cvs: phpweb /include ip-to-country.inc

jacques Mon May 5 20:11:18 2003 EDT Modified files: /phpweb/include ip-to-country.inc Log: * Patched to really work with $_SERVER['HTTP_X_FORWARDED_FOR'] where the user uses a proxy and that proxy goes via n+1 proxies on the way to one of the php.net mirrors. * We also ignore RFC 1918 IP addresses that are listed in $_SERVER['HTTP_X_FORWARDED_FOR'] seeing that indicates the user is on a private network. Incase there are only RFC 1918 IP's in $_SERVER['HTTP_X_FORWARDED_FOR'] we use $_SERVER['REMOTE_ADDR'] Anyways I might have broken something I'll keep an eye on this before I head to bed. It's currently 02h10 GMT +0200 here. --jm Index: phpweb/include/ip-to-country.inc diff -u phpweb/include/ip-to-country.inc:1.6 phpweb/include/ip-to-country.inc:1.7 --- phpweb/include/ip-to-country.inc:1.6 Sun May 4 16:07:37 2003 +++ phpweb/include/ip-to-country.inc Mon May 5 20:11:18 2003 @@ -1,6 +1,6 @@ <?php // -*- C++ -*- -// $Id: ip-to-country.inc,v 1.6 2003/05/04 20:07:37 goba Exp $ +// $Id: ip-to-country.inc,v 1.7 2003/05/06 00:11:18 jacques Exp $ /* @@ -60,9 +60,28 @@ return TRUE; } - // User is behind a proxy + // User is behind a proxy and check that we discard RFC1918 IP addresses + // if they are behind a proxy then only figure out which IP belongs to the + // user. Might not need any more hackin if there is a squid reverse proxy + // infront of apache. if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { - $ipnum = (float) sprintf("%u", ip2long($_SERVER['HTTP_X_FORWARDED_FOR'])); + unset($ips); + unset($ip); + + // Put the IP's into an array which we shall work with shortly. + $ips = explode (", ", $_SERVER['HTTP_X_FORWARDED_FOR']); + + for ($i = 0; $i < count($ips); $i++) { + // Skip RFC 1918 IP's 10.0.0.0/8, 172.16.0.0/12 and + // 192.168.0.0/16 -- jim kill me later with my regexp pattern + // below. + if (!eregi ("^(10|172\.16|192\.168)\.", $ips[$i])) { + $ip = $ips[$i]; + break; + } + } + + $ipnum = (float) sprintf("%u", ip2long(($ip ? $ip : $_SERVER['REMOTE_ADDR']))); } // This is the real IP of the user @@ -174,3 +193,5 @@ global $COUNTRY; return (!empty($COUNTRY) && $COUNTRY != "NA"); } + +/* vim: set noet ts=4 sw=4 ft=php: : */