search

dorzki / slack-notifications

Get WordPress notifications to your team's Slack channel.
https://wordpress.org/plugins/dorzki-notifications-to-slack/
GNU General Public License v3.0
41 stars 27 forks source link

Client IP should be replaced with value from X-Forwarded-For header if present #25

Closed cpdk closed 6 years ago

cpdk commented 6 years ago

We are running the plugin in a setup where WordPress is behind a CDN (AWS CloudFront) and a LoadBalancer (AWS ALB). Both of which will terminate SSL (and thus TCP) - therefor the real client IP is not visible except as an HTTP Header.

What we see on slack is the internal IP of the LoadBalancer (in the 10.0.0.0/8 non-public range):

Most proxies (and all we use) handle this by following RFC 7239 - ie. by injecting an HTTP header called X-Forwarded-For with a list of IPs.

See: the RFC - section 5.2 for details

It would be great if this otherwise great plugin could pickup if the user is accessing WordPress through a proxy and then pickup the actual client IP to post to Slack.

DorZuberi commented 6 years ago

Hi @cpdk , I will release a hotfix in a few days.

Thanks for reporting the bug!

DorZuberi commented 6 years ago

Hi @cpdk, I've fixed the issue on commit 280c5b2135f363af2205921d9ab29804dee10ffa.

The version will be uploaded to WordPress Repo soon.

cpdk commented 6 years ago

Sound great - will test asap

DorZuberi commented 6 years ago

@cpdk Cool, would love to get an update if the issue was resolved.

Also, if you can rate the plugin it would be awesome :)