Tickets :: Comment on [#6133] don't blindly trust x-forwarded-for

* Your Email Address
* Spam protection	Enter the letters below: . . __ . . __..__ \ // `\|__\|(__ [__) \/ \__.\| \|.__)\| \
Comment	> I've removed the usage of X-forwarded-for when checking the safe_ips > list. The two other places we use it that aren't simply in log > messages are in Auth.php (last login info) and MIME_Headers (the > received: header). > > > > I'm guessing that the received header is the one you care about and > I'm inclined to agree; throwing out the proxy address there is > dubious because it's likely to be useful tracking information. What > do you think about including both (the REMOTE_ADDR value, and a > parenthetical that it was forwarded for the value of > HTTP_X_FORWARDED_FOR)?
Attachment
Watch this ticket