Changeset 426 in code for trunk/config

Timestamp:

Oct 25, 2020, 5:22:12 PM (5 years ago)

Author:

contact

Message:

Don't accept any IP as a proxy by default

It's too easy to setup a reverse proxy which doesn't support the PROXY
protocol, or lets the X-Forwarded-For header fields pass through.
Disable this by default.

To restore the previous behaviour, add accept-proxy-ip localhost to
the config file.

File:

• trunk/config/config.go (modified) (2 diffs)

trunk/config/config.go

@@ -53 +53 @@
         }
         return &Server{
-                Hostname:       hostname,
-                SQLDriver:      "sqlite3",
-                SQLSource:      "soju.db",
-                AcceptProxyIPs: loopbackIPs,
+                Hostname:  hostname,
+                SQLDriver: "sqlite3",
+                SQLSource: "soju.db",
         }
 }
@@ -101 +100 @@
                         srv.AcceptProxyIPs = nil
                         for _, s := range d.Params {
+                                if s == "localhost" {
+                                        srv.AcceptProxyIPs = append(srv.AcceptProxyIPs, loopbackIPs...)
+                                        continue
+                                }
                                 _, n, err := net.ParseCIDR(s)
                                 if err != nil {