We are recently seeing a number of external sites trying to leverage the core of EE to use our site to force referrals that look like they are coming from our domain. My assumption is they are trying this to juice up their referrals for search engine rankings. What they do is hit our site with URLs like:
http://www.macobserver.com/tmo/?URL=http%3A%2F%2Fexpressionengine.stackexchange.com%2F
This then redirects from our site to that external site. In doing some digging this is something built into the EE Core:
/system/expressionengine/libraries/Redirect.php
There is a check that stops the links from auto-redirecting with an interstitial page, but that is only a small bit of protection.
if ($force_redirect == TRUE OR ( ! isset($_SERVER['HTTP_REFERER']) OR ! stristr($_SERVER['HTTP_REFERER'], $host)))
{
// Possibly not from our site, so we give the user the option
// Of clicking the link or not
$str = "<html>\n<head>\n<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>\n<title>Redirect</title>\n</head>\n<body>".
"<p>To proceed to the URL you have requested, click the link below:</p>".
"<p><a href='".$_GET['URL']."'>".$_GET['URL']."</a></p>\n</body>\n</html>";
}
Is there a way to better prevent this kind of "referrer-jacking"?