Add trusted IPs in config and try to ban forwarded IP on failed login

[github/shaarli/Shaarli.git] / application / HttpUtils.php

diff --git a/application/HttpUtils.php b/application/HttpUtils.php
index c84ba6f05746d404b195607715556a67ccce8eba..354d261c4a43b7f0b0b55e5a1acf703b038fbf77 100644 (file)
--- a/application/HttpUtils.php
+++ b/application/HttpUtils.php
@@ -193,7 +193,7 @@ function server_url($server)
 function index_url($server)
 {
     $scriptname = $server['SCRIPT_NAME'];
-    if (endswith($scriptname, 'index.php')) {
+    if (endsWith($scriptname, 'index.php')) {
         $scriptname = substr($scriptname, 0, -9);
     }
     return server_url($server) . $scriptname;
@@ -215,3 +215,29 @@ function page_url($server)
     }
     return index_url($server);
 }
+
+/**
+ * Retrieve the initial IP forwarded by the reverse proxy.
+ *
+ * Inspired from: https://github.com/zendframework/zend-http/blob/master/src/PhpEnvironment/RemoteAddress.php
+ *
+ * @param array $server     $_SERVER array which contains HTTP headers.
+ * @param array $trustedIps List of trusted IP from the configuration.
+ *
+ * @return string|bool The forwarded IP, or false if none could be extracted.
+ */
+function getIpAddressFromProxy($server, $trustedIps)
+{
+    $forwardedIpHeader = 'HTTP_X_FORWARDED_FOR';
+    if (empty($server[$forwardedIpHeader])) {
+        return false;
+    }
+
+    $ips = preg_split('/\s*,\s*/', $server[$forwardedIpHeader]);
+    $ips = array_diff($ips, $trustedIps);
+    if (empty($ips)) {
+        return false;
+    }
+
+    return array_pop($ips);
+}