0

I have three pages:

index.html
getjavascript.php?id=index
index.js

index.html includes the script 

'getjavascript.php?id=index'

and getjavascript dynamically gets the script index.js.

Is there any way to prevent external users from directly accessing 

getjavascript.php

using PHP?

index.js is in a hidden location.

Thanks,

Improve this question
2
  • 1
    You should really clarify how each file is being "included" because it sounds like index.html has no SSI or anything thus there is no way to do what you want - but you should clarify your scenario more. Commented Apr 21, 2012 at 5:09
  • You hide a file only to have its contents exposed by another file? Commented Apr 21, 2012 at 6:06

4 Answers 4

Reset to default
2

I'm assuming that index.html contains an include similar to the snippet below (assumption is that we're doing a client-side pull of this javascript).

<script type="text/JavaScript" src="getjavascript.php?id=index" />

If your intent is to hide secrets within the javascript file, there is no way of stopping a user from retrieving the contents. They can trivially use developer tools to view the contents. Furthermore, because the browser needs to download the file, there's not really a way to distinguish between a user accessing directly versus a browser retrieving this file.

If your intent is to obfuscate the fact that your server is using PHP, you can use mod_rewrite to remove the extension.

Server side includes are a different story and modifications to .htaccess or moving this file outside of your webroot directory would work.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Hi, i'm more trying to hide the source of the index.js. What i was thinking was a if($_SERVER[webpage] == 'getjavascript.php'){ exit(); }else{ echo $file; } ?>
0

It's possible by using htaccess.

Redirect /getjavascript.php http://example.com/newdirectory/

Improve this answer

1 Comment

This won't work since the browser needs to make requests to getjavascript.php?id=index and will fail.
0

Now I see two ways to solve your problem

  1. Using Apache RewriteRule directive. This way will allow you to hide real URL name in your html file
  2. Try to use additional parameter in getjavascript.php that detect that if this url called directly from browser (not from html form or link).
Improve this answer

Comments

-1

Put the include script outside of the document root. For example, if you have your root in public_html, create a folder outside public_html to put your included files in. That way, your script can read them but random people on the internet can't.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.