Bugzilla – Attachment 188380 Details for
Bug 39789
Add ability to specify an alternative header to X-Forwarded-For for finding the real IP address
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address
a6cc22d.patch (text/plain), 4.05 KB, created by
Kyle M Hall (khall)
on 2025-10-23 17:00:56 UTC
(
hide
)
Description:
Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2025-10-23 17:00:56 UTC
Size:
4.05 KB
patch
obsolete
>From a6cc22d845b1395c3ac53d288604d771a07d7a9a Mon Sep 17 00:00:00 2001 >From: Kyle M Hall <kyle@bywatersolutions.com> >Date: Wed, 30 Apr 2025 11:16:09 -0400 >Subject: [PATCH] Bug 39789: Add ability to specify an alternative header to > X-Forwarded-For for finding the real ip address > >Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. > >This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously > >For example, CloudFlare has it's own custom header. >This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. > >Test Plan: >1) prove t/Koha/Middleware/RealIP.t > >Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> >--- > C4/Context.pm | 7 ++++++- > Koha/Middleware/RealIP.pm | 20 ++++++++++++-------- > debian/templates/koha-conf-site.xml.in | 2 ++ > 3 files changed, 20 insertions(+), 9 deletions(-) > >diff --git a/C4/Context.pm b/C4/Context.pm >index 78602055164..752101ab23f 100644 >--- a/C4/Context.pm >+++ b/C4/Context.pm >@@ -880,7 +880,12 @@ variable to be set correctly. > sub set_remote_address { > if ( C4::Context->config('koha_trusted_proxies') ) { > require CGI; >- my $header = CGI->http('HTTP_X_FORWARDED_FOR'); >+ >+ # If no reverse_proxy_ip_header, just use HTTP_X_FORWARDED_FOR as the header to check, simplifies logic and is a bit faster that way >+ my $reverse_proxy_ip_header = C4::Context->config('reverse_proxy_ip_header') || 'HTTP_X_FORWARDED_FOR'; >+ >+ # Check the cgi for the custom header, if the custom header is not set, fall back to HTTP_X_FORWARDED_FOR >+ my $header = CGI->http($reverse_proxy_ip_header) || CGI->http('HTTP_X_FORWARDED_FOR'); > > if ($header) { > require Koha::Middleware::RealIP; >diff --git a/Koha/Middleware/RealIP.pm b/Koha/Middleware/RealIP.pm >index 352f484ea26..c33a3de76ff 100644 >--- a/Koha/Middleware/RealIP.pm >+++ b/Koha/Middleware/RealIP.pm >@@ -51,14 +51,15 @@ sub call { > my $self = shift; > my $env = shift; > >- if ( $env->{HTTP_X_FORWARDED_FOR} ) { >- my @trusted_proxy = $self->trusted_proxy ? @{ $self->trusted_proxy } : undef; >- >- if (@trusted_proxy) { >- my $addr = get_real_ip( $env->{REMOTE_ADDR}, $env->{HTTP_X_FORWARDED_FOR}, \@trusted_proxy ); >- $ENV{REMOTE_ADDR} = $addr; >- $env->{REMOTE_ADDR} = $addr; >- } >+ # If no reverse_proxy_ip_header, just use HTTP_X_FORWARDED_FOR as the header to check, simplifies logic and is a bit faster that way >+ my $reverse_proxy_ip_header = C4::Context->config('reverse_proxy_ip_header') || 'HTTP_X_FORWARDED_FOR'; >+ >+ # Check the env for the custom header, if the custom header is not set, fall back to HTTP_X_FORWARDED_FOR >+ my $header = $env->{$reverse_proxy_ip_header} || $env->{'HTTP_X_FORWARDED_FOR'}; >+ if ($header) { >+ my $addr = get_real_ip( $env->{REMOTE_ADDR}, $header ); >+ $ENV{REMOTE_ADDR} = $addr; >+ $env->{REMOTE_ADDR} = $addr; > } > > return $self->app->($env); >@@ -76,6 +77,9 @@ determines the correct external ip address, and returns it. > sub get_real_ip { > my ( $remote_addr, $header ) = @_; > >+ my $require_trusted = C4::Context->config('require_trusted_proxy_for_headers') // 1; >+ return $remote_addr unless $require_trusted; >+ > my @forwarded_for = $header =~ /([^,\s]+)/g; > return $remote_addr unless @forwarded_for; > >diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in >index 0e07af36d8f..3d9525fc424 100644 >--- a/debian/templates/koha-conf-site.xml.in >+++ b/debian/templates/koha-conf-site.xml.in >@@ -343,6 +343,8 @@ __END_SRU_PUBLICSERVER__ > <!-- Configuration for X-Forwarded-For --> > <!-- > <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies> >+ <reverse_proxy_ip_header>HTTP_X_FORWARDED_FOR</reverse_proxy_ip_header> >+ <require_trusted_proxy_for_headers>1</require_trusted_proxy_for_headers> > --> > > <!-- Elasticsearch Configuration --> >-- >2.50.1 (Apple Git-155)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39789
:
181718
|
181720
|
181915
|
181916
|
181917
|
181918
|
181919
|
181920
|
181921
|
182299
|
182300
|
182395
|
182396
|
182397
|
182841
|
182842
|
182843
|
182844
|
182846
|
182847
|
182848
|
182849
|
183215
|
188379
|
188380
|
188381
|
188382
|
188383