kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Added security notice to Request#remote_ip underlining the fact that its value can be spoofed (and that you should use Request#remote_addr if thats a concern for your application) [Adrian Holovaty]

Browse source 
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7502 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
This commit is contained in:
David Heinemeier Hansson 2007-09-17 11:12:10 +00:00
parent 7cb26b5d2d
commit 4e7dce7e40
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
actionpack/lib/action_controller/request.rb
View file

@ -119,6 +119,14 @@ module ActionController
# falling back to REMOTE_ADDR. HTTP_X_FORWARDED_FOR may be a comma-
# delimited list in the case of multiple chained proxies; the first is
# the originating IP.
#
# Security note: Be aware that since remote_ip will check regular HTTP headers,
# it can be tricked by anyone setting those manually. In other words, people can
# pose as whatever IP address they like to this method. That doesn't matter if
# all your doing is using IP addresses for statistical or geographical information,
# but if you want to, for example, limit access to an administrative area by IP,
# you should instead use Request#remote_addr, which can't be spoofed (but also won't
# survive proxy forwards).
def remote_ip
return @env['HTTP_CLIENT_IP'] if @env.include? 'HTTP_CLIENT_IP'