Infra-Mirrors/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2025-06-24 22:50:43 -04:00
Code Issues Projects Releases Packages Wiki Activity

traffic limiter would fail behind a reverse proxy / load balancer.

Browse source 
Adding configuration option to set the trusted HTTP header to get the
visitors IP in such a case (avoiding security issue if malicious clients
just set these headers themselfs)
This commit is contained in:
El RIDO 2015-09-18 22:31:01 +02:00
parent 801cdc627e
commit 47efedf23c
2 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/zerobin.php
View file

@ -223,7 +223,16 @@ class zerobin
// Make sure last paste from the IP address was more than X seconds ago.
trafficlimiter::setLimit($this->_conf['traffic']['limit']);
trafficlimiter::setPath($this->_conf['traffic']['dir']);
if (!trafficlimiter::canPass($_SERVER['REMOTE_ADDR']))
$ipKey = 'REMOTE_ADDR';
if (array_key_exists('header', $this->_conf['traffic']))
{
$header = 'HTTP_' . $this->_conf['traffic']['header'];
if (array_key_exists($header, $_SERVER) && !empty($_SERVER[$header]))
{
$ipKey = $header;
}
}
if (!trafficlimiter::canPass($_SERVER[$ipKey]))
{
$this->_return_message(
1,