diff options
author | Jeremy Kemper <jeremy@bitsweat.net> | 2008-06-03 22:38:27 -0700 |
---|---|---|
committer | Jeremy Kemper <jeremy@bitsweat.net> | 2008-06-03 22:38:27 -0700 |
commit | 53bcbfbdc1eed45cc6615e59d36baf018ab43d96 (patch) | |
tree | 691441d50ef7e49b5317ce279329bcaa1d135744 /actionpack/lib/action_controller/request.rb | |
parent | f55ad960d22337d0d92a93724f1cc3ad45200836 (diff) | |
parent | 82e96eb294ae21528c3e05e91c05c7ee5222afbd (diff) | |
download | rails-53bcbfbdc1eed45cc6615e59d36baf018ab43d96.tar.gz rails-53bcbfbdc1eed45cc6615e59d36baf018ab43d96.tar.bz2 rails-53bcbfbdc1eed45cc6615e59d36baf018ab43d96.zip |
Merge branch 'master' into erbout
Diffstat (limited to 'actionpack/lib/action_controller/request.rb')
-rwxr-xr-x | actionpack/lib/action_controller/request.rb | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/actionpack/lib/action_controller/request.rb b/actionpack/lib/action_controller/request.rb index a35b904194..9b02f2c8a1 100755 --- a/actionpack/lib/action_controller/request.rb +++ b/actionpack/lib/action_controller/request.rb @@ -134,14 +134,15 @@ module ActionController # REMOTE_ADDR is a proxy. HTTP_X_FORWARDED_FOR may be a comma- # delimited list in the case of multiple chained proxies; the last # address which is not trusted is the originating IP. - def remote_ip if TRUSTED_PROXIES !~ @env['REMOTE_ADDR'] return @env['REMOTE_ADDR'] end + remote_ips = @env['HTTP_X_FORWARDED_FOR'] && @env['HTTP_X_FORWARDED_FOR'].split(',') + if @env.include? 'HTTP_CLIENT_IP' - if @env.include? 'HTTP_X_FORWARDED_FOR' + if remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP']) # We don't know which came from the proxy, and which from the user raise ActionControllerError.new(<<EOM) IP spoofing attack?! @@ -149,11 +150,11 @@ HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect} EOM end + return @env['HTTP_CLIENT_IP'] end - if @env.include? 'HTTP_X_FORWARDED_FOR' then - remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',') + if remote_ips while remote_ips.size > 1 && TRUSTED_PROXIES =~ remote_ips.last.strip remote_ips.pop end |