[ros-diffs] [cfinck] 446: Change the RosCMS Login code and Bugzilla's ROSCMS Login module to determine the client's IP address also from the X-Forwarded-For header. This also readds the IP check to Bugzilla.

[cfinck at svn.reactos.org]

Author: cfinck
Date: Thu Jul  9 04:00:45 2009
New Revision: 446

URL: http://svn.reactos.org/svn/reactos?rev=446&view=rev
Log:
Change the RosCMS Login code and Bugzilla's ROSCMS Login module to determine the client's IP address also from the X-Forwarded-For header.
This also readds the IP check to Bugzilla.

Modified:
    branches/danny-web/www/www.reactos.org/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm
    branches/danny-web/www/www.reactos.org/roscms/lib/om/Login.class.php

Modified: branches/danny-web/www/www.reactos.org/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm
URL: http://svn.reactos.org/svn/reactos/branches/danny-web/www/www.reactos.org/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm?rev=446&r1=445&r2=446&view=diff
==============================================================================
--- branches/danny-web/www/www.reactos.org/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm [iso-8859-1] (original)
+++ branches/danny-web/www/www.reactos.org/bugzilla/Bugzilla/Auth/Login/ROSCMS.pm [iso-8859-1] Thu Jul  9 04:00:45 2009
@@ -72,10 +72,24 @@
 	if ( defined $session_id ) {
 		my $session_id_clean = $session_id;
 		trick_taint($session_id_clean);
-
+		
+		my $ip_clean;
+		if ($ENV{'HTTP_X_FORWARDED_FOR'}) {
+			my @proxies = split(/,/, $ENV{'HTTP_X_FORWARDED_FOR'});
+			$ip_clean = $proxies[0];
+		} else {
+			$ip_clean = $ENV{'REMOTE_ADDR'};
+		}
+		
+		if ($ip_clean =~ m/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/) {
+			$ip_clean = $1;
+		} else {
+			$ip_clean = 'invalid';
+		}
+		
 		my $browser_agent_clean = $ENV{'HTTP_USER_AGENT'};
 		trick_taint($browser_agent_clean);
-
+		
 		my $query = "SELECT m.subsys_user_id, m.user_id " .
 				"  FROM $roscms_db_name.roscms_accounts_sessions s " .
                                 "  JOIN $roscms_db_name.roscms_accounts u ON s.user_id = u.id " .
@@ -83,11 +97,13 @@
 				" WHERE s.id = ? " .
 				"   AND (s.expires IS NULL OR " .
 				"        NOW() <= s.expires) " .
+				"   AND (s.ip = 'false' OR " .
+				"        s.ip = ?) " .
 				"   AND (s.browseragent = 'false' OR " .
 				"        s.browseragent = ?) " .
 				"   AND m.subsys = 'bugzilla'";
 
-		my @params = ($session_id_clean, $browser_agent_clean);
+		my @params = ($session_id_clean, $ip_clean, $browser_agent_clean);
 		($user_id, $roscms_user_id) = $dbh->selectrow_array($query, undef, @params);
 		
 		if ($user_id) {

Modified: branches/danny-web/www/www.reactos.org/roscms/lib/om/Login.class.php
URL: http://svn.reactos.org/svn/reactos/branches/danny-web/www/www.reactos.org/roscms/lib/om/Login.class.php?rev=446&r1=445&r2=446&view=diff
==============================================================================
--- branches/danny-web/www/www.reactos.org/roscms/lib/om/Login.class.php [iso-8859-1] (original)
+++ branches/danny-web/www/www.reactos.org/roscms/lib/om/Login.class.php [iso-8859-1] Thu Jul  9 04:00:45 2009
@@ -60,10 +60,18 @@
       $session_id = $matches[1];
 
       // get a valid ip
-      if (isset($_SERVER['REMOTE_ADDR']) && preg_match('/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/', $_SERVER['REMOTE_ADDR'], $matches) ) {
-          $remote_addr = $matches[1];
-      }
-      else{
+      if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER))
+      {
+      	$proxies = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
+      	$remote_addr = $proxies[0];
+      }
+      else
+      {
+      	$remote_addr = $_SERVER['REMOTE_ADDR'];
+      }
+      
+      if (!preg_match('/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/', $remote_addr))
+      {
           $remote_addr = 'invalid';
       }