restrict access to the server containing my manialink ?

[jonasredant]

Hi, I'm creating a Manialink for Trackmania United Forever. I know this forum is for Trackmania 2,
but for the older games there aren't many people creating manialinks anymore or visiting that section
of the forum and I'm pretty desperate...

I'm currently adding horns to my manialink.
I have the following problem:

When someone downloads a horn a *.loc (locator file) is installed together with the horn automatically.
This file contains the url of the horn that person just downloaded. If someone pastes that url in a
webbrowser he could download all my horns for free from the server that hosts my manialink files...
So, basically it comes down to this: all files on the server should be accessed ONLY by me and the ingame browser or whatever system downloads the horn.

Sure could use some help here...

[steeffeen]

simply impossible
you could filter the user-agent that is allowed to download the file but that can easily be faked by the web browser
and even if you manage to prevent other clients than ManiaPlanet itself to download the files that wouldn't help either
because if people manage to find the locators, they can find the files themselves as well because they are also downloaded and saved in the cache folder
so there isn't even the need to download them from your server by hand

[jonasredant]

what do you mean with " that can easily be faked by the web browser"?
I'm totally new to this kind of stuff...
But the only thing I want to accomplish here is that browsers can't access the files.
I googled a bit, but this is going over my head here.
I found things like: BrowserMatch ^Mozilla netscape on http://httpd.apache.org/docs/2.2/mod/mo ... owsermatch
and modifying a .htaccess file but I don't understand the syntax used.
What I'm trying to accomplish is that people pasting for eg http://webserver/horns/music/Tsunami.ogg in their browser can't download the file but have to use coppers in the game. I didn't even know about the cache folder,
so I'm assuming that many others don't know either, but they could be inventive enough to use the loc file.

[steeffeen]

pretty much every web browsers allows you to change the user-agent that is sent to the web server so that's not a real security measure
here's a picture of Safari on my Mac

though it might help to restrict the access by user-agent
after all i'm doing the same ^.^

your .htaccess has to look kind of like that:

Code: Select all

SetEnvIf User-Agent .*ManiaPlanet* maniaplanet
Order Allow,Deny
Allow from env=maniaplanet

(1st line declares a user-agent filter "maniaplanet"
2nd line denies access for everybody
3rd line allows access for all matching the filter "maniaplanet")

[Akbalder]

You maybe just want to prevent a web browser from listing every files available on your web server.
You can dot this by putting a .htaccess file in your horns directory with the text :

Code: Select all

IndexIgnore *

[jonasredant]

Ok, I've been messing around for hours now. Doesn't work.

the server with my horns is 000webhost.com
Server Name server44.000webhost.com
IP Address 31.170.160.108
Apache ver. 2.2.19 (Unix)
PHP version 5.2.*
MySQL ver. 5.1

I used this code to test to exclude firefox:

SetEnvIf User-Agent .*irefox* testje
Order Deny,Allow
Deny from env=testje

This excluded Firefox from downloading the files, Internet explorer still worked and I could
open the manialink in Trackmania, so I thought OK, it's evolving in the right direction...

Then I tried this

SetEnvIf User-Agent .*irefox* testje
SetEnvIf User-Agent .*xplorer* testje2
Order Deny,Allow
Deny from env=testje
Deny from env=testje2

to exclude both Internet explorer and firefox: doesn't work anymore?
even this doesn't block Internet explorer:

SetEnvIf User-Agent .*xplorer* testje
Order Deny,Allow
Deny from env=testje

Problem is that I don't know what I'm doing, I just am searching a way to solve my problem. Before today i didn't even know what a .htaccess file was. Also I forgot about all I knew about regular expressions.

in the .htaccess file there are these lines:
# Do not remove this line, otherwise mod_rewrite rules will stop working
RewriteBase /

should I paste the code above or beneath those lines (do newlines count?)
I don't know whether all this code is case sensitive, if .*irefox* has to be specified as ".*irefox*",
whether newlines count.

Also I'm using Trackmania United Forever, so is the user-agent ManiaPlanet also?

[jonasredant]

@Akbalder

IndexIgnore * prevents the browser from listing the files, but if you have the url
already you can still paste it and download the file

[steeffeen]

hm yeah it won't be ManiaPlanet then, i think it's something like "Gamebox"?

why don't just only allow the correct ones instead of disallowing incorrect ones?
that doesn't make any sense bro since there are X different user-agents

and yes the stuff is case sensitive

you can paste your code above the default lines but below would also be alright (if it's really only this line you've posted)

[jonasredant]

Well, I wanted to test out the code a bit. And I didn't knew the user-agent for TMUF so I tried blocking a few browsers.

Do you know what's wrong with this code?

SetEnvIf User-Agent .*irefox* testje
SetEnvIf User-Agent .*xplorer* testje2
Order Deny,Allow
Deny from env=testje
Deny from env=testje2

to exclude both Internet explorer and firefox: doesn't work anymore?
even this doesn't block Internet explorer:

SetEnvIf User-Agent .*xplorer* testje
Order Deny,Allow
Deny from env=testje

[jonasredant]

I tried this:

Code: Select all

SetEnvIf User-Agent .*Gamebox* test
Order Allow,Deny
Allow from env=test
# Do not remove this line, otherwise mod_rewrite rules will stop working
RewriteBase /

isn't working