J3 Issue ?
avatar twrhills
twrhills
11 Jul 2019

Steps to reproduce the issue

Install Joomla behind a reverse proxy which provides both remote_addr and http_x_forwarded_for headers.
Perform a login failure on /administrator
Check the /logs/error.php log

Expected result

To see the ip address from http_x_forwarded_for reported as the offending IP address.

Actual result

To see the ip address from remote_addr reported as the offending IP address.

System information (as much as possible)

N/A

Additional comments

Not 100% sure if this is a problem or not, I believe that if HTTP_X_FORWARDED_FOR is set this should be treated as overriding REMOTE_IP, this is not the case in the following file:

./libraries/src/Log/Logger/FormattedtextLogger.php

Here we see:

    protected function formatLine(LogEntry $entry)
    {
            // Set some default field values if not already set.
            if (!isset($entry->clientIP))
            {
                    // Check for proxies as well.
                    if (isset($_SERVER['REMOTE_ADDR']))
                    {
                            $entry->clientIP = $_SERVER['REMOTE_ADDR'];
                    }
                    elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
                    {
                            $entry->clientIP = $_SERVER['HTTP_X_FORWARDED_FOR'];
                    }
                    elseif (isset($_SERVER['HTTP_CLIENT_IP']))
                    {
                            $entry->clientIP = $_SERVER['HTTP_CLIENT_IP'];
                    }
            }

Votes

# of Users Experiencing Issue
1/1
Average Importance Score
3.00

avatar twrhills twrhills - open - 11 Jul 2019
avatar joomla-cms-bot joomla-cms-bot - labeled - 11 Jul 2019
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 11 Jul 2019

Guess J3

avatar franz-wohlkoenig franz-wohlkoenig - change - 11 Jul 2019
Labels Added: J3 Issue
avatar franz-wohlkoenig franz-wohlkoenig - labeled - 11 Jul 2019
avatar SharkyKZ
SharkyKZ - comment - 11 Jul 2019

Test PR #25520 please.

avatar franz-wohlkoenig franz-wohlkoenig - change - 11 Jul 2019
Status New Closed
Closed_Date 0000-00-00 00:00:00 2019-07-11 12:35:44
Closed_By franz-wohlkoenig
avatar franz-wohlkoenig franz-wohlkoenig - close - 11 Jul 2019
avatar franz-wohlkoenig
franz-wohlkoenig - comment - 11 Jul 2019

Closed as having Pull Request #25520

Add a Comment

Login with GitHub to post a comment