Copy and Paste JavaScript With an Ajax Engine / Page 3

Copy and Paste JavaScript with an Ajax Engine [con't]

An Ajax "Same Domain" Restriction Workaround

As noted earler, the main JavaScript function for the Ajax engine may retrieve content only from the domain where the Web page with the JavaScript is located. A workaround is to install a software relay on the domain. Ajax provides the URL to the relay. The relay grabs the content from the Internet and returns it to Ajax. Here's a PHP script and a Perl CGI script. Either one can be used as a software relay.

PHP relay script:

<?php
# List the allowed domain names below, between quote
#   characters, with all but the last followed by a comma.
#
# This is to restrict opportunities for cross site
#   scripting. Pages can only be retrieved from the
#   domains listed here.
#
# In order to retrieve pages from both example.com and
#   www.example.com, both domains must be listed.
$AllowedDomains = Array(
"example.com",
"www.example.com",
"www.BontragerCGI.com",
"BontragerConnection.com"
);
# Notes:
# Check for a URL in the query string, as a value in a
#   GET variable, or as a value in a POST variable. The
#   first to match is used. If none match, exit.
if( isset($_SERVER['QUERY_STRING']) and preg_match('/^http:\/\//i',$_SERVER['QUERY_STRING']) )
{ $url = $_SERVER['QUERY_STRING']; }
elseif( isset($_GET['url']) and preg_match('/^http:\/\//i',$_GET['url']) )
{ $url = $_GET['url']; }
elseif( isset($_POST['url']) and preg_match('/^http:\/\//i',$_POST['url']) )
{ $url = $_POST['url']; }
else
{ exit; }
# Verify the domain in the URL is allowed. If unable to
#   verify, exit.
$checkdomain = preg_replace('/^http:\/\//i','',$url);
$checkdomain = preg_replace('/\/.*$/','',$checkdomain);
$checkdomain = strtolower($checkdomain);
$domainokay = false;
foreach($AllowedDomains as $domain)
{
	if( $checkdomain == strtolower($domain) )
	{
		$domainokay = true;
		break;
	}
}
if(! $domainokay)
{ exit; }
# An URL may be used as a filename with function readfile()
#   when URL-aware fopen wrappers are enabled. See
#   https://us2.php.net/manual/en/ref.filesystem.php#ini.allow-url-fopen
readfile($url);
exit;
# When URL-aware fopen wrappers are not enabled, the
#   following can be used.
# Retrieve the page and echo it to the browser.
# Break URL into host and URI parts.
if(strpos($url,'/') == 0)
{
	$host = $_SERVER['SERVER_NAME'];
	$uri = $url;
}
else
{
	$url = preg_replace('/^.+?:\/\//','',$url);
	$pos = strpos($url,'/');
	$host = substr($url,0,$pos);
	$uri = substr($url,$pos);
}
# Open socket and store remote web page in $content
$content = '';
$fp = @fsockopen("$host",80,$errno,$errstr,30);
if(!$fp)
{
	echo("Error: $errstr ($errno)");
	exit;
}
else
{
	fwrite($fp,"GET $uri HTTP/1.0\r\n");
	fwrite($fp,"Host: $host\r\n");
	if( isset($_SERVER['HTTP_USER_AGENT']) )
	{ fwrite($fp,'User-Agent: '.$_SERVER['HTTP_USER_AGENT']."\r\n"); }
	fwrite($fp,"Connection: Close\r\n");
	fwrite($fp,"\r\n");
	while (! feof($fp) )
	{ $content .= fgets($fp,1024); }
	fclose($fp);
}
# Remove header lines from content and echo the rest to
#   the browser.
if( strpos($content,"\r") > 0 )
{ echo( preg_replace('/^.+?[\r\n]{4,}/s','',$content) ); }
else
{ echo( preg_replace('/^.+?\n{2,}/s','',$content) ); }
?>

Perl CGI relay script:

#!/usr/bin/perl
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;
# Between the line like this (see below)
#      my $AllowedDomains = <<LIST;
#   and the line like this,
#      LIST
#   list the allowed domain names separated with one
#   or more white space characters.
#
# This is to restrict opportunities for cross site
#   scripting. Pages can only be retrieved from the
#   domains listed here.
#
# In order to retrieve pages from both example.com and
#   www.example.com, both domains must be listed.
my $AllowedDomains = <<LIST;
example.com   www.example.com
   www.BontragerCGI.com
BontragerConnection.com
LIST
# Notes:
# Check for a URL in the query string, as a value in a
#   GET variable, or as a value in a POST variable. The
#   first to match is used. If none match, exit.
my $url = '';
if($ENV{QUERY_STRING} and $ENV{QUERY_STRING} !~ /=/)
{ $url = $ENV{QUERY_STRING}; }
elsif($ENV{QUERY_STRING} and $ENV{QUERY_STRING} =~ /^url=(.+)$/)
{ $url = $1; }
elsif($ENV{REQUEST_METHOD} eq 'POST')
{
	my $buffer;
	read(STDIN,$buffer,$ENV{CONTENT_LENGTH});
	if($buffer =~ /^url=(.+)$/)
	{ $url = $1; }
}
goto BOTTOM unless $url;
# Verify the domain in the URL is allowed. If unable to
#   verify, exit.
my $checkdomain = lc $url;
$checkdomain =~ s!^https://!!i;
$checkdomain =~ s!/.*$!!;
my $domainokay = '';
$AllowedDomains =~ s/^\s*//s;
$AllowedDomains =~ s/\s*$//s;
for my $domain (split /\s+/,$AllowedDomains)
{
	if($checkdomain eq lc($domain))
	{
		$domainokay = 1;
		last;
	}
}
goto BOTTOM unless $domainokay;
# Retrieve the page and print it to the browser.
my ($content,$success) = ();
my $ua = LWP::UserAgent->new;
$ua->agent($ENV{HTTP_USER_AGENT}) if $ENV{HTTP_USER_AGENT};
my $r = $ua->request(GET $url);
$success = $r->is_success if $r->is_success;
if($success)
{ $content = $r->content; }
else
{ $content = 'Something is awry. Status code: '.$r->code; }
print "Content-type: text/html\n\n$content";
BOTTOM:
# end of script

Install the script of your choice (only if you wish to retrieve content from a domain) other than where the JavaScript Ajax engine is being used. Notice that both scripts require a list of domain names where they're allowed to retrieve content. This is to reduce issues with hackers/crackers exploiting your relays and grabbing content for potentially malicious purposes.

Leave the instructions in the scripts so they'll be there when you wish to add or remove a domain name.

To use the software relay, make a link something like this:

When the above example link is clicked, the JavaScript retrieves the content from URL /relay.php?https://example.com/file.txt and inserts it into the HTML tag with id="AnIdentification".

When URL /relay.php?https://example.com/file.txt is asked for content, relay.php grabs the content from URL https://example.com/file.txt and returns it to the Ajax engine. /relay.php?https://example.com/file.txt is a relative URL. The relative URL's parameter is the absolute URL of the content to retrieve from the example.com domain. The Perl CGI software is used the same way. It's URL might be /cgi-bin/relay.cgi?https://example.com/file.txt

Conclusion

You now have a of the copy and paste JavaScript Ajax engine as one of your software tools. And you didn't need to dig into Ajax to understand it. You also have a neat little workaround for the Ajax "same domain" restriction. You can retrieve content at any public HTTP URL and display it on your page.

About the Author

Will Bontrager has created software specifically for the Internet since early 1998. To learn more about Will, visit https://bontragerconnection.com/ and https://willmaster.com/.

Original: October 31, 2007 Digg This Add to del.icio.us

[prev]