From 53c6d92b0b22f3c2661b810fc817fa787a4ef9a4 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 23 Dec 2020 13:17:40 +0100 Subject: [PATCH] Enhance remote ip detection --- htdocs/core/lib/functions.lib.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 713da28996e..92114b7c094 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -2887,12 +2887,16 @@ function getUserRemoteIP() { if (empty($_SERVER['HTTP_X_FORWARDED_FOR']) || preg_match('/[^0-9\.\:,\[\]]/', $_SERVER['HTTP_X_FORWARDED_FOR'])) { if (empty($_SERVER['HTTP_CLIENT_IP']) || preg_match('/[^0-9\.\:,\[\]]/', $_SERVER['HTTP_CLIENT_IP'])) { - $ip = (empty($_SERVER['REMOTE_ADDR']) ? '' : $_SERVER['REMOTE_ADDR']); + if (empty($_SERVER["HTTP_CF_CONNECTING_IP"])) { + $ip = (empty($_SERVER['REMOTE_ADDR']) ? '' : $_SERVER['REMOTE_ADDR']); // value may have been forged by client + } else { + $ip = $_SERVER["HTTP_CF_CONNECTING_IP"]; // value here may have been forged by client + } } else { - $ip = $_SERVER['HTTP_CLIENT_IP']; // value is clean here + $ip = $_SERVER['HTTP_CLIENT_IP']; // value is clean here but may have been forged by proxy } } else { - $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; // value is clean here + $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; // value is clean here but may have been forged by proxy } return $ip; }