Have been using Protector for a while, and would like to see it "trap" any HTTP request, that is obviously trying to parse a script from a remote site. These do not always result in a 403 or a 404 either, depending upon server security and configuration.

The type of requests are of the format:

Quote:

(domain name of remote url changed in the above, for obvious reasons).

returns a 302, and often other attempts at remote script parsing, return a 200, so XOOPS thinks that "all is well", despite the fact that Protector is installed.

I don't think the 'blanket approach' of setting "allow_url_fopen" value to off is suitable for all sites. Turning this option off is recommended when using Protector, however server setup/config., and especially PHP version, has a bearing on whether or not this setting should really be off.

See these discussions:

http://foundationphp.com/phpsolutions/updates.php
http://www.webmasterworld.com/forum88/10940.htm

Determining if the string 'http' was being parsed, could be something like ..



As the version of PHP has some bearing on the need to have the setting "allow_url_fopen" value to off, the PHP function phpversion() could be utilised.

My 0.001 cents worth anyway.

I doubt that GiJoe, the module's author, will see this.

Might be best posting this on his own site's Forums:
http://xoops.peak.ne.jp/

Thanks, I have PM'd the author of the Protector documentation, who seems to be a regular poster on the Peak website.