Mirrors/roundcubemail
2
0
Fork 0
mirror of https://github.com/roundcube/roundcubemail.git synced 2026-03-03 14:54:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

Respect HTTP_X_FORWARDED_FOR and HTTP_X_REAL_IP variables for session IP check

Browse Source
This commit is contained in:
Thomas Bruederli
2013-07-17 08:04:15 +02:00
parent 6d1e313788
commit 4d480b36ea
2 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
program/lib/Roundcube/rcube_session.php
View File

@@ -54,7 +54,7 @@ class rcube_session
{
$this->db = $db;
$this->start = microtime(true);
$this->ip = $_SERVER['REMOTE_ADDR'];
$this->ip = rcube_utils::remote_addr();
$this->logging = $config->get('log_session', false);
$lifetime = $config->get('session_lifetime', 1) * 60;
@@ -480,7 +480,7 @@ class rcube_session
public function kill()
{
$this->vars = null;
$this->ip = $_SERVER['REMOTE_ADDR']; // update IP (might have changed)
$this->ip = rcube_utils::remote_addr(); // update IP (might have changed)
$this->destroy(session_id());
rcube_utils::setcookie($this->cookiename, '-del-', time() - 60);
}
@@ -694,10 +694,10 @@ class rcube_session
function check_auth()
{
$this->cookie = $_COOKIE[$this->cookiename];
$result = $this->ip_check ? $_SERVER['REMOTE_ADDR'] == $this->ip : true;
$result = $this->ip_check ? rcube_utils::remote_addr() == $this->ip : true;
if (!$result) {
$this->log("IP check failed for " . $this->key . "; expected " . $this->ip . "; got " . $_SERVER['REMOTE_ADDR']);
$this->log("IP check failed for " . $this->key . "; expected " . $this->ip . "; got " . rcube_utils::remote_addr());
}
if ($result && $this->_mkcookie($this->now) != $this->cookie) {

15
program/lib/Roundcube/rcube_utils.php
View File

@@ -665,6 +665,21 @@ class rcube_utils
}
/**
* Returns the real remote IP address
*
* @return string Remote IP address
*/
public static function remote_addr()
{
foreach (array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR') as $prop) {
if (!empty($_SERVER[$prop]))
return $_SERVER[$prop];
}
return '';
}
/**
* Read a specific HTTP request header.
*