View | Details | Raw Unified | Return to bug 39789
Collapse All | Expand All

(-)a/C4/Context.pm (-1 / +6 lines)
Lines 880-886 variable to be set correctly. Link Here
880
sub set_remote_address {
880
sub set_remote_address {
881
    if ( C4::Context->config('koha_trusted_proxies') ) {
881
    if ( C4::Context->config('koha_trusted_proxies') ) {
882
        require CGI;
882
        require CGI;
883
        my $header = CGI->http('HTTP_X_FORWARDED_FOR');
883
884
        # If no reverse_proxy_ip_header, just use HTTP_X_FORWARDED_FOR as the header to check, simplifies logic and is a bit faster that way
885
        my $reverse_proxy_ip_header = C4::Context->config('reverse_proxy_ip_header') || 'HTTP_X_FORWARDED_FOR';
886
887
        # Check the cgi for the custom header, if the custom header is not set, fall back to HTTP_X_FORWARDED_FOR
888
        my $header = CGI->http($reverse_proxy_ip_header) || CGI->http('HTTP_X_FORWARDED_FOR');
884
889
885
        if ($header) {
890
        if ($header) {
886
            require Koha::Middleware::RealIP;
891
            require Koha::Middleware::RealIP;
(-)a/Koha/Middleware/RealIP.pm (-8 / +12 lines)
Lines 51-64 sub call { Link Here
51
    my $self = shift;
51
    my $self = shift;
52
    my $env  = shift;
52
    my $env  = shift;
53
53
54
    if ( $env->{HTTP_X_FORWARDED_FOR} ) {
54
    # If no reverse_proxy_ip_header, just use HTTP_X_FORWARDED_FOR as the header to check, simplifies logic and is a bit faster that way
55
        my @trusted_proxy = $self->trusted_proxy ? @{ $self->trusted_proxy } : undef;
55
    my $reverse_proxy_ip_header = C4::Context->config('reverse_proxy_ip_header') || 'HTTP_X_FORWARDED_FOR';
56
56
57
        if (@trusted_proxy) {
57
    # Check the env for the custom header, if the custom header is not set, fall back to HTTP_X_FORWARDED_FOR
58
            my $addr = get_real_ip( $env->{REMOTE_ADDR}, $env->{HTTP_X_FORWARDED_FOR}, \@trusted_proxy );
58
    my $header = $env->{$reverse_proxy_ip_header} || $env->{'HTTP_X_FORWARDED_FOR'};
59
            $ENV{REMOTE_ADDR} = $addr;
59
    if ($header) {
60
            $env->{REMOTE_ADDR} = $addr;
60
        my $addr = get_real_ip( $env->{REMOTE_ADDR}, $header );
61
        }
61
        $ENV{REMOTE_ADDR} = $addr;
62
        $env->{REMOTE_ADDR} = $addr;
62
    }
63
    }
63
64
64
    return $self->app->($env);
65
    return $self->app->($env);
Lines 76-81 determines the correct external ip address, and returns it. Link Here
76
sub get_real_ip {
77
sub get_real_ip {
77
    my ( $remote_addr, $header ) = @_;
78
    my ( $remote_addr, $header ) = @_;
78
79
80
    my $enable_trusted_proxy_for_headers = C4::Context->config('enable_trusted_proxy_for_headers') // 1;
81
    return $remote_addr unless $enable_trusted_proxy_for_headers;
82
79
    my @forwarded_for = $header =~ /([^,\s]+)/g;
83
    my @forwarded_for = $header =~ /([^,\s]+)/g;
80
    return $remote_addr unless @forwarded_for;
84
    return $remote_addr unless @forwarded_for;
81
85
(-)a/debian/templates/koha-conf-site.xml.in (-1 / +3 lines)
Lines 341-348 __END_SRU_PUBLICSERVER__ Link Here
341
 <plack_workers>2</plack_workers>
341
 <plack_workers>2</plack_workers>
342
342
343
 <!-- Configuration for X-Forwarded-For -->
343
 <!-- Configuration for X-Forwarded-For -->
344
 <!-- Set enable_trusted_proxy_for_headers to 0 to never trust proxy headers, always use given REMOTE_ADDRESS -->
344
 <!--
345
 <!--
345
 <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies>
346
 <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies>
347
 <reverse_proxy_ip_header>HTTP_X_FORWARDED_FOR</reverse_proxy_ip_header>
348
 <enable_trusted_proxy_for_headers>1</enable_trusted_proxy_for_headers>
346
 -->
349
 -->
347
350
348
 <!-- Elasticsearch Configuration -->
351
 <!-- Elasticsearch Configuration -->
349
- 

Return to bug 39789