Re: Change URL location on CURL requests?

Alessandra <[email protected]>
Newsgroups gmane.comp.web.curl.php
Message-ID <[email protected]> 
Hi Shan Shui,

I tested CURLOPT_REFERER with value https://domain1/page.html and
https://domain1/ but browser did not return thank you page.
original form is https://network.leadhouse.net/affiliate_signup.html
my form is https://www.leadhouse.net/horizonadv.php/affiliate-signup
my script is in attachment.

I hope that you could help me.
Thank you.
Alessandra.


On Mon, Mar 15, 2010 at 7:45 PM, Shanshui Liu <[email protected]> wrote:
> Hi Alessandra,
> Try setting the CURLOPT_REFERER option to the form URL. Some form handler
> check for this value believing that it would prevent form spoofing (and it
> clearly doesn't). If that doesn't work, then I guess you'll have to show us
> the forms in question so that we can help you further.
> With regards,
> Liu Shan Shui
> http://lx.sg/
> "Life would be much easier if I had the source code." - Anonymous
>
>
> On Mon, Mar 15, 2010 at 8:57 PM, Alessandra <[email protected]>
> wrote:
>>
>> Hi all,
>> I read more forum and tutorial about curl post and changing URL
>> location.. but I think that something escapes me..
>> I have got a form (https://domain1/page.html) that I would like:
>> * mask it with my form (https://domain2/page.html)
>> * post all fields into original form (https://domain1/page.html)
>> * return thank you page about original form
>> (https://domain1/page.html) when I submitted with my form
>> (https://domain2/page.html)
>>
>> https://domain1/page.html has got a form tag:
>> <form method="post" id='signup' onsubmit="return validate_form();">
>> function javascript returns true.
>> if I filled in all fields and I submitted it, browser returns thank
>> you page into same url page: https://domain1/page.html
>>
>> I create my form into https://domain2/page.html
>> that recall https://domain2/my.php that post fields by this code:
>>
>> [code]
>>  ..
>>  $url = "https://domain1/page.html";
>>  $user_agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
>>  $ch = curl_init();
>>  curl_setopt($ch, CURLOPT_URL, $url);
>>  curl_setopt($ch, CURLOPT_POST, count($postdata));
>>  curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
>>  curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
>>  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
>>  $result = curl_exec($ch);
>>  ..
>> [/code]
>>
>> if I filled in all fields about my form (https://domain2/page.html)
>> and I submitted it, browser returns original form page
>> (https://domain1/page.html) with all fields filled and not thank you
>> page.
>> I tested more curl lib options adding each option at a time:
>>
>> [code]
>>  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
>>  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
>>  curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30);
>>  curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
>>  curl_setopt($ch, CURLOPT_FAILONERROR, 0);
>>  curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
>> [/code]
>>
>> I checked safe and basedir options, curl lib errors and url info:
>>
>> [code]
>>  .. previous code..
>>
>>  if(!ini_get('safe_mode') && !ini_get("open_basedir")) {
>>   echo "n safe, n basedir: CURLOPT_FOLLOWLOCATION, true";
>>  } elseif(!ini_get("open_basedir")) {
>>   echo "y safe, n basedir";
>>  } elseif(!ini_get('safe_mode')) {
>>   echo "n safe, y basedir";
>>  } else {
>>   echo "y safe, y basedir";
>>  }
>>
>>  $error_no = curl_errno($ch);
>>  $error_wd = curl_error($ch);
>>  $url_info = curl_getinfo($ch);
>>
>>  $result = curl_exec($ch);
>>  curl_close($ch);
>>  $strg = "";
>>
>>  foreach ($url_info as $k => $v) {
>>   $strg .= "$k = $v; ";
>>  }
>>
>>  if ($error_no == 0) {
>>   $error = '<br/>File uploaded succesfully
>> ('.$error_wd.'['.$error_no.']): '.$strg.'.';
>>  } else {
>>   $error = '<br/>File upload error ('.$error_wd.'['.$error_no.']):
>> '.$strg.'.';
>>  }
>>
>>  echo $error;
>> [/code]
>>
>> And I obtainted that:
>> * php runs with safe_mode and open_basedir ON
>> * posting by curl lib has got error:
>> File uploaded succesfully ([0]): url = https://domain1/page.html;
>> content_type = text/html; http_code = 200; header_size = 393;
>> request_size = 175; filetime = -1; ssl_verify_result = 0;
>> redirect_count = 0; total_time = 1.60061; namelookup_time = 0.002403;
>> connect_time = 0.143216; pretransfer_time = 0.438166; size_upload =
>> 4552; size_download = 51836; speed_download = 32385; speed_upload =
>> 2843; download_content_length = 0; upload_content_length = 4552;
>> starttransfer_time = 0.589802; redirect_time = 0; .1
>>
>> I don't understand where/what I must to do because browser returns me
>> thank you page: https://domain1/page.html
>> can you help me about?
>>
>> Alessandra.
>> _______________________________________________
>> http://cool.haxx.se/cgi-bin/mailman/listinfo/curl-and-php
>
>
> _______________________________________________
> http://cool.haxx.se/cgi-bin/mailman/listinfo/curl-and-php
>
>



-- 
 Alessandra Bilardi, Ph. D.
----
 CRIBI, University of Padova, Italy
 Via Ugo Bassi, 58/B - 35121 Padova
 Tel +390498276165 Fax +390498276159
  http://www.linkedin.com/in/bilardi
----
La semplicità è la più alta forma di perfezione (Leonardo Da Vinci)
Keep simple, stupid (KISS, IT)
----

_______________________________________________
http://cool.haxx.se/cgi-bin/mailman/listinfo/curl-and-php
affiliate_signup.php (application/octet-stream, 4.4 KB) 
<?php

