From fb6a1d00f71bc8bee86c7530a3fcbafae73958a0 Mon Sep 17 00:00:00 2001
From: KubaPro010 <kuba.pro010@gmail.com>
Date: Sat, 21 Mar 2026 15:24:01 +0100
Subject: [PATCH] localhost

---
 server/helpers.js | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/server/helpers.js b/server/helpers.js
index caab540..3b25622 100644
--- a/server/helpers.js
+++ b/server/helpers.js
@@ -343,17 +343,32 @@ function findServerFiles(plugins) {
   return results;
 }
 
+function normalizeIp(ip) {
+  if(ip && ip.startsWith('::ffff:')) return ip.substring(7);
+  return ip;
+}
+
+function isLocalhost(ip) {
+  const normalized = normalizeIp(ip);
+  return normalized === '127.0.0.1' || normalized === '::1';
+}
+
+function isTrustedProxy(ip) {
+  return serverConfig.trustedProxies.includes(normalizeIp(ip));
+}
+
 function getIpAddress(request) {
-  const remoteIp = request.socket.remoteAddress;
+  const remoteIpRaw = request.socket.remoteAddress;
+  const remoteIp = normalizeIp(remoteIpRaw);
   const xff = request.headers['x-forwarded-for'];
 
-  // If X-Forwarded-For is present but request is NOT from a trusted proxy → suspicious
-  if (xff && !serverConfig.trustedProxies.includes(remoteIp)) {
-    consoleCmd.logSecurity(`Untrusted proxy tried to set X-Forwarded-For: ${xff} (remote: ${remoteIp})`);
+  if (xff && !isLocalhost(remoteIp) && !isTrustedProxy(remoteIp)) {
+    consoleCmd.logSecurity(`Untrusted proxy tried to set X-Forwarded-For: ${xff} (remote: ${remoteIpRaw})`);
     return remoteIp;
   }
 
-  if (xff && serverConfig.trustedProxies.includes(remoteIp)) return xff.split(',')[0].trim();
+  if (xff) return normalizeIp(xff.split(',')[0].trim());
+
   return remoteIp;
 }