Fix X-Forwarded-For not supported properly

[davidglezz]

Questions	Answers
Branch?	develop
Description?	Range must be 172.16/12 instead of 172.16/16 (https://tools.ietf.org/html/rfc1918#section-3)
Type?	bug fix
Category?	CO
BC breaks?	no
Deprecations?	no
Fixed ticket?	Fixes #13074.
How to test?	No need QA, it's related to server configuration.

Some tests

172.15.255.255 -> use REMOTE_ADDR
172.16.0.0    ->  use HTTP_X_FORWARDED_FOR
172.16.255.255 -> use HTTP_X_FORWARDED_FOR
172.22.255.0  ->  use HTTP_X_FORWARDED_FOR
172.31.0.0   ->   use HTTP_X_FORWARDED_FOR
172.31.255.255 -> use HTTP_X_FORWARDED_FOR
172.32.0.0   ->   use REMOTE_ADDR

---

This change is 

[PierreRambaud]

Unfortunately there is no unit tests for this method, can you add them?

[davidglezz]

No, sorry, 0 experience doing test. I know I should know.

[PierreRambaud]

So, we need a better scenario to test 😅

[davidglezz]

I only modify the behavior for 172 range.

Before: preg_match('/^172\.16.*/i', ..)

• 172.16.x.x → true → use HTTP_X_FORWARDED_FOR ✅
• 172.16x.x.x → true → use HTTP_X_FORWARDED_FOR ❌
• 172.17.x.x to 172.31.x.x → false → use REMOTE_ADDR ❌

After: preg_match('/^172\.(1[6-9]|2\d|30|31)\..*/i', ..)

• 172.16.x.x to 172.31.x.x → true → use HTTP_X_FORWARDED_FOR ✅
• 172.x.x.x but not in 172.16.x.x to 172.31.x.x → false → use REMOTE_ADDR ✅

[PierreRambaud]

On more review and merge without QA.

[PierreRambaud]

Thanks @davidglezz

[Jogai]

Is there a way I can convince people to cherry pick this in an earlier release?

[PierreRambaud]

Is there a way I can convince people to cherry pick this in an earlier release?

You should contact an agency or a freelance to do it for you 😉

[Jogai]

I'm a freelancer, and I'm comfortable with git, but I'm guessing its generally not accepted to make a pull request against a release branch.

[PierreRambaud]

No it will not be accepted ^^ We are only working on the develop branch. You will have to wait for the 1.7.8.0 if you need this fix.