netman w00t — Wed, 12 Jan 2005 20:53:36 +0000

Do you have the option of using server-side scripting like PHP? This task would me much easier accomplished that way.

Using client-side scripting for this can be easily defeated, either intentionally or unintentionally, and server-side scripting also has the advantage of being much more transparent.

For example, a simple setup could be as follows:
[in the .htaccess for your web root]

RewriteEngine on
RewriteRule !^index.php /index.php [L]

'
[in index.php]

<?php
    $default_file = \"index.html\"; // this file will be returned when the user requests directories

    session_start();

    if($_POST['agree_button'] == \"agree\")
    {
        $_SESSION['user_agrees'] = true;
        header(\"Location: /\");
    }

    if(!$_SESSION['user_agrees'])
    {
        
<html>
 ... 
<form action=\"test.php\" method=\"post\">
<input type=\"submit\" name=\"agree_button\" value=\"agree\" />
</form>
 ... 
</html>
        exit;
    }

    list($file) = explode(\"?\",$_SERVER['REQUEST_URI']);
    if(ereg(\"/$\",$file))
        $file .= $default_file;
    if(empty($file))
        $file = $default_file;

    if(!$fd = @fopen($_SERVER['DOCUMENT_ROOT'].$file,\"rb\"))
    {
        
<html>
<head><title>Error</title></head>
<body><h1>Error</h1><b>Couldn't access the requested file</b></body>
</html>

    } else {
        while($buf = fread($fd,1024))
            print($buf);
    }
?>

This assumes a couple of things:
1) You're using Apache (who doesn't nowadays?)
2) You can use .htaccess files (most can)
3) You have mod_rewrite loaded (this is rather common)
4) You can use PHP.

If you can meet those assumptions, then the above script is pretty easy to use. Just put it in your web root, and each and every request will be checked to see if the user has agreed to your terms or whatever. If the user hasn't accepted the terms, it displays some html (modify it to your needs) containing a form which it processes. If the user has accepted the terms, it fetches the required file, and if this is impossible, it prints an error message (customize this as well). The user never sees the script's presence again after they've agreed (at least until their PHP session cookie gets deleted) and passing on a url will not defeat it either.

The only downsides to using this are the fact that PHP must be invoked on every request, incurring a slight overhead, and the fact that regular Apache errordocuments can't be used, but neither of these are a major issue IMO.