HTTP_REFERER behavior - assistance required

Question

I have three separate pages: modify.php allows the user to select a publisher and creates a session variable for that publisher.

modify.php

<?php
    session_start();
    require ("../login.php");

    if (!isset($_SESSION['user']))
        header('Location: ../index.php');

    if (isset($_POST['submit'])) {
        $_SESSION['publisher'] = $_POST['publishers'];
        header('Location: modify2.php');
    }

    $user_id = $_SESSION['user'];
    $success = true;

    include ("header.php");
    include ("subnav.php");

    $stmt = $db->prepare
        ("SELECT DISTINCT p.name 
        FROM subscriptions s
        JOIN titles t
            ON s.title = t.id
        JOIN publishers p
            ON t.publisher = p.name
        WHERE s.user=:user
        ORDER by p.name");
    $stmt->bindValue(':user', $user_id, PDO::PARAM_INT);
    $stmt->execute();
    $rows = $stmt->fetchAll();
    $num_rows = count($rows);
    if ($num_rows == 0) {
        $success = false;
        $errors[] = 'You currently have no subscriptions.';
    }
?>

    <h2>Modify Subscriptions</h2>

    <?php
        if (!empty($errors))
            foreach($errors as $error)
                echo $error;
    ?>

<?php
        if ($success == true) { ?>
            <form action="" method="post">
                <ul>
                    <li>
                        Select Publisher:<br>
                        <select name="publishers">
                        <?php
                        foreach($rows as $row) {
                            echo '<option value ="'. $row['name'] . '">' . $row['name'] . '</option>';  
                        }   ?>
                        </select>
                    </li>
                    <li>
                        <input type="submit" value="Select Publisher" name ="submit" id="submit">
                    </li>
                </ul>
            </form>
<?php   } ?>

<?php   
    include ("footer.php");
?>

modify2.php receives a session variable "publisher" from modify.php and retrieves the titles that are by that publisher. It then unsets the publisher session variable for two reasons: 1) it isn't needed anymore and 2) if this variable is empty then mofify2.php knows that the referer is coming from the wrong page

modify2.php

<?php
    session_start();
    require ("../login.php");

    if (!isset($_SESSION['user']))
        header('Location: ../index.php');

    if (!isset($_SESSION['publisher']))
        header('Location: modify.php');

    $referer = $_SERVER['HTTP_REFERER'];
    if (basename($referer) <> 'modify.php')
        header('Location: modify.php');

    if (isset($_POST['submit'])) {
        $_SESSION['title'] = $_POST['title'];
        unset($_SESSION['publisher']);
        header('Location: modify3.php');
    }

    $user_id = $_SESSION['user'];
    $publisher = $_SESSION['publisher'];

    include ("header.php");
    include ("subnav.php");

    $stmt = $db->prepare
        ("SELECT t.title
        FROM titles t
        JOIN publishers p
            ON t.publisher = p.name
        JOIN subscriptions s
            ON t.id = s.title
        WHERE s.user=:user AND t.publisher=:publisher
        ORDER by t.title");
    $stmt->bindValue(':user', $user_id, PDO::PARAM_INT);
    $stmt->bindValue(':publisher', $publisher, PDO::PARAM_STR);
    $stmt->execute();
    $rows = $stmt->fetchAll();
    $num_rows = count($rows);
    if ($num_rows == 0)
        $errors[] = 'There are currently no titles for that publisher.';
?>

    <h2>Modify Subscriptions</h2>

    <?php
        if (!empty($errors))
            foreach($errors as $error)
                echo $error;
    ?>

    <form action="" method="post">
        <ul>
            <li>
                Select Title:<br>
                <select name="title">
                <?php
                foreach($rows as $row) {
                    echo '<option value ="'. $row['id'] . '">' . $row['title'] . '</option>';  
                }   ?>
                </select>
            </li>
            <li>
                <input type="submit" value="Select Title" name ="submit" id="submit">
            </li>
        </ul>
    </form>

<?php   
    include ("footer.php");
?>

This file is wherein lies the problem. For whatever reason my http_referer block of code prevents access to the page. Any help would be appreciated.

modify3.php

<?php
    session_start();
    require ("../login.php");

    if (!isset($_SESSION['user']))
        header('Location: ../index.php');

    if (!isset($_SESSION['title']))
        header('Location: modify2.php');

    $referer = $_SERVER['HTTP_REFERER'];
    if (basename($referer) <> 'modify2.php');
        header('Location: modify2.php');

    $user_id = $_SESSION['user'];
    $title = $_SESSION['title'];
    $success = false;

    if (isset($_POST['submit'])) {

        $covers = (isset($_POST['covers'])) ? 1 : 0;

        if (empty($_POST['quantity']))
            $errors[] = 'You must enter a quantity!';
        else if (!is_numeric($_POST['quantity']))   
            $errors[] = 'You must enter a number for the quantity field!';
        else if (is_numeric($_POST['quantity']) && $_POST['quantity'] > 5)
            $errors[] = 'If you want to subscribe to more than 5 of the same issue, please contact us';
        else {
            $stmt = $db->prepare("UPDATE subscriptions SET quantity=:quantity, covers=:covers WHERE user=:id AND title=:title");
            $stmt->bindValue(':quantity', $_POST['quantity'], PDO::PARAM_INT);
            $stmt->bindValue(':covers', $covers, PDO::PARAM_INT);
            $stmt->bindValue(':id', $user_id, PDO::PARAM_INT);
            $stmt->bindValue(':title', $title, PDO::PARAM_INT);
            $stmt->execute();
            $success = true;
            unset($_SESSION['title']);
        }
    }

    include ("header.php");
    include ("subnav.php");

?>

    <h2>Modify Subscriptions</h2>

    <?php
        if (!empty($errors))
            foreach($errors as $error)
                echo $error;
    ?>

    <?php 
        if ($success == false) { ?>
            <form action="" method="post">
                <ul>
                    <li>
                        <b>Title To Modify:</b><br>
                        <?php 
                        $stmt = $db->prepare("SELECT title FROM titles WHERE id=:title");
                        $stmt->bindValue(':title', $title, PDO::PARAM_STR);
                        $stmt->execute();$rows = $stmt->fetchAll(); 
                        foreach ($rows as $row) {
                            echo $row['title'];
                        }
                        ?>
                    </li>
                    <li>
                        <br><input type="checkbox" name="covers" value="covers"
                        <?php
                            $stmt = $db->prepare("SELECT covers FROM subscriptions WHERE user=:id AND title=:title");
                            $stmt->bindValue(':id', $user_id, PDO::PARAM_INT);
                            $stmt->bindValue(':title', $title, PDO::PARAM_INT);
                            $stmt->execute();
                            $rows = $stmt->fetchAll();
                            foreach ($rows as $row)
                                if ($row['covers'] == 1)
                                    echo 'checked';
                        ?>
                        >Check to opt-in for all regular priced covers.
                    </li>
                    <li>
                        <br><b>Quantity Requested:</b> <br>
                        <input type="text" name="quantity" value="<?php $stmt = $db->prepare("SELECT quantity FROM subscriptions WHERE user=:user AND title=:title"); $stmt->bindValue(':user', $user_id, PDO::PARAM_INT); $stmt->bindValue(':title', $title, PDO::PARAM_INT); $stmt->execute(); $rows = $stmt->fetchAll(); foreach ($rows as $row) echo $row['quantity']; ?>">
                    </li>
                    <li>
                        <input type="submit" value="Save Changes" name="submit" id="submit">
                    </li>
                </ul>
            </form>
<?php   } 
        else { ?>
            <p>You have succesfully updated your title!</p>
<?php   }   ?>


<?php   
    include ("footer.php");
?>

If I take the following block of code out:

$referer = $_SERVER['HTTP_REFERER'];
        if (basename($referer) <> 'modify2.php');
            header('Location: modify2.php');

then my page works correctly, but it won't prevent people from manually typing it into their browser and accessing it in the wrong way.

Answer 1

You can't rely on the Referer header being sent by the browser. In fact, some of them offer the option to spoof it for "security" reasons.

Instead, you should save a variable in the $_SESSION array, indicating whether the user has accessed the page in the correct way.