阻止网络爬虫在user.login/user.reg/link.tpl之间进行循环重定向

Author: SwimmingTiger

src/page/link/tpl.php

@@ -1,4 +1,10 @@
 <?php
+$url = trim(code::b64d($_GET['url64']));
+if (preg_match('/^user\.(?:login|reg)\.[^?]*\?u=user\.(?:login|reg)\./', (string)$url)) {
+    header('HTTP/1.1 400 Bad Request');
+    die('循环重定向');
+}
+
 $tpl = str::word($PAGE->ext[0]);
 
 // 填充POST以触发CSRF保护
@@ -8,8 +14,6 @@
 // 只对CSRF请求拒绝设置Cookie，以便主题修改不生效。
 //require SUB_DIR.'/csrf_protect.php';
 
-$url = trim(code::b64d($_GET['url64']));
-
 if (!Page::isCsrfPost() && $PAGE->isRegTpl($tpl)) {
     page::setCookie('tpl', $tpl, 3600 * 24 * 3650);
 }

src/page/user/login.php

@@ -1,8 +1,13 @@
 <?php
 try {
-    $tpl = $PAGE->start();
     $u = $_GET['u'];
     if ($u == '') $u = $_GET['url'];
+    if (preg_match('/^user\.(?:login|reg)\./', (string)$u)) {
+        header('HTTP/1.1 400 Bad Request');
+        die('循环重定向');
+    }
+
+    $tpl = $PAGE->start();
     if ($u == '') $u = 'index.index.' . $PAGE->bid;
     $tpl->assign('u', $u);
     if (!$_POST['go']) {

src/page/user/reg.php

@@ -1,7 +1,12 @@
 <?php
 try {
-    $tpl = $PAGE->start();
     $u = $_GET['u'];
+    if (preg_match('/^user\.(?:login|reg)\./', (string)$u)) {
+        header('HTTP/1.1 400 Bad Request');
+        die('循环重定向');
+    }
+
+    $tpl = $PAGE->start();
     if ($u == '') $u = 'index.index.' . $PAGE->bid;
     $tpl->assign('u', $u);
 

src/robots.txt

@@ -3,6 +3,7 @@ Disallow: /q.php/user.login*
 Disallow: /q.php/user.reg*
 Disallow: /q.php/addin.chat*
 Disallow: /q.php/addin.speedtest*
+Disallow: /q.php/link.tpl*
 Allow: /q.php/addin*
 Allow: /q.php/admin*
 Allow: /q.php/api*