From a8302fb25316661512951fdf744ac1bae6e94ef6 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Tue, 5 Jan 2021 10:17:24 +0300
Subject: [PATCH] use X-Real-IP headers if possible while authenticating
---
classes/api.php | 2 +-
classes/handler/public.php | 2 +-
classes/logger/sql.php | 5 ++++-
classes/userhelper.php | 11 +++++++++--
4 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/classes/api.php b/classes/api.php
index 6b857f689..aa39171bf 100755
--- a/classes/api.php
+++ b/classes/api.php
@@ -81,7 +81,7 @@ class API extends Handler {
$this->wrap(self::STATUS_OK, array("session_id" => session_id(),
"api_level" => self::API_LEVEL));
} else { // else we are not logged in
- user_error("Failed login attempt for $login from {$_SERVER['REMOTE_ADDR']}", E_USER_WARNING);
+ user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
}
} else {
diff --git a/classes/handler/public.php b/classes/handler/public.php
index 4bd9c06f9..86a82cc61 100755
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -714,7 +714,7 @@ class Handler_Public extends Handler {
if (!isset($_SESSION["login_error_msg"]))
$_SESSION["login_error_msg"] = __("Incorrect username or password");
- user_error("Failed login attempt for $login from {$_SERVER['REMOTE_ADDR']}", E_USER_WARNING);
+ user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
}
$return = clean($_REQUEST['return']);
diff --git a/classes/logger/sql.php b/classes/logger/sql.php
index 1b44b1e5f..c1ea16ef9 100755
--- a/classes/logger/sql.php
+++ b/classes/logger/sql.php
@@ -16,7 +16,10 @@ class Logger_SQL {
$context = mb_substr($context, 0, 8192);
$server_params = [
- "IP" => "REMOTE_ADDR",
+ "Real IP" => "HTTP_X_REAL_IP",
+ "Forwarded For" => "HTTP_X_FORWARDED_FOR",
+ "Forwarded Protocol" => "HTTP_X_FORWARDED_PROTO",
+ "Remote IP" => "REMOTE_ADDR",
"Request URI" => "REQUEST_URI",
"User agent" => "HTTP_USER_AGENT",
];
diff --git a/classes/userhelper.php b/classes/userhelper.php
index fd0b0ac57..4cc6768db 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -38,7 +38,7 @@ class UserHelper {
$usth = $pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
$usth->execute([$user_id]);
- $_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
+ $_SESSION["ip_address"] = UserHelper::get_user_ip();
$_SESSION["user_agent"] = sha1($_SERVER['HTTP_USER_AGENT']);
$_SESSION["pwd_hash"] = $row["pwd_hash"];
@@ -63,7 +63,7 @@ class UserHelper {
if (!$_SESSION["csrf_token"])
$_SESSION["csrf_token"] = bin2hex(get_random_bytes(16));
- $_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
+ $_SESSION["ip_address"] = UserHelper::get_user_ip();
Pref_Prefs::initialize_user_prefs($_SESSION["uid"]);
@@ -138,4 +138,11 @@ class UserHelper {
}
+ static function get_user_ip() {
+ foreach (["HTTP_X_REAL_IP", "REMOTE_ADDR", "REMOTEADDR"] as $hdr) {
+ if (isset($_SERVER[$hdr]))
+ return $_SERVER[$hdr];
+ }
+ }
+
}
--
GitLab