From 4440790902618c98f81f23a28747ccc117bfe53b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 11 Jul 2016 08:07:19 +0200 Subject: [PATCH] Make proxy IP parsing aware of multiple proxies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michal Čihař --- libraries/ip_allow_deny.lib.php | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/libraries/ip_allow_deny.lib.php b/libraries/ip_allow_deny.lib.php index f253e37c15..8deba0c0a8 100644 --- a/libraries/ip_allow_deny.lib.php +++ b/libraries/ip_allow_deny.lib.php @@ -29,19 +29,28 @@ function PMA_getIp() /* Do we trust this IP as a proxy? If yes we will use it's header. */ if (isset($GLOBALS['cfg']['TrustedProxies'][$direct_ip])) { - $trusted_header_value - = PMA_getenv($GLOBALS['cfg']['TrustedProxies'][$direct_ip]); - $matches = array(); + /** + * Parse header in form: + * X-Forwarded-For: client, proxy1, proxy2 + */ + // Get header content + $value = PMA_getenv($GLOBALS['cfg']['TrustedProxies'][$direct_ip]); + // Grab first element what is client adddress + $value = explode(',', $value)[0]; + // Extract IP address // the $ checks that the header contains only one IP address, // ?: makes sure the () don't capture + $matches = array(); $is_ip = preg_match( '|^(?:[0-9]{1,3}\.){3,3}[0-9]{1,3}$|', - $trusted_header_value, $matches + $value, $matches ); if ($is_ip && (count($matches) == 1)) { // True IP behind a proxy return $matches[0]; } + // We could not parse header + return false; } /* Return true IP */ @@ -169,7 +178,7 @@ function PMA_ipv4MaskTest($testRange, $ipToTest) function PMA_ipv6MaskTest($test_range, $ip_to_test) { $result = true; - + // convert to lowercase for easier comparison $test_range = strtolower($test_range); $ip_to_test = strtolower($ip_to_test);