Changeset 598 for trunk/lib

Timestamp:

Apr 27, 2017 2:56:05 PM (7 years ago)

Author:

anonymous

Message:

Strip non-IP address data from proxy-server-provided IP addresses (e.g., 'for=189.211.197.173'). Fix bug with mispelt referer variable.

File:

• trunk/lib/Utilities.inc.php (modified) (2 diffs)

trunk/lib/Utilities.inc.php

@@ -1261 +1261 @@
             if (array_key_exists($key, $_SERVER)) {
                 foreach (explode(',', $_SERVER[$key]) as $addr) {
+                    // Strip non-address data to avoid "PHP Warning:  inet_pton(): Unrecognized address for=189.211.197.173 in ./Utilities.inc.php on line 1293"
+                    $addr = preg_replace('/[^=]=/', '', $addr);
                     $addr = canonicalIPAddr(trim($addr));
                     if (false !== filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
@@ -1394 +1396 @@
 {
     $current_url = absoluteMe();
-    $referer_url = getenv('HTTP_REFERER');
+    $referrer_url = getenv('HTTP_REFERER');
 
     // If one of the hostnames is an IP address, compare only the path of both.
     if (preg_match('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', parse_url($current_url, PHP_URL_HOST)) || preg_match('/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/', parse_url($referrer_url, PHP_URL_HOST))) {
         $current_url = preg_replace('@^https?://[^/]+@', '', $current_url);
-        $referer_url = preg_replace('@^https?://[^/]+@', '', $referer_url);
+        $referrer_url = preg_replace('@^https?://[^/]+@', '', $referrer_url);
     }
 
     if ($exclude_query) {
-        return (stripQuery($current_url) == stripQuery($referer_url));
+        return (stripQuery($current_url) == stripQuery($referrer_url));
     } else {
         $app =& App::getInstance();
-        $app->logMsg(sprintf('refererIsMe comparison: %s == %s', $current_url, $referer_url), LOG_DEBUG, __FILE__, __LINE__);
-        return ($current_url == $referer_url);
+        $app->logMsg(sprintf('refererIsMe comparison: %s == %s', $current_url, $referrer_url), LOG_DEBUG, __FILE__, __LINE__);
+        return ($current_url == $referrer_url);
     }
 }