SMF
SMF copied to clipboard
SimpleMachines
Use reverse proxy IP for users
The real client IP is not used in $user_info. This causes incorrect behavior when used behind a reverse proxy. For example only one guest will be visible (as only the IP of the reverse proxy is used) and all logging is linked to that IP.
Again a small hotfix. A better aproach would be to use a proper getClientIP() function which processes the headers and checks for the reverse proxy IP.
Example: Symphony getClientIP()
This is the reason we have $user_info['ip'] and $user_info['ip2']. If incorrect stats/guests online are being detected because of a single ip, then we should be fixing that. In reality, guests online shouldn't be determined by their ip, but by their session. Some countries alone have a limited number of IPv4 and use what is essentially a CGNAT.
@MarcoCLA, please open an issue to describe in more detail the problem that this PR is meant to address.
What is the use-case of $user_info['ip'] in the current implementation ($_SERVER['REMOTE_ADDR'])?
If a forwarded ip is verified, I see no reason to use the REMOTE_ADDR instead of the validated forwarded ip.
Added to "The future" for further consideration. It will help a great deal if we are given a more fulsome description of the problem in a proper issue report.