{"action":"created","issue":{"url":"https://api.github.com/repos/panique/huge/issues/711","labels_url":"https://api.github.com/repos/panique/huge/issues/711/labels{/name}","comments_url":"https://api.github.com/repos/panique/huge/issues/711/comments","events_url":"https://api.github.com/repos/panique/huge/issues/711/events","html_url":"https://github.com/panique/huge/issues/711","id":102663277,"number":711,"title":"[SOLVED!?] Prevent Curl Views without Exit() and with added security backup","user":{"login":"videsignz","id":13843898,"avatar_url":"https://avatars.githubusercontent.com/u/13843898?v=3","gravatar_id":"","url":"https://api.github.com/users/videsignz","html_url":"https://github.com/videsignz","followers_url":"https://api.github.com/users/videsignz/followers","following_url":"https://api.github.com/users/videsignz/following{/other_user}","gists_url":"https://api.github.com/users/videsignz/gists{/gist_id}","starred_url":"https://api.github.com/users/videsignz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/videsignz/subscriptions","organizations_url":"https://api.github.com/users/videsignz/orgs","repos_url":"https://api.github.com/users/videsignz/repos","events_url":"https://api.github.com/users/videsignz/events{/privacy}","received_events_url":"https://api.github.com/users/videsignz/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-08-23T21:37:38Z","updated_at":"2015-11-29T15:11:25Z","closed_at":"2015-11-29T05:25:21Z","body":"Well, it took me all night and today to come up with, what  I believe, is a real sound solution.\r\n\r\n**Auth Class**\r\nWe start by replacing the `exit()` function with the following.\r\n```php\r\n// Initialize a new Session\r\nSession::init();\r\n// Set a session 'Restrict' flag\r\nSession::set('restrict', true);\r\n```\r\nThe `header('location')` function has already been called at this point so the above script would presumably only affect a curl request. Easy enough...\r\n\r\n**View Class**\r\nIn my understanding, it is ultimately the view that we need to protect.\r\n\r\nWe begin by adding a new function called `clean($filename)` (we can name it better later on)\r\nRefer to the comments in this script for an understanding of the function...\r\n```php\r\npublic static function clean($filename)\r\n{\r\n\t// If the restrict flag is set to true\r\n\tif(Session::get('restrict')==true){\r\n\t\t// Change the $filename to another page\r\n\t\t$filename = 'login/index';\r\n\t\t// Destroy the Session as it is no longer needed\r\n\t\tSession::destroy();\r\n\t}\t\r\n\t// Return the $filename to render\r\n\t// restrict=true $filename='login/index';\r\n\t// else $filename=original $filename;\r\n\treturn $filename;\t\t\r\n}\r\n```\r\nFinally, in all of the render functions that will be used to render secured areas you would call this function first and foremost.\r\n```php\r\npublic function render($filename, $data = null)\r\n{\r\n    // Here is the call\r\n    $filename = self::clean($filename);\t\t\r\n\t\t\t\t\r\n    if ($data) {\r\n        foreach ($data as $key => $value) {\r\n            $this->{$key} = $value;\r\n        }\r\n    }\t\r\n    require Config::get('PATH_VIEW') . '_templates/header.php';\r\n    require Config::get('PATH_VIEW') . $filename . '.php';\r\n    require Config::get('PATH_VIEW') . '_templates/footer.php';\r\n }\r\n```\r\nAs you can see, we completely avoid using the `exit()` function and mimic the effect of the original `header(\"location\")` function\r\n\r\nThe beauty of this is that it only gets initiated if the script runs past the header redirect, via curl, or for any other unforeseen reason. Nice backup either way :)\r\n\r\nI have tested this in all ways possible that I know of, but if any of you could break this, please tell me so.\r\n\r\nI would really like to know what you guys think!\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/panique/huge/issues/comments/160421713","html_url":"https://github.com/panique/huge/issues/711#issuecomment-160421713","issue_url":"https://api.github.com/repos/panique/huge/issues/711","id":160421713,"user":{"login":"videsignz","id":13843898,"avatar_url":"https://avatars.githubusercontent.com/u/13843898?v=3","gravatar_id":"","url":"https://api.github.com/users/videsignz","html_url":"https://github.com/videsignz","followers_url":"https://api.github.com/users/videsignz/followers","following_url":"https://api.github.com/users/videsignz/following{/other_user}","gists_url":"https://api.github.com/users/videsignz/gists{/gist_id}","starred_url":"https://api.github.com/users/videsignz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/videsignz/subscriptions","organizations_url":"https://api.github.com/users/videsignz/orgs","repos_url":"https://api.github.com/users/videsignz/repos","events_url":"https://api.github.com/users/videsignz/events{/privacy}","received_events_url":"https://api.github.com/users/videsignz/received_events","type":"User","site_admin":false},"created_at":"2015-11-29T15:11:25Z","updated_at":"2015-11-29T15:11:25Z","body":"Ok, I understand your thinking.... I may post some other suggestions in the future though ;)"}}