remote.php authorizes the server-to-server actions (heartbeat, host-down log, enable/disable and add/update URL) by comparing the caller's IP to the registered plugin_webseer_servers. It read that IP from the X-Forwarded-For header before falling back to REMOTE_ADDR.
A forwarded header is set by the client, so it should not be trusted to identify the peer. This switches the comparison to REMOTE_ADDR, the real connection address.
No behaviour change for direct server-to-server connections. If a deployment fronts these servers with a trusted proxy, the proxy address is now what's matched (the intended, non-spoofable behaviour). php -l and php-cs-fixer clean.
Tracking issue for #71, which carries the fix.
remote.phpauthorizes the server-to-server actions (heartbeat, host-down log, enable/disable and add/update URL) by comparing the caller's IP to the registeredplugin_webseer_servers. It read that IP from theX-Forwarded-Forheader before falling back toREMOTE_ADDR.A forwarded header is set by the client, so it should not be trusted to identify the peer. This switches the comparison to
REMOTE_ADDR, the real connection address.No behaviour change for direct server-to-server connections. If a deployment fronts these servers with a trusted proxy, the proxy address is now what's matched (the intended, non-spoofable behaviour).
php -land php-cs-fixer clean.Tracking issue for #71, which carries the fix.