/*
  echo "<h2>get_pair</h2>\n";
  foreach ($_GET as $k => $v) {echo "<p>".$k." = ".$v."</p>\n";}
*/
  echo "<h2>post_pair</h2>\n";
  foreach ($_POST as $k => $v) {echo "<p>".$k." = ".$v."</p>\n";}
/**/

  $lh_field = array();
  $postdata = array();
  $check = 0;

  foreach ($_POST as $k => $v) {

   if (preg_match("/^custom_/",$k)) {
    foreach ($v AS $key => $val) {
     $custom = $k."[".$key."]";
     echo "custom ".$k."[".$key."]=" . urlencode($val);
     $postdata[$custom] = $val;
    }
   } elseif (preg_match("/^sitethemes/",$k) || preg_match("/^bdage/",$k) || preg_match("/^sitesupports/",$k) || preg_match("/^listeban/",$k)) {
    $lh_field[$k] = $v;
   } elseif (preg_match("/^lh_/",$k)) {
    $key = preg_replace("/^lh_/","",$k);
    $lh_field[$key] = $v;
   } elseif (preg_match("/^ck_/",$k)) {
    $key = preg_replace("/^ck_/","",$k);
    if (preg_match("/date/",$k) && !$v) {
     $check++;
    }
   } else {
//    if (preg_match("/agree_terms/",$k)) {$v = $v == 0 ? 'Off' : 'On';}
//    if (preg_match("/agree_terms/",$k)) {$v = $v == 0 ? 'Off' : 'checked';}
//    if (preg_match("/agree_terms/",$k)) {$v = $v == 0 ? 'Off' : 'True';}
    $postdata[$k] = $v;
    if (preg_match("/signature/",$k)) {
     $reg = "/".$_POST['first_name']." ".$_POST['last_name']."/";
     if (preg_match($reg,$v)) {
      $check++;
     }
    }
    if (preg_match("/^email/",$k) && preg_match("/^[^@$§]+@[^@$§.]+.[^0-9@$§.][^0-9@$§.][^0-9@$§.]/",$v) && $v == $_POST['re_email']) {
     $check++; 
    }
    if (preg_match("/^password/",$k) && $v == $_POST['re_password']) {
     $check++;
    }
   }
  }

  if ($check == 3) {

   echo "<h2>into platform</h2>\n";
   foreach ($postdata as $k => $v) {echo "<p>".$k." = ".$v."</p>\n";}
   echo "<h2>into leadhouse</h2>\n";
   foreach ($lh_field as $k => $v) {echo "<p>".$k." = ".$v."</p>\n";}
   $req = "";
   foreach ($postdata AS $key => $val) {
    if (is_array($val)) {
     foreach ($val AS $k => $v) {
      $req .= "&".$key."[".$k."]=" . urlencode($v);
     }
    } else {
     $req .= "&$key=" . urlencode($val);
     if (preg_match("/site1$/",$key)) {
      for ($i=2;$i<=109;$i++) {
       $req .= "&website".$i."=" . urlencode($val);        	   
      }
     }
    }
   }
   $req = substr($req,1);      //remove initial '&'

   echo $req;

   $domain = "https://network.leadhouse.net/";
   $url = "https://network.leadhouse.net/affiliate_signup.html";
   $user_agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"; 

   $ch = curl_init();

   curl_setopt($ch, CURLOPT_URL, $url);
   curl_setopt($ch, CURLOPT_POST, count($postdata));
   curl_setopt($ch, CURLOPT_POSTFIELDS, $req);

   curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
   curl_setopt($ch, CURLOPT_REFERER, $domain);
/*
   curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
   curl_setopt($ch, CURLOPT_HEADER, 0);
   curl_setopt($ch, CURLOPT_RETURNTRANSFER, 0);
   curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
   curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); 
   curl_setopt($ch, CURLOPT_AUTOREFERER, 1);
   curl_setopt($ch, CURLOPT_FAILONERROR, 0);
   curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);
*/

   echo "<pre>";
   print_r(curl_getinfo($ch,CURLINFO_EFFECTIVE_URL));
   echo "</pre>";
   if(!ini_get('safe_mode') && !ini_get("open_basedir")) {
    echo "no safe, no basedir: CURLOPT_FOLLOWLOCATION, true";
   } elseif(!ini_get("open_basedir")) {
    echo "y safe, no basedir";
   } elseif(!ini_get('safe_mode')) {
    echo "no safe, y basedir";
   } else {
    echo "y safe, y basedir";
   }

   $result = curl_exec($ch);

/**/
   $error_no = curl_errno($ch);
   $error_wd = curl_error($ch);
   $url_info = curl_getinfo($ch);
/**/
/**/
   $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); 
   if ($http_code == 301 || $http_code == 302) {
    $pag = $root."edit_template_content.html?curr_trans_edit=".$_POST['curr_trans_edit']."&sel_edit_content_name=".$_POST['sel_edit_content_name'];
    $result = get_formdata($pag);
   }
/**/
 
   curl_close($ch);

/**/  
   $strg = "";

   foreach ($url_info as $k => $v) $strg .= "$k = $v; ";
   if ($error_no == 0) {
    $error = '<br/>File uploaded succesfully ('.$error_wd.'['.$error_no.']): '.$strg.'.';
   } else {
    $error = '<br/>File upload error ('.$error_wd.'['.$error_no.']): '.$strg.'.';
   }
   echo $error;
/**/

   echo $result;

  } else {
   echo "pagina di riepilogo e link a conferma o indietro per modificare cos&igrave; uno controlla i dati e si usa fino alla fine alcuni tips dei js 'clonati' ".$check;
  } 

?>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.