Limiting inbound links to approved referers?

How can I make a page viewable only via an approved affiliate link?

[nigelvibations]

Hi,

My apologies if this has been asked and answered before - I've been scouring the net all afternoon and come up blank.

Here's my situation: I host online "MySite Alliance" membership certificates at www.example.com. I want to give each of my Alliance members a little icon they can put on www.example.com, like a Verisign Secure pop-up link, that launches a small certificate pop-up window hosted at www.example.com.

However, I *only* want this certificate to be viewable via the link at www.example.com. If someone types the URL into their address bar, or links to it from another site, I don't want it to work. Wei Shi's "Anti Leech File Gate" looked promising, but I couldn't get it to install properly and am now stuck.

I feel like this should be a pretty easy thing to do, either with PHP or .htaccess, I just don't know how to do it and lack the proper vocabulary to Google my way to an answer, so any help would be massively appreciated. And if it makes you feel any better, this is ultimately for a sustainable energy/forestry project, so you'd technically be saving the rainforest.

Thanks,
Nigel

[edited by: dreamcatcher at 9:05 am (utc) on April 19, 2007]
[edit reason] Use example.com, thanks. [/edit]

[capulet_x]

Nigel,

Could you supply www.example.com with a script to set a cookie that is only valid on their sites:

[us2.php.net...]

Or since you are going to supply www.example.com with an icon any way will they allow it to be an icon/flashmovie? I know this is kind've out of place in a PHP forum but I think you can set a cookie from a flash movie using PHP or javascript in an ActionScript function like:

//script for flash...

lv=_root.loadVarObject;
lv.cookieName=_root.cookieName; // assign variables that you want to
// be sent to the script
lv.randomizer=Math.floor(Math.random()*10000); // prevent caching
lv.sendAndLoad("getCookie.php", _root, "POST");// send back data to root

//script in PHP file...

<?php
eval("\$cookieValue=\$$cookieName;");
$urlEncodedCookieValue=urlencode($cookieValue);
echo("cookieValue=$urlEncodedCookieValue");
?>

If www.example.com allows this they must put the flash swf file and the php script in the same directory.

You can check for the cookie before allowing the popup or have the popup redirect elsewhere if the cookie is not present...or both.

Without the flash file / icon there is no cookie.

[edited by: dreamcatcher at 9:04 am (utc) on April 19, 2007]
[edit reason] Use example.com, thanks. [/edit]

[nigelvibations]

Thanks for your help. I wound up figuring it out by putting the following in my certificate directory's .htaccess, where example.com = my site, and example2.com = affiliate site:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} ^http://www\.example2\.com/$ 
RewriteCond %{REQUEST_URI}!^http://www\.example\.com/certificate/asdfjkl\.html 
RewriteRule .* asdfjkl.html 

This way, links from example2.com look like like this:

http://www.example.com/certificate

But actually load this:

http://www.example.com/certificate/asdfjkl.html

And typing or linking to www.example.com/certificate from any location not specifically listed in .htaccess loads the default index.html file.

So no PHP after all, but thank God for mod_rewrite.

Cheers,
Nigel