wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use getRemoteAddress which supports reverse proxies

Browse source 
Breaking change for 8.1 wiki (Security > Administrators):

The log format for failed logins has changed and uses now the remote address and is considering reverse proxies for such scenarios when configured correctly.
This commit is contained in:
Lukas Reschke 2015-02-24 11:49:40 +01:00
parent da8e34cf7f
commit 165afb004b
2 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apps/files_sharing/ajax/publicpreview.php
View file

@ -68,7 +68,7 @@ if($linkedItem['item_type'] === 'folder') {
$isValid = \OC\Files\Filesystem::isValidPath($file);
if(!$isValid) {
\OC_Response::setStatus(\OC_Response::STATUS_BAD_REQUEST);
\OC_Log::write('core-preview', 'Passed filename is not valid, might be malicious (file:"' . $file . '";ip:"' . $_SERVER['REMOTE_ADDR'] . '")', \OC_Log::WARN);
\OC_Log::write('core-preview', 'Passed filename is not valid, might be malicious (file:"' . $file . '";ip:"' . \OC::$server->getRequest()->getRemoteAddress() . '")', \OC_Log::WARN);
exit;
}
$sharedFile = \OC\Files\Filesystem::normalizePath($file);

5
lib/private/user/manager.php
View file

@ -181,10 +181,7 @@ class Manager extends PublicEmitter implements IUserManager {
}
}
$remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
$forwardedFor = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
\OC::$server->getLogger()->warning('Login failed: \''. $loginname .'\' (Remote IP: \''. $remoteAddr .'\', X-Forwarded-For: \''. $forwardedFor .'\')', array('app' => 'core'));
\OC::$server->getLogger()->warning('Login failed: \''. $loginname .'\' (Remote IP: \''. \OC::$server->getRequest()->getRemoteAddress(). ')', ['app' => 'core']);
return false;
}