Alex/freescout
1
0
Fork 0
mirror of https://github.com/freescout-helpdesk/freescout.git synced 2025-01-31 20:11:38 +01:00
Code Issues Releases Wiki Activity

Allow to set trusted proxies via .env file APP_TRUSTED_PROXIES parameter - closes #1994

Browse Source
This commit is contained in:
FreeScout 2023-07-17 00:12:00 -07:00
parent 2b9f56b456
commit 71fb3b1313
3 changed files with 90 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.env.example
View File

@ -26,6 +26,11 @@ APP_URL=https://example.com
# Comment it to use default timezone from php.ini
#APP_TIMEZONE=Europe/London
# Comma separated list of trusted proxies for proper IP detection in FreeScout.
# To trust all proxies that connect to your server use single asterisk: *
# To trust ALL proxies, including those that are in a chain of forwarding use double asterisk: **
#APP_TRUSTED_PROXIES=192.168.1.1,192.168.1.2,192.168.1.3
DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306

20
app/Http/Middleware/HttpsRedirect.php
View File

@ -18,20 +18,22 @@ class HttpsRedirect {
*
* @var array
*/
protected $headers = [
Request::HEADER_FORWARDED => 'FORWARDED',
Request::HEADER_X_FORWARDED_FOR => 'X_FORWARDED_FOR',
Request::HEADER_X_FORWARDED_HOST => 'X_FORWARDED_HOST',
Request::HEADER_X_FORWARDED_PORT => 'X_FORWARDED_PORT',
Request::HEADER_X_FORWARDED_PROTO => 'X_FORWARDED_PROTO',
];
// protected $headers = [
// Request::HEADER_FORWARDED => 'FORWARDED',
// Request::HEADER_X_FORWARDED_FOR => 'X_FORWARDED_FOR',
// Request::HEADER_X_FORWARDED_HOST => 'X_FORWARDED_HOST',
// Request::HEADER_X_FORWARDED_PORT => 'X_FORWARDED_PORT',
// Request::HEADER_X_FORWARDED_PROTO => 'X_FORWARDED_PROTO',
// ];
public function handle($request, Closure $next)
{
if (\Helper::isHttps()) {
$request->setTrustedProxies( [ $request->getClientIp() ], array_keys($this->headers));
//$request->setTrustedProxies( [ $request->getClientIp() ], array_keys($this->headers));
if (!$request->secure() && strtolower($_SERVER['HTTPS'] ?? '') != 'on'
if (//!$request->secure()
!in_array(strtolower($_SERVER['X_FORWARDED_PROTO'] ?? ''), array('https', 'on', 'ssl', '1'), true)
&& strtolower($_SERVER['HTTPS'] ?? '') != 'on'
&& ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') != 'https'
&& ($_SERVER['HTTP_CF_VISITOR'] ?? '') != '{"scheme":"https"}'
) {

74
config/trustedproxy.php Normal file
View File

@ -0,0 +1,74 @@
<?php
return [
/*
* Set trusted proxy IP addresses.
*
* Both IPv4 and IPv6 addresses are
* supported, along with CIDR notation.
*
* The "*" character is syntactic sugar
* within TrustedProxy to trust any proxy
* that connects directly to your server,
* a requirement when you cannot know the address
* of your proxy (e.g. if using Rackspace balancers).
*
* The "**" character is syntactic sugar within
* TrustedProxy to trust not just any proxy that
* connects directly to your server, but also
* proxies that connect to those proxies, and all
* the way back until you reach the original source
* IP. It will mean that $request->getClientIp()
* always gets the originating client IP, no matter
* how many proxies that client's request has
* subsequently passed through.
*/
// 'proxies' => [
// '192.168.1.10',
// ],
'proxies' => preg_match("#^\*{1,2}$#", env('APP_TRUSTED_PROXIES', ''))
? env('APP_TRUSTED_PROXIES', '')
: explode(',', env('APP_TRUSTED_PROXIES', '')),
/*
* Or, to trust all proxies that connect
* directly to your server, uncomment this:
*/
# 'proxies' => '*',
/*
* Or, to trust ALL proxies, including those that
* are in a chain of forwarding, uncomment this:
*/
# 'proxies' => '**',
/*
* Default Header Names
*
* Change these if the proxy does
* not send the default header names.
*
* Note that headers such as X-Forwarded-For
* are transformed to HTTP_X_FORWARDED_FOR format.
*
* The following are Symfony defaults, found in
* \Symfony\Component\HttpFoundation\Request::$trustedHeaders
*
* You may optionally set headers to 'null' here if you'd like
* for them to be considered untrusted instead. Ex:
*
* Illuminate\Http\Request::HEADER_CLIENT_HOST => null,
*
* WARNING: If you're using AWS Elastic Load Balancing or Heroku,
* the FORWARDED and X_FORWARDED_HOST headers should be set to null
* as they are currently unsupported there.
*/
'headers' => [
(defined('Illuminate\Http\Request::HEADER_FORWARDED') ? Illuminate\Http\Request::HEADER_FORWARDED : 'forwarded') => 'FORWARDED',
Illuminate\Http\Request::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
Illuminate\Http\Request::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',
Illuminate\Http\Request::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
Illuminate\Http\Request::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
]
];