Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Merge branch '3-2-stable' into 3-2-sec

* 3-2-stable:
  make sure both headers are set before checking for ip spoofing
  Move set_inverse_instance to association.build_record
  • Loading branch information...
commit befeeb2d0aef8db4ba84d1e2fa0d273f8a111363 2 parents 5aee516 + 83c4b0a
Aaron Patterson tenderlove authored
8 actionpack/CHANGELOG.md
View
@@ -1,5 +1,13 @@
## unreleased ##
+* Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing
+ attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set.
+
+ Fixes #12410
+ Backports #10844
+
+ *Tamir Duberstein*
+
* Fix the assert_recognizes test method so that it works when there are
constraints on the querystring.
2  actionpack/lib/action_dispatch/middleware/remote_ip.rb
View
@@ -49,7 +49,7 @@ def calculate_ip
forwarded_ips = ips_from('HTTP_X_FORWARDED_FOR')
remote_addrs = ips_from('REMOTE_ADDR')
- check_ip = client_ip && @middleware.check_ip
+ check_ip = client_ip && forwarded_ips.present? && @middleware.check_ip
if check_ip && !forwarded_ips.include?(client_ip)
# We don't know which came from the proxy, and which from the user
raise IpSpoofAttackError, "IP spoofing attack?!" \
6 activerecord/CHANGELOG.md
View
@@ -1,4 +1,10 @@
## unreleased ##
+* Move .set_inverse_instance call to association.build_record method. Everytime a new record is build
+ using the association, we need to try to set the inverse_of relation.
+
+ Fixes #10371.
+
+ *arthurnn*
* When calling the method .find_or_initialize_by_* from a collection_proxy
it should set the inverse_of relation even when the entry was found on the db.
1  activerecord/lib/active_record/associations/association.rb
View
@@ -240,6 +240,7 @@ def build_record(attributes, options)
skip_assign = [reflection.foreign_key, reflection.type].compact
attributes = create_scope.except(*(record.changed - skip_assign))
record.assign_attributes(attributes, :without_protection => true)
+ set_inverse_instance(record)
end
end
end
1  activerecord/lib/active_record/associations/collection_association.rb
View
@@ -350,7 +350,6 @@ def add_to_target(record)
end
callback(:after_add, record)
- set_inverse_instance(record)
record
end
4 activerecord/test/cases/associations/inverse_associations_test.rb
View
@@ -125,8 +125,10 @@ def test_parent_instance_should_be_shared_with_newly_built_child
end
def test_parent_instance_should_be_shared_with_newly_created_child
- m = Man.find(:first)
+ m = Man.create
f = m.create_face(:description => 'haunted')
+
+ assert_equal m.object_id, f.man.object_id
assert_not_nil f.man
assert_equal m.name, f.man.name, "Name of man should be the same before changes to parent instance"
m.name = 'Bongo'
10 railties/test/application/middleware/remote_ip_test.rb
View
@@ -46,6 +46,16 @@ def remote_ip(env = {})
end
end
+ test "works with both headers individually" do
+ make_basic_app
+ assert_nothing_raised(ActionDispatch::RemoteIp::IpSpoofAttackError) do
+ assert_equal "1.1.1.1", remote_ip("HTTP_X_FORWARDED_FOR" => "1.1.1.1")
+ end
+ assert_nothing_raised(ActionDispatch::RemoteIp::IpSpoofAttackError) do
+ assert_equal "1.1.1.2", remote_ip("HTTP_CLIENT_IP" => "1.1.1.2")
+ end
+ end
+
test "can disable IP spoofing check" do
make_basic_app do |app|
app.config.action_dispatch.ip_spoofing_check = false
Please sign in to comment.
Something went wrong with that request. Please try again.