
Craigo(@c-white-outlook-com)
1 Post
Customers
Quote from Craigo on March 13, 2024, 10:57
In storage.php
$ip = $_SERVER['HTTP_X_FORWARDED_FOR']; // "91.196.221.50, 172.71.174.239"
$this->user_ip = filter_var($ip, FILTER_VALIDATE_IP);
the problem is that HTTP_X_FORWARDED_FOR contains a comma seperated IP, and FILTER_VALIDATE_IP says this is invalid.
Suggested Fix:
if(!empty($_SERVER['HTTP_X_REAL_IP'])){
$ip = $_SERVER['HTTP_X_REAL_IP'];
if($splitPos = strpos($ip, ',')) $ip = substr($ip, 0, $splitPos);
} else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
if($splitPos = strpos($ip, ',')) $ip = substr($ip, 0, $splitPos);
} elseif(isset($_SERVER['REMOTE_ADDR'])) {
$ip = $_SERVER['REMOTE_ADDR'];
} else {
$ip='';
}
In storage.php
$ip = $_SERVER['HTTP_X_FORWARDED_FOR']; //"91.196.221.50, 172.71.174.239"
$this->user_ip = filter_var($ip, FILTER_VALIDATE_IP);
the problem is that HTTP_X_FORWARDED_FOR contains a comma seperated IP, and FILTER_VALIDATE_IP says this is invalid.
Suggested Fix:
if(!empty($_SERVER['HTTP_X_REAL_IP'])){
$ip = $_SERVER['HTTP_X_REAL_IP'];
if($splitPos = strpos($ip, ',')) $ip = substr($ip, 0, $splitPos);
} else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
if($splitPos = strpos($ip, ',')) $ip = substr($ip, 0, $splitPos);
} elseif(isset($_SERVER['REMOTE_ADDR'])) {
$ip = $_SERVER['REMOTE_ADDR'];
} else {
$ip='';
}
Pablo Borysenco(@pavlo_borysenco)
34,196 Posts
Quote from Pablo Borysenco on March 13, 2024, 11:40
Hello
thank you for your cooperation
I passed this on to the developers
Hello
thank you for your cooperation
I passed this on to the developers