[PHP] How does vBulletin 4 hide CSS?

[RastaLulz]

Hello,

This is what happens when you try to access vBulletin's CSS (even through view source mode):
http://www.vbulletin.com/forum/css....ulletin-chrome.css,vbulletin-formcontrols.css,

I was wondering how vBulletin 4 manages to hide the CSS source from being viewed directly. At first I thought a simple session trick would work, but it appears that the browser or something is caching the file in view source mode, as I can view it the first time, but after a refresh it hides the CSS like it is suppose to do. But if I directly access the CSS file the first time it does what I wanted it to do - it hides the CSS.

index.php

<?php
//secure CSS
session_start();
$_SESSION['CSS'] = 'unsecure';
?>

<link rel="stylesheet" type="text/css" href="style.php" />

style.php

<?php
session_start();
if($_SESSION['CSS'] != 'unsecure') {
  die('What are you trying to do?');
}
unset($_SESSION['CSS']);
header("Content-type: text/css");
?>
body {
  background-color: #EBEBEB;
}

Any input on how to accomplish this would be much appreciated.

 

[s-p-n]

not sure if this is how they do it, but it could be with an AJAX call? I can see their hidden CSS with Firebug so idk the point of doing this.. If you let the browser see the css then the end user's computer see's it, which means it's not hidden very well at all... but it needs to be interpreted by the end user's computer at some point or the page will have no stylesheet.. it's a catch22. Same reason HTML can't be hidden very well...

But I can try to hide the CSS with AJAX. Again, not sure how they achieved that..

Page that's ok to have stylesheet:

<?php
session_start();
$_SESSION['load_css_bool']=true;
?>

On the style sheet:

<?php
session_start();
if($_SESSION['load_css_bool'])
{
    ?>
    //css here
    <?php
}
?>

on the head of the page with the stylesheet:

<head>
<script type="text/JavaScript">
function unauthorise_stylesheet() {
    if(window.XMLHttpRequest)
    {
        xmlhttp=new XMLHttpRequest();
    } else {
        xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
    }
    xmlhttp.onreadystatechange=function()
    {
        if(xmlhttp.readyState==4 && xmlhttp.status==200)
        {
            var response = xmlhttp.responseText;
        }
    }
    xmlhttp.open("GET",unauthorise_stylesheet.php",true);
    xmlhttp.send();
}
</script>
</head>
<body onload="unauthorise_stylesheet()">
...

on the PHP file unauthorise_stylesheet.php:

<?php
session_start();
$_SESSION['load_css_bool'] = false;
?>Stylesheet Hidden

I personally think the whole idea is overkill and not worth the effort..

 

[jMerliN]

1. Read the source.

2. Play around with Wireshark.

Example:

I loaded IE. Killed all history, started Wireshark and loaded vBulletin Community Forum. The filter I used was: http && ip.src == 98.158.195.239 || ip.dst == 98.158.195.239

Now, you'll notice I did this for a good reason, vBulletin has well designed cache control which means you'll just end up getting 302's, we really want to see what's going on.

I loaded the page, hit refresh, then navigated to the CSS page in the URL and looked at the differences in the queries. I noticed the only difference between a non-cached request and the ad-hoc one I made is the encoding:

http://www.vbulletin.com/forum/css.php?styleid=12&langid=1&d=1291156103&td=ltr&sheet=bbcode.css,editor.css,popupmenu.css,reset-fonts.css,vbulletin.css,vbulletin-chrome.css,vbulletin-formcontrols.css,

vs

http://www.vbulletin.com/forum/css.php?styleid=12&langid=1&d=1291156103&td=ltr&sheet=bbcode.css,editor.css,popupmenu.css,reset-fonts.css,vbulletin.css,vbulletin-chrome.css,vbulletin-formcontrols.css,

Without looking at the code I can't tell you exactly why '&' trips this up -- but my guess is it messes up the arguments and so you get the same output as if there are none, or:

http://www.vbulletin.com/forum/css.php

And that this is unintended. You can verify this, use the decoded URL and you'll see the CSS in your browser. Chrome automatically htmlencodes the smart links from its source views.

 

[RastaLulz]

I can see their hidden CSS with Firebug so idk the point of doing this..

Good point. It sucks that there isn't a way to protect your work.. Oh well, thanks for the help guys.

Thread closed. :*: