From e7689459f25663e00b4f5814a3608872ff36b582 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sun, 30 Jul 2023 12:59:18 +0200 Subject: Rework trusted proxies (#5549) * Rework trusted proxies Fix https://github.com/FreshRSS/FreshRSS/issues/5502 Follow-up of https://github.com/FreshRSS/FreshRSS/pull/3226 New environment variable `TRUSTED_PROXY`: set to 0 to disable, or to a list of trusted IP ranges compatible with https://httpd.apache.org/docs/current/mod/mod_remoteip.html#remoteiptrustedproxy New internal environment variable `CONN_REMOTE_ADDR` to remember the true IP address of the connection (e.g. last proxy), even when using mod_remoteip. Current working setups should not observe any significant change. * Minor whitespace * Safer trusted sources during install Rework of https://github.com/FreshRSS/FreshRSS/pull/5358 https://github.com/FreshRSS/FreshRSS/issues/5357 * Minor readme --- app/install.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'app/install.php') diff --git a/app/install.php b/app/install.php index 873689054..b42771fbb 100644 --- a/app/install.php +++ b/app/install.php @@ -208,9 +208,14 @@ function saveStep3(): bool { return false; } - if (FreshRSS_Context::$system_conf->auth_type === 'http_auth' && !empty($_SERVER['REMOTE_ADDR']) && is_string($_SERVER['REMOTE_ADDR'])) { - // Trust by default the remote IP address (e.g. proxy) used during install to provide remote user name - FreshRSS_Context::$system_conf->trusted_sources = [ $_SERVER['REMOTE_ADDR'] ]; + if (FreshRSS_Context::$system_conf->auth_type === 'http_auth' && + connectionRemoteAddress() !== '' && + empty($_SERVER['REMOTE_USER']) && empty($_SERVER['REDIRECT_REMOTE_USER']) && // No safe authentication HTTP headers + (!empty($_SERVER['HTTP_REMOTE_USER']) || !empty($_SERVER['HTTP_X_WEBAUTH_USER'])) // but has unsafe authentication HTTP headers + ) { + // Trust by default the remote IP address (e.g. last proxy) used during install to provide remote user name via unsafe HTTP header + FreshRSS_Context::$system_conf->trusted_sources[] = connectionRemoteAddress(); + FreshRSS_Context::$system_conf->trusted_sources = array_unique(FreshRSS_Context::$system_conf->trusted_sources); } // Create default user files but first, we delete previous data to -- cgit v1.2.3