Req #66676 [NEW]: $_SERVER['REMOTE_ADDR'] insecure

From: hj at BridgeportContractor dot com Operating system: windows 7, x64 and *nix PHP version: 5.4.25 Package: Apache related Bug Type: Feature/Change Request Bug description:$_SERVER['REMOTE_ADDR'] insecure Description: ------------ REMOTE_ADDR is not to be trusted. Can you get the server's IP from the tcp exchange rather than from the http exchange? I recently logged '183.60..244.37' from $_SERVER['REMOTE_ADDR'] from an attack http request on my hosing server. This is clearly not a valid IP address. A little research and I have found that others too say to not trust REMOTE_ADDR from $_SERVER in php. I think PHP needs a trustworthy replacement, as this is the only way to log http accesses. See also: http://serverfault.com/questions/574239/double-dots-in-otherwise-valid-ip4-addreses-e-g-183-60-244-37/574245?noredirect=1#comment669478_574245 Thanks for all of your work guys. -- Edit bug report at https://bugs.php.net/bug.php?id=66676&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66676&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66676&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66676&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66676&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66676&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66676&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66676&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66676&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66676&r=support Expected behavior: https://bugs.php.net/fix.php?id=66676&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66676&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66676&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66676&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66676&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66676&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66676&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66676&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66676&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66676&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66676&r=mysqlcfg