jenkins-bot has submitted this change and it was merged.
Change subject: Detect invalid IPs in XFFs and give a more useful error message
......................................................................
Detect invalid IPs in XFFs and give a more useful error message
* This will only error out if we are stuck with a CDN or site proxy IP
Bug: 54288
Change-Id: Ib81e06527c2f7a8d9c288b56c0f46610a4517f74
---
M includes/WebRequest.php
1 file changed, 11 insertions(+), 4 deletions(-)
Approvals:
CSteipp: Looks good to me, approved
jenkins-bot: Verified
diff --git a/includes/WebRequest.php b/includes/WebRequest.php
index 23eee04..b17cb9e 100644
--- a/includes/WebRequest.php
+++ b/includes/WebRequest.php
@@ -1144,10 +1144,17 @@
foreach ( $ipchain as $i => $curIP ) {
$curIP = IP::sanitizeIP( IP::canonicalize(
$curIP ) );
if ( wfIsTrustedProxy( $curIP ) && isset(
$ipchain[$i + 1] ) ) {
- if ( wfIsConfiguredProxy( $curIP ) ||
// bug 48919
- ( IP::isPublic( $ipchain[$i +
1] ) || $wgUsePrivateIPs )
+ if ( wfIsConfiguredProxy( $curIP ) ||
// bug 48919; treat IP as sane
+ IP::isPublic( $ipchain[$i + 1]
) ||
+ $wgUsePrivateIPs
) {
- $ip = IP::canonicalize(
$ipchain[$i + 1] );
+ $nextIP = IP::canonicalize(
$ipchain[$i + 1] );
+ if ( !$nextIP &&
wfIsConfiguredProxy( $ip ) ) {
+ // We have not yet made
it past CDN/proxy servers of this site,
+ // so either they are
misconfigured or there is some IP spoofing.
+ throw new MWException(
"Invalid IP given in XFF '$forwardedFor'." );
+ }
+ $ip = $nextIP;
continue;
}
}
@@ -1159,7 +1166,7 @@
wfRunHooks( 'GetIP', array( &$ip ) );
if ( !$ip ) {
- throw new MWException( "Unable to determine IP" );
+ throw new MWException( "Unable to determine IP." );
}
wfDebug( "IP: $ip\n" );
--
To view, visit https://gerrit.wikimedia.org/r/84866
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ib81e06527c2f7a8d9c288b56c0f46610a4517f74
Gerrit-PatchSet: 5
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Aaron Schulz <[email protected]>
Gerrit-Reviewer: Aaron Schulz <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: Daniel Friesen <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
