kuba/fm-dx-webserver
1
0
Fork 0
mirror of https://github.com/KubaPro010/fm-dx-webserver.git synced 2026-07-29 16:29:19 +02:00
Code Issues Activity

localhost

Browse Source
This commit is contained in:
kuba
2026-03-21 15:24:01 +01:00
parent f17e845c1d
commit fb6a1d00f7
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/helpers.js
+20 -5
View File
@@ -343,17 +343,32 @@ function findServerFiles(plugins) {
return results;
}
function normalizeIp(ip) {
if(ip && ip.startsWith('::ffff:')) return ip.substring(7);
return ip;
}
function isLocalhost(ip) {
const normalized = normalizeIp(ip);
return normalized === '127.0.0.1' || normalized === '::1';
}
function isTrustedProxy(ip) {
return serverConfig.trustedProxies.includes(normalizeIp(ip));
}
function getIpAddress(request) {
const remoteIp = request.socket.remoteAddress;
const remoteIpRaw = request.socket.remoteAddress;
const remoteIp = normalizeIp(remoteIpRaw);
const xff = request.headers['x-forwarded-for'];
// If X-Forwarded-For is present but request is NOT from a trusted proxy → suspicious
if (xff && !serverConfig.trustedProxies.includes(remoteIp)) {
consoleCmd.logSecurity(`Untrusted proxy tried to set X-Forwarded-For: ${xff} (remote: ${remoteIp})`);
if (xff && !isLocalhost(remoteIp) && !isTrustedProxy(remoteIp)) {
consoleCmd.logSecurity(`Untrusted proxy tried to set X-Forwarded-For: ${xff} (remote: ${remoteIpRaw})`);
return remoteIp;
}
if (xff && serverConfig.trustedProxies.includes(remoteIp)) return xff.split(',')[0].trim();
if (xff) return normalizeIp(xff.split(',')[0].trim());
return remoteIp;
}