don't call getTrustedHeaderName() if possible

symfony · May 23, 2017 · 6350dab · 6350dab
1 parent aef39bc
commit 6350dab
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Symfony/Component/HttpKernel/Fragment/InlineFragmentRenderer.php b/src/Symfony/Component/HttpKernel/Fragment/InlineFragmentRenderer.php
@@ -119,7 +119,11 @@ protected function createSubRequest($uri, Request $request)
         // Sub-request object will point to localhost as client ip and real client ip
         // will be included into trusted header for client ip
         try {
-            if ($trustedHeaderName = Request::getTrustedHeaderName(Request::HEADER_CLIENT_IP, false)) {
+            if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
+                $currentXForwardedFor = $request->headers->get('X_FORWARDED_FOR', '');
+
+                $server['HTTP_X_FORWARDED_FOR'] = ($currentXForwardedFor ? $currentXForwardedFor.', ' : '').$request->getClientIp();
+            } elseif (method_exists(Request::class, 'getTrustedHeaderName') && $trustedHeaderName = Request::getTrustedHeaderName(Request::HEADER_CLIENT_IP, false)) {
                 $currentXForwardedFor = $request->headers->get($trustedHeaderName, '');
 
                 $server['HTTP_'.$trustedHeaderName] = ($currentXForwardedFor ? $currentXForwardedFor.', ' : '').$request->getClientIp();