diff options
| author | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-03-26 12:30:57 +0100 |
|---|---|---|
| committer | backportbot[bot] <backportbot[bot]@users.noreply.github.com> | 2024-03-26 17:41:06 +0000 |
| commit | 3203db81603d1025ec7237ffc026fffcab5d682c (patch) | |
| tree | 9653a6a13ed95c4f9766514bb433823ff401eff3 /apps | |
| parent | bfa6ef849758115b4fc195e3da5f7117257802e6 (diff) | |
| download | nextcloud-server-3203db81603d1025ec7237ffc026fffcab5d682c.tar.gz nextcloud-server-3203db81603d1025ec7237ffc026fffcab5d682c.zip | |
fix(settings): Also verify that `trusted_proxies` only contains IP addresses (with range)
Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/settings/lib/SetupChecks/ForwardedForHeaders.php | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/apps/settings/lib/SetupChecks/ForwardedForHeaders.php b/apps/settings/lib/SetupChecks/ForwardedForHeaders.php index daf84e265af..98252c31247 100644 --- a/apps/settings/lib/SetupChecks/ForwardedForHeaders.php +++ b/apps/settings/lib/SetupChecks/ForwardedForHeaders.php @@ -59,6 +59,16 @@ class ForwardedForHeaders implements ISetupCheck { return SetupResult::error($this->l10n->t('Your "trusted_proxies" setting is not correctly set, it should be an array.')); } + foreach ($trustedProxies as $proxy) { + $addressParts = explode('/', $proxy, 2); + if (filter_var($addressParts[0], FILTER_VALIDATE_IP) === false || !ctype_digit($addressParts[1] ?? '24')) { + return SetupResult::error( + $this->l10n->t('Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation.'), + $this->urlGenerator->linkToDocs('admin-reverse-proxy'), + ); + } + } + if (($remoteAddress === '') && ($detectedRemoteAddress === '')) { if (\OC::$CLI) { /* We were called from CLI */ |