admin.php?op=$ - [F]
#ReWriteRule admin.php?op=.*\.php$ http://www.example.com/error.htm [R,L]

---

Clarification of Question by alakon2-ga on 28 Apr 2004 07:03 PDT

In response to Gourav Jain's comment, we have a large number of
editors who need to access the system. It would be difficult to
impliment as they frequently access the site from different locations.

Hi,
You can deny the requests from other IP/Domain by putting the
following lines in your .htaccess file.

order allow,deny
allow from <Your IP/Domain>
deny from all

for more detail on the .htaccess you can refer on the following URL

http://wsabstract.com/howto/htaccess.shtml

Gourav Jain

Put this in the folder where admin.php resides:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://.*YOURWEBSITEHERE.com.*$      [NC]
RewriteRule .*\.(php)$ http://YOURWEBSITEHERE.com [R,NC]

Make sure this is specifically in the folder that contains admin.php
only! You don't want it anywhere else because you obviously still want
people to link to the rest of your website.

For added security, you can create a simple HTML page with only a link
to your admin page, and put it in a random folder. Make sure to change
"http://.*YOURWEBSITEHERE.com.*" to
"http://.*YOURWEBSITEHERE.com/FOLDERHERE" or else it won't matter
where you put that secret file. This will make it so you can only that
one file can access it.

At least, this should theoratically work.