Hidding Script Name from Weblogs

[Frank_Rizzo]

Is it possible to hide the referring URL / script page when linking through to other sites?

I have an admin page which lists potential link partners. If I click the partners links (to peruse their sites) the admin url is being recorded in the partners access log file. This is a security risk as they now know the admin page!

admin.php generates a list of links:

www.newpartner4widgets.com

If I click that link their site will record me as coming from

www.mysite.com/linksadmin/admin.php

The security problem is that newpartner4widgets.com can see this link, paste it into their browser and access the admin.php page!

Is it possible to just make it look as if www.mysite.com visited and not send the other stuff?

Please note this is not my script but a free links script available for download - Grrrr! I have mailed the support for the links software but I'd really like to fix this asap by not leaking out the admin page.

[jatar_k]

use a linking script or you could cut and paste them, maybe open in a new window

password protect the admin page might be a thought as well

use .htaccess

[Nutter]

Is your admin page password protected? If it is, and it's a good password, it may not be worth worrying about. My other thought is that if it's a publicly available script, a bunch of people probably already know what path to the admin page is.

You could also right click on the link, copy, and paste it in to the address box. But, you'd lose the referrer to your site completely.

- Ryan

[Frank_Rizzo]

The admin page does have password protection. However, if you just bookmark the admin page, or click it from a link you go straight in.

Really annoyed with this. I usualluy follow strict rules with stuff like this. Yes, now I have .htaccessed the dir but you'd think the vendors would realise these pitfalls by now.

I tell you what else I do. I always rename the scripts to something obscure - both the script name and the dir. But when weblogs are recording the referring script, path, and webserver what's the point!

Surely there must be a way of cloaking where a link is coming from?

[jezra]

I haven't tested this, so I no idea if it will work. What if you made a redirect script that your admin pages links to? If the admin page passed the URI of the page you want to visit to the redirect script as a GET, the redirect could be as follows:
<?
$URI=$_GET['URI'];
header("Referer: [example.com");...]
header("Location: $URI");
exit;
?>
In theory, this should spoof the referer to be [example.com...]
Anyone care to test this?
jez