Codeigniter - Restricting direct access to controller functions from URL call

Question

I want to know if there is any way through which I can restrict access to my controller functions through URL. But I want to give them a call through my link in the site. For example if I have a link in my site which points to a controller function:

<a href='test/function'>Call me</a>

But I don't want the controller function to be called when I place the above URL in my browser address bar. Can anyone help with this?

I didn't get you. I want the function to be called when I click "Call me" link. But when I paste the url "mysite/test/function" in my address bar, I don't want the function to be called. — Sanks
– Sanks, Commented Jan 19, 2013 at 13:25
What's the purpose? Are you loading some content via AJAX or something? Then I would recommend using something like a key which you can attach to a data-attribute. — Marcus Olsson
– Marcus Olsson, Commented Jan 19, 2013 at 13:27
@Marcus: Yes, I am loading via AJAX. What do you mean by a key and attribute attached? — Sanks
– Sanks, Commented Jan 19, 2013 at 13:29
If you use Ajax, hide the href of this a and set the URL in the js code. — Hieu Le
– Hieu Le, Commented Jan 19, 2013 at 14:11

hohner · Accepted Answer · 2013-01-19 13:41:52Z

3

This is not possible. Apache and, consequently CodeIgniter, is allowing access to your PHP script to the outside world whether through a manually entered browser URL or through a visited hyperlink. Both scenarios connect to your web application in the exact same way, but they just get there differently.

You can allow access to only your CodeIgniter scripts (i.e. prevent public users from accessing a controller) by using:

if ( ! defined('BASEPATH')) exit('No direct script access allowed');

As Marcus has pointed out, you could use something like:

if (!$_SERVER['HTTP_REFERER']) $this->redirect('/home');

But it's often very inconsistent.

edited Jan 19, 2013 at 13:41

answered Jan 19, 2013 at 13:30

hohner

11.6k8 gold badges51 silver badges85 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mario Santini · Accepted Answer · 2016-11-10 12:45:25Z

2

Solution: put this code at the beginning of every controller method

if (defined('BASEPATH') && !$this->input->is_ajax_request()) 
    exit('No direct script access allowed');

edited Nov 10, 2016 at 12:45

Mario Santini

3,0112 gold badges22 silver badges30 bronze badges

answered Nov 10, 2016 at 10:57

Mujeeb

211 bronze badge

1 Comment

Marcelo Agimóvel Over a year ago

Nice, but user can still alter the ajax request and do a mess if that function works globally. For example a global function to update, wich receive the name of table and other parameters that can be easily changed trough google developer tools. Did I got to far?

Marcus Olsson · Accepted Answer · 2013-01-19 13:39:39Z

0

As you stated in the comment, that if you want to load the link via AJAX:

Your markup:

<a href="test/function" data-key="abc">

Your jquery:

$('a').on('click',function(){
    var data = $(this).data('key');
    $('#result').load($(this).attr("href") + '?key=' + data);
});

Then in you CodeIgniter controller, you check to see if your key is present and matches ("abc"), else you return a 403 or something simillar.

Also, you could of course check the $_SERVER['HTTP_REFERER'] to see where the user came from (this is however quite easily spoofed) and only allow access when the GET-request is made from your own site.

answered Jan 19, 2013 at 13:39

Marcus Olsson

2,52719 silver badges37 bronze badges

Comments

Richard Merchant · Accepted Answer · 2013-12-20 17:16:12Z

0

This really helped. I also added this as an added check

$allowed_host = gethostname();
$host = parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST);
if(substr($host, 0 - strlen($allowed_host)) != $allowed_host)
  $this->redirect('/home');`

answered Dec 20, 2013 at 17:16

Richard Merchant

1,00313 silver badges10 bronze badges

Comments

Nilesh T. Kashid · Accepted Answer · 2016-11-23 04:50:04Z

0

 In view: `<input type="hidden" value="1" name="back">`

 put inside your function in Controller: 


if(($this->input->post('back'))==1)
              {
                echo " what you want do here";
              }
              else
              {
                 $this->load->view('template',array('welcome_page')) ;
              }

form validation you will put inside this if condition..This will definitely work..

answered Nov 23, 2016 at 4:50

Nilesh T. Kashid

151 silver badge8 bronze badges

Collectives™ on Stack Overflow

Codeigniter - Restricting direct access to controller functions from URL call

5 Answers 5

Comments

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related