HTTP_REFERER problems from SSI

shows as reffering link on one host, as document on another

[theperlyking]

I have a tracking script I've just installed on a new host for a new domain, on the old host the tracker is embedded in the page via SSI - i.e

<!--#exec cgi="/cgi-bin/prog.pl" -->

and shows the HTTP_REFERER as whatever link the user clicked on , i.e they went from page1.shtml to page2.shtml the tracker shows a hit for page1 then a hit for page2 with the referrer being page1.

My problem is on the new host the same script shows a hit for page1, then the hit for page2 - but the referrer shows as page2.shtml itself! Its almost as if the perl script is saying its own referrer is page2.shtml because that is where it was called from...

Can anyone help?

[littleman]

What OS/server is it Perly?

[Brett_Tabke]

First, use "virtual" instead of exec - it is much much safer. Exec just blindly executes the script, whereas virtual determines what to do with the file based upon it's content - thus, it will only launch things that are allowed. There are some exploits for exec based ssi. Example:

<!--#include virtual="/cgi-bin/counter.cgi"-->
or
<!--#include virtual="foo.htm"-->

Anyway, what I would do, is dump the server environ variables to a file and see what it is kicking out. Could be the new host has a different setup. At the top of your script add:

open FILE ">>env-log.txt";
foreach $key (sort keys %ENV) {
print FILE "key: $key value: $ENV{$key}\n";
}
print FILE "--------\n";
close (FILE);

Then call a page with your ssi on it once to generate the log file a few times and look at what is being passed to scripts. Some boxes have server script wrappers that manipulate the variables before passing them to a script process. I've been on hosts where all the environment variables started with "WRAPPER_" etc.

An HTTP_Referer comes from the browser, so that should be independent of anything your script is doing. If the browser sent a referrer, it should be in the variables.

[theperlyking]

Both are apache/linux.

If I put <!--#echo var="HTTP_REFERER" --> in the page it also reports itself (i.e embedded in page1.html it prints page1.html..).
:(

[theperlyking]

EDIT:
:( sorry guys for wasting your time, silly error on my part - nothing to do with the server at all, brett saying about the browser supplying the referrer reminded me!

D'oh!

Edited by: theperlyking

[littleman]

Also try using this script.
[cgi-fun.hypermart.net...]
Just to make sure your browser isn't doing anything funky.

[Brett_Tabke]

Do it all the time Perlyking. Many times, just typing out the problem is enough to solve it.