浏览代码

fix(api): fix django source of remote IP

In accordance with the nginx default uwsgi parameters, we cannot
trust the X-Forwarded-For HTTP header field. However, nxing uwsgi
parameters guarantee that the uwsgi REMOTE_ADDR field contains
the IP that is talking to nginx.

State prior to this commit compromise the abuse checks that are
conducted relying on the remote IP address.

This closes nils-wisiol/desec-internal#8.
Nils Wisiol 8 年之前
父节点
当前提交
ecee5025f3
共有 1 个文件被更改,包括 1 次插入6 次删除
  1. 1 6
      api/desecapi/views.py

+ 1 - 6
api/desecapi/views.py

@@ -29,12 +29,7 @@ from desecapi.emails import send_account_lock_email
 
 
 
 
 def get_client_ip(request):
 def get_client_ip(request):
-    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
-    if x_forwarded_for:
-        ip = x_forwarded_for.split(',')[0]
-    else:
-        ip = request.META.get('REMOTE_ADDR')
-    return ip
+    return request.META.get('REMOTE_ADDR')
 
 
 
 
 class DomainList(generics.ListCreateAPIView):
 class DomainList(generics.ListCreateAPIView):