diff options
| -rw-r--r-- | system/core/Input.php | 25 | ||||
| -rw-r--r-- | user_guide_src/source/changelog.rst | 2 |
2 files changed, 25 insertions, 2 deletions
diff --git a/system/core/Input.php b/system/core/Input.php index 162e40c85..968a42a9a 100644 --- a/system/core/Input.php +++ b/system/core/Input.php @@ -330,10 +330,33 @@ class CI_Input { if (config_item('proxy_ips') != '' && $this->server('HTTP_X_FORWARDED_FOR') && $this->server('REMOTE_ADDR')) { + $has_ranges = strpos($proxies, '/') !== false; $proxies = preg_split('/[\s,]/', config_item('proxy_ips'), -1, PREG_SPLIT_NO_EMPTY); $proxies = is_array($proxies) ? $proxies : array($proxies); + + if ($has_ranges) + { + $long_ip = ip2long($_SERVER['REMOTE_ADDR']); + $bit_32 = 1 << 32; + + // Go through each of the IP Addresses to check for and + // test against range notation + foreach($proxies as $ip) + { + list($address, $mask_length) = explode('/', $ip); + + // Generate the bitmask for a 32 bit IP Address + $bitmask = $bit_32 - (1 << (32 - (int)$mask_length)); + if (($long_ip & $bitmask) == $address) + { + $this->ip_address = $_SERVER['HTTP_X_FORWARDED_FOR']; + break; + } + } - $this->ip_address = in_array($_SERVER['REMOTE_ADDR'], $proxies) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; + } else { + $this->ip_address = in_array($_SERVER['REMOTE_ADDR'], $proxies) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; + } } elseif ( ! $this->server('HTTP_CLIENT_IP') && $this->server('REMOTE_ADDR')) { diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst index 625127e2a..7f428e5db 100644 --- a/user_guide_src/source/changelog.rst +++ b/user_guide_src/source/changelog.rst @@ -205,7 +205,7 @@ Release Date: Not Released - Changed :doc:`Config Library <libraries/config>` method site_url() to accept an array as well. - Added method ``strip_image_tags()`` to the :doc:`Security Library <libraries/security>`. - Changed ``_exception_handler()`` to respect php.ini 'display_errors' setting. - + - Added support for IPv4 range masks (e.g. 192.168.1.1/24) to specify ranges of IP addresses for use with the proxy_ips setting. Bug fixes for 3.0 ------------------ |