diff options
Diffstat (limited to 'app')
| -rw-r--r-- | app/Controllers/authController.php | 2 | ||||
| -rw-r--r-- | app/install.php | 11 |
2 files changed, 9 insertions, 4 deletions
diff --git a/app/Controllers/authController.php b/app/Controllers/authController.php index 8feebe9a3..90c9a9e03 100644 --- a/app/Controllers/authController.php +++ b/app/Controllers/authController.php @@ -79,7 +79,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController { 'error' => [ _t('feedback.access.denied'), ' [HTTP Remote-User=' . htmlspecialchars(httpAuthUser(false), ENT_NOQUOTES, 'UTF-8') . - ' ; Remote IP address=' . ($_SERVER['REMOTE_ADDR'] ?? '') . ']' + ' ; Remote IP address=' . connectionRemoteAddress() . ']' ] ], false); break; diff --git a/app/install.php b/app/install.php index 873689054..b42771fbb 100644 --- a/app/install.php +++ b/app/install.php @@ -208,9 +208,14 @@ function saveStep3(): bool { return false; } - if (FreshRSS_Context::$system_conf->auth_type === 'http_auth' && !empty($_SERVER['REMOTE_ADDR']) && is_string($_SERVER['REMOTE_ADDR'])) { - // Trust by default the remote IP address (e.g. proxy) used during install to provide remote user name - FreshRSS_Context::$system_conf->trusted_sources = [ $_SERVER['REMOTE_ADDR'] ]; + if (FreshRSS_Context::$system_conf->auth_type === 'http_auth' && + connectionRemoteAddress() !== '' && + empty($_SERVER['REMOTE_USER']) && empty($_SERVER['REDIRECT_REMOTE_USER']) && // No safe authentication HTTP headers + (!empty($_SERVER['HTTP_REMOTE_USER']) || !empty($_SERVER['HTTP_X_WEBAUTH_USER'])) // but has unsafe authentication HTTP headers + ) { + // Trust by default the remote IP address (e.g. last proxy) used during install to provide remote user name via unsafe HTTP header + FreshRSS_Context::$system_conf->trusted_sources[] = connectionRemoteAddress(); + FreshRSS_Context::$system_conf->trusted_sources = array_unique(FreshRSS_Context::$system_conf->trusted_sources); } // Create default user files but first, we delete previous data to |