From 8a30afc2f8e4e473d791ae003cb179fd50a6e7ff Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 30 Apr 2025 11:16:09 -0400 Subject: [PATCH] Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t --- C4/Context.pm | 3 ++- Koha/Middleware/RealIP.pm | 5 +++-- .../data/mysql/atomicupdate/bug_39789.pl | 20 +++++++++++++++++++ .../en/modules/admin/preferences/admin.pref | 5 +++++ 4 files changed, 30 insertions(+), 3 deletions(-) create mode 100755 installer/data/mysql/atomicupdate/bug_39789.pl diff --git a/C4/Context.pm b/C4/Context.pm index 4968a001bbe..d964b507629 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -867,7 +867,8 @@ variable to be set correctly. sub set_remote_address { if ( C4::Context->config('koha_trusted_proxies') ) { require CGI; - my $header = CGI->http('HTTP_X_FORWARDED_FOR'); + my $ReverseProxyIpHeader = C4::Context->preference('ReverseProxyIpHeader'); + my $header = CGI->http($ReverseProxyIpHeader); if ($header) { require Koha::Middleware::RealIP; diff --git a/Koha/Middleware/RealIP.pm b/Koha/Middleware/RealIP.pm index 3df5bc0f83b..be5c5c61e63 100644 --- a/Koha/Middleware/RealIP.pm +++ b/Koha/Middleware/RealIP.pm @@ -51,11 +51,12 @@ sub call { my $self = shift; my $env = shift; - if ( $env->{HTTP_X_FORWARDED_FOR} ) { + my $ReverseProxyIpHeader = C4::Context->preference('ReverseProxyIpHeader'); + if ( $ReverseProxyIpHeader && $env->{$ReverseProxyIpHeader} ) { my @trusted_proxy = $self->trusted_proxy ? @{ $self->trusted_proxy } : undef; if (@trusted_proxy) { - my $addr = get_real_ip( $env->{REMOTE_ADDR}, $env->{HTTP_X_FORWARDED_FOR}, \@trusted_proxy ); + my $addr = get_real_ip( $env->{REMOTE_ADDR}, $env->{$ReverseProxyIpHeader}, \@trusted_proxy ); $ENV{REMOTE_ADDR} = $addr; $env->{REMOTE_ADDR} = $addr; } diff --git a/installer/data/mysql/atomicupdate/bug_39789.pl b/installer/data/mysql/atomicupdate/bug_39789.pl new file mode 100755 index 00000000000..eccf377e44a --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_39789.pl @@ -0,0 +1,20 @@ +use Modern::Perl; +use Koha::Installer::Output qw(say_warning say_success say_info); + +return { + bug_number => "29789", + description => "Add new system preference ReverseProxyIpHeader", + up => sub { + my ($args) = @_; + my ( $dbh, $out ) = @$args{qw(dbh out)}; + + my $rv = $dbh->do( + q{ + INSERT IGNORE INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `type` ) + VALUES ('ReverseProxyIpHeader','HTTP_X_FORWARDED_FOR',NULL,'Header environment variable ','free') + } + ); + + say $out "Added new system preference 'ReverseProxyIpHeader'"; + }, +}; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index 18d21a955a1..3dfb3b69044 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -107,6 +107,11 @@ Administration: 1: "Yes" 0: "No" - (Disable only when remote IP address changes frequently.) + - + - Look in the header + - pref: ReverseProxyIpHeader + class: url + - for IP addresses that http requests have been forwarded from. - - "Set logged in library for staff by matching their current IP to the library configuration: " - pref: StaffLoginLibraryBasedOnIP -- 2.39.5 (Apple Git-154)