| ca5b6a64 | 29-Jan-2019 |
Simon DELAGE <sdelage@gmail.com> |
Improve tpl_getMediaFile()
Previously, if no candidate is found, the result would still always be last candidate url even if it doesn't exist (and function would trigger a Warning for trying to geti
Improve tpl_getMediaFile()
Previously, if no candidate is found, the result would still always be last candidate url even if it doesn't exist (and function would trigger a Warning for trying to getimagesize() on a file that doesn't exist)
show more ...
|
| 925105e8 | 21-Oct-2019 |
Phy <git@phy25.com> |
clientIP: add trustedproxy, return first untrusted IP instead of the last one
This fixes #2828, where malicious clients passed in customized HTTP header to keep its IP address off records.
This is
clientIP: add trustedproxy, return first untrusted IP instead of the last one
This fixes #2828, where malicious clients passed in customized HTTP header to keep its IP address off records.
This is inspired by Sympony's Request::setTrustedProxies, but I don't want to implement everything including IP CIDR matching (IPv4 + IPv6), so I decided to reuse the local IP checker in place powered by regexp. Now admins can customize this "local" (trusted) proxy list using $conf['trustedproxy'], and by default it will allow any local IPs.
If in the future there is a need to implement array-based CIDR matching, $conf['trustedproxies'] can be used for the new config name.
show more ...
|