public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 01:25:56 +00:00
Code Issues Releases Wiki Activity

use X-Real-IP headers if possible while authenticating

Browse Source
This commit is contained in:
Andrew Dolgov
2021-01-05 10:17:24 +03:00
parent 8764662138
commit a8302fb253
4 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
classes/userhelper.php
View File

@@ -38,7 +38,7 @@ class UserHelper {
$usth = $pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
$usth->execute([$user_id]);
$_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
$_SESSION["ip_address"] = UserHelper::get_user_ip();
$_SESSION["user_agent"] = sha1($_SERVER['HTTP_USER_AGENT']);
$_SESSION["pwd_hash"] = $row["pwd_hash"];
@@ -63,7 +63,7 @@ class UserHelper {
if (!$_SESSION["csrf_token"])
$_SESSION["csrf_token"] = bin2hex(get_random_bytes(16));
$_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
$_SESSION["ip_address"] = UserHelper::get_user_ip();
Pref_Prefs::initialize_user_prefs($_SESSION["uid"]);
@@ -138,4 +138,11 @@ class UserHelper {
}
static function get_user_ip() {
foreach (["HTTP_X_REAL_IP", "REMOTE_ADDR", "REMOTEADDR"] as $hdr) {
if (isset($_SERVER[$hdr]))
return $_SERVER[$hdr];
}
}
}