cvs: php-bugs-web / vote.php /include functions.inc
| From: | Jacques Marneweck | Date: | Sat, 07 Aug 2004 09:29:39 +0000 |
| Subject: | cvs: php-bugs-web / vote.php /include functions.inc | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-25717@lists.php.net to get a copy of this message | ||
jacques Sat Aug 7 05:29:39 2004 EDT
Modified files:
/php-bugs-web/include functions.inc
/php-bugs-web vote.php
Log:
Commiting patch which fixes bug #29151.
http://cvs.php.net/diff.php/php-bugs-web/include/functions.inc?r1=1.127&r2=1.128&ty=u
Index: php-bugs-web/include/functions.inc
diff -u php-bugs-web/include/functions.inc:1.127 php-bugs-web/include/functions.inc:1.128
--- php-bugs-web/include/functions.inc:1.127 Tue Jul 13 17:51:25 2004
+++ php-bugs-web/include/functions.inc Sat Aug 7 05:29:39 2004
@@ -578,4 +578,42 @@
return array(" AND MATCH (bugdb.email,sdesc,ldesc) AGAINST ('" .
addslashes($search) . "')", $ignored);
}
+/* Figure out which IP the user is coming from avoiding RFC 1918 space */
+function get_real_ip () {
+ global $HTTP_X_FORWARDED_FOR, $REMOTE_ADDR;
+
+ $ip = false;
+
+ /**
+ * User is behind a proxy and check that we discard RFC1918 IP
+ * addresses if they are behind a proxy then only figure out which
+ * IP belongs to the user. Might not need any more hacking if
+ * there is a squid reverse proxy infront of apache.
+ */
+ if (!empty($HTTP_X_FORWARDED_FOR)) {
+ $ips = explode (", ", $HTTP_X_FORWARDED_FOR);
+ if ($ip) { array_unshift($ips, $ip); $ip = false; }
+ for ($i = 0; $i < count($ips); $i++) {
+ /**
+ * Skip RFC 1918 IP's 10.0.0.0/8, 172.16.0.0/12 and
+ * 192.168.0.0/16 -- jim kill me later with my regexp pattern
+ * below.
+ */
+ if (!eregi ("^(10|172\.16|192\.168)\.", $ips[$i])) {
+ if (version_compare(phpversion(), "5.0.0", ">=")) {
+ if (ip2long($ips[$i]) != false) {
+ $ip = $ips[$i];
+ break;
+ }
+ } else {
+ if (ip2long($ips[$i]) != -1) {
+ $ip = $ips[$i];
+ break;
+ }
+ }
+ }
+ }
+ }
+ return ($ip ? $ip : $REMOTE_ADDR);
+}
?>
http://cvs.php.net/diff.php/php-bugs-web/vote.php?r1=1.10&r2=1.11&ty=u
Index: php-bugs-web/vote.php
diff -u php-bugs-web/vote.php:1.10 php-bugs-web/vote.php:1.11
--- php-bugs-web/vote.php:1.10 Thu Aug 5 09:55:44 2004
+++ php-bugs-web/vote.php Sat Aug 7 05:29:39 2004
@@ -21,7 +21,7 @@
or die("Unable to connect to SQL server.");
@mysql_select_db("phpbugdb");
-$ip = ip2long($HTTP_X_FORWARDED_FOR ? $HTTP_X_FORWARDED_FOR : $REMOTE_ADDR);
+$ip = ip2long(get_real_ip());
// TODO: check if ip address has been banned. hopefully this will
// never need to be implemented.