Request#remote_ip handles the uncommon case that REMOTE_ADDR is a com…

…ma-separated list. [#523 state:resolved] Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net>
rails · Aug 28, 2008 · e21ed3e · e21ed3e
1 parent b23b191
commit e21ed3e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/actionpack/lib/action_controller/request.rb b/actionpack/lib/action_controller/request.rb
@@ -135,10 +135,12 @@ def xml_http_request?
     # delimited list in the case of multiple chained proxies; the last
     # address which is not trusted is the originating IP.
     def remote_ip
-      if TRUSTED_PROXIES !~ @env['REMOTE_ADDR']
-        return @env['REMOTE_ADDR']
-      end
+      remote_addr_list = @env['REMOTE_ADDR'] && @env['REMOTE_ADDR'].split(',').collect(&:strip)
 
+      unless remote_addr_list.blank?
+        not_trusted_addrs = remote_addr_list.reject {|addr| addr =~ TRUSTED_PROXIES}
+        return not_trusted_addrs.first unless not_trusted_addrs.empty?
+      end
       remote_ips = @env['HTTP_X_FORWARDED_FOR'] && @env['HTTP_X_FORWARDED_FOR'].split(',')
 
       if @env.include? 'HTTP_CLIENT_IP'

diff --git a/actionpack/test/controller/request_test.rb b/actionpack/test/controller/request_test.rb
@@ -12,6 +12,9 @@ def test_remote_ip
     @request.remote_addr = '1.2.3.4'
     assert_equal '1.2.3.4', @request.remote_ip
 
+    @request.remote_addr = '1.2.3.4,3.4.5.6'
+    assert_equal '1.2.3.4', @request.remote_ip(true)
+
     @request.env['HTTP_CLIENT_IP'] = '2.3.4.5'
     assert_equal '1.2.3.4', @request.remote_ip