ERROR - Invalid Referrer

[rbspro]

Having problems with a script running windows xp with two user accounts script works fine on one user but on the other I'm getting a ERROR - Invalid Referrer.

can anyone help as script works fine on the other users side (sends email to them and also to me)

the scripts at http://www.willettsbutchers.co.uk/contactus/contactus.htm

[tlm]

Post some code.

[rbspro]

script is at http://www.willettsbutchers.co.uk/contactus/contactus.htm

[jhourcle]

suggestions for posting are at http://www.perlmonks.org/index.pl?node=How%20%28not%29%20to%20ask%20a%20question

Update: The link is How (Not) To Ask A Question. I was trying to duplicate the format of the message I'm replying to, at my bad attempt at humor.

[jZed]

In the first place, it's rude to expect us to go clicking links to find out what you're talking about. In the second place, when future monks visit this node, they won't know what the node is about because that link will either no longer be there, or presumbably be fixed. And in the third place, that link goes to an HTML page, it doesn't give us the slightest idea about any perl code. The only way we can help you with your perl code is for you to show us your perl code (or a trimmed down sample), not for you to show us the HTML page that submits a form to the perl script.

[TedPride]

The important part is here:

@valid_ref = ('http://www.willettsbutchers.co.uk') ;
foreach $ref (@valid_ref) {
if ($ENV{'HTTP_REFERER'} =~ m/$ref/i) {$is_valid = 1 ; last ;}
}
if (! $is_valid) {
print "Content-type: text/html\n\nERROR - Invalid Referrer\n" ;
exit 0 ;
}

Either the page you're accessing the script from is not at http://www.willettsbutchers.co.uk, or the server is not giving you a HTTP_REFERER variable.

Incidently, whoever wrote that script has to be one of the most inefficient coders ever. I wrote prettier code before I started coming to Perlmonks, and that's saying a lot.

[fauria]

I think this question has been already answered, but as a general tip, youd better use other mechanisms rather than rely on HTTP_REFERER for identifying or validating the source of anything, as it can be overwritten easily with tools like curl or something else.

HTTP headers are ok for statistical info, such as where people comes from to our site through what links, but are a little bit risky if you base part of your security or integrity on them.