Block a Page if NOT called from iframe

[ukgimp]

I have an apache site that has an imframe of a page also on the same server. How would you stop that page being accessed directly.

eg

/media/ads.php

This page gets called from within the template.

Can this be done with htaccess or php based on referer.

Looking for the best solution.

Cheers

[ukgimp]

I search for a while, no joy, then the very next page I find a solution

<?php

$allowed_domains = array(
        'a-good-domain.com',
        'another-nice-one.org',
        );

$allowed = false;
foreach ($allowed_domains as $a) {
    if (preg_match("@https?://$a/.*@", $_SERVER['HTTP_REFERER'])) {
        $allowed = true;
    }
}

if ($allowed)
    echo "Nice domain";
else
    echo "Ugly domain";

[JasonD]

the regexp is easily defeated with a sub domain and referer can be faked.

Why not try and and do some location.hostname and some JS jiggery pokery although please remember that the sandbox attribute will allow the direct IFrame to be defeated so i would suggest having the page load JS that pulls the content in via XHR request.