diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2013-10-03 10:27:58 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-10-03 10:27:58 -0700 |
| commit | befeeb2d0aef8db4ba84d1e2fa0d273f8a111363 (patch) | |
| tree | 70e00f8546f6bb7765474dd792c1d08ed7ecac19 /actionpack | |
| parent | 5aee516b5edb49d7206cd9815c13a78b6b16c5d9 (diff) | |
| parent | 83c4b0a7f977b75a9005ceb78d8a2a719392d904 (diff) | |
| download | rails-befeeb2d0aef8db4ba84d1e2fa0d273f8a111363.tar.gz rails-befeeb2d0aef8db4ba84d1e2fa0d273f8a111363.tar.bz2 rails-befeeb2d0aef8db4ba84d1e2fa0d273f8a111363.zip | |
Merge branch '3-2-stable' into 3-2-sec
* 3-2-stable:
make sure both headers are set before checking for ip spoofing
Move set_inverse_instance to association.build_record
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/CHANGELOG.md | 8 | ||||
| -rw-r--r-- | actionpack/lib/action_dispatch/middleware/remote_ip.rb | 2 |
2 files changed, 9 insertions, 1 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index 906592874d..31136d91b3 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -1,5 +1,13 @@ ## unreleased ## +* Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing + attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set. + + Fixes #12410 + Backports #10844 + + *Tamir Duberstein* + * Fix the assert_recognizes test method so that it works when there are constraints on the querystring. diff --git a/actionpack/lib/action_dispatch/middleware/remote_ip.rb b/actionpack/lib/action_dispatch/middleware/remote_ip.rb index 66ece60860..f4545bd95e 100644 --- a/actionpack/lib/action_dispatch/middleware/remote_ip.rb +++ b/actionpack/lib/action_dispatch/middleware/remote_ip.rb @@ -49,7 +49,7 @@ module ActionDispatch forwarded_ips = ips_from('HTTP_X_FORWARDED_FOR') remote_addrs = ips_from('REMOTE_ADDR') - check_ip = client_ip && @middleware.check_ip + check_ip = client_ip && forwarded_ips.present? && @middleware.check_ip if check_ip && !forwarded_ips.include?(client_ip) # We don't know which came from the proxy, and which from the user raise IpSpoofAttackError, "IP spoofing attack?!" \ |