[Bug 39789] New: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Bug ID: 39789 Summary: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181718 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181718&action=edit Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Tristin Stagg <tristin.stagg@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tristin.stagg@bywatersoluti | |ons.com --- Comment #2 from Tristin Stagg <tristin.stagg@bywatersolutions.com> --- This looks great Kyle. This will help out a lot! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181718|0 |1 is obsolete| | --- Comment #3 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181720 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181720&action=edit Bug 39789 - Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Wouldn't it make more sense to put this in koha-conf.xml alongside "koha_trusted_proxies"? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #5 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- (In reply to David Cook from comment #4)
Wouldn't it make more sense to put this in koha-conf.xml alongside "koha_trusted_proxies"?
Agreed! I will get this fixed up! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181720|0 |1 is obsolete| | --- Comment #6 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181915 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181915&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #7 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181916 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181916&action=edit Bug 39789: Change syspref to config option -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #8 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181917&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181915|0 |1 is obsolete| | Attachment #181916|0 |1 is obsolete| | Attachment #181917|0 |1 is obsolete| | --- Comment #9 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181918 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181918&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #10 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181919 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181919&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181918|0 |1 is obsolete| | Attachment #181919|0 |1 is obsolete| | --- Comment #11 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181920 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181920&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #12 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 181921 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=181921&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #13 from Lin Wei <lin-wei.li@inLibro.com> --- Created attachment 182299 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182299&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181921|0 |1 is obsolete| | --- Comment #14 from Lin Wei <lin-wei.li@inLibro.com> --- Created attachment 182300 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182300&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #181920|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182299|0 |1 is obsolete| | Attachment #182300|0 |1 is obsolete| | --- Comment #15 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182395 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182395&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #16 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182396 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182396&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #17 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182397 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182397&action=edit Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Add ability to specify an |Add ability to specify an |alternative header to |alternative header to |X-Forwarded-For for finding |X-Forwarded-For for finding |the real ip address |the real IP address -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182397|0 |1 is obsolete| | --- Comment #18 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182841 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182841&action=edit Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182395|0 |1 is obsolete| | Attachment #182396|0 |1 is obsolete| | Attachment #182841|0 |1 is obsolete| | --- Comment #19 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182842 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182842&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #20 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182843 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182843&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #21 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182844 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182844&action=edit Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182842|0 |1 is obsolete| | Attachment #182843|0 |1 is obsolete| | Attachment #182844|0 |1 is obsolete| | --- Comment #22 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182846 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182846&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182846|0 |1 is obsolete| | --- Comment #23 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182847 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182847&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #24 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182848 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182848&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #25 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 182849 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182849&action=edit Bug 39789: Check requests for the custom header with fallback to X-Forwarded-For This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #26 from David Cook <dcook@prosentient.com.au> --- Planning to come back and review this next week... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #27 from Tristin Stagg <tristin.stagg@bywatersolutions.com> --- Created attachment 183215 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183215&action=edit Bug 39789: Add new "require_trusted_proxy_for_headers" 1) call will check the remote address against the list of trusted proxies first, if configured to do so, right off the bat. This allows us to not have to do this if we do not want to. Particularly useful if i were to tell an Koha server that it could only receive web requests from Cloudflare, or even if i was able to do that at the reverse proxy level. It's configurable so it can be disabled/enabled. a) If trusted, then it parses the header that was determined (from configuration or default X-Forwarded-For) b) Otherwise, it will fall back to the remote address 2) If not configured to check remote address against a trusted proxy, it will just parse the header that was determined. a) If it does not find a value, it will simply return the remote address. 3) "get_real_ip" no longer checks against trusted proxies, as that is done beforehand. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |dcook@prosentient.com.au |y.org | CC| |martin.renvoize@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|dcook@prosentient.com.au |testopia@bugs.koha-communit | |y.org --- Comment #28 from David Cook <dcook@prosentient.com.au> --- Sorry I'm going to have to step back on QA for this one, as I've run out of Bugzilla time for a bit... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |pedro.amorim@openfifth.co.u |y.org |k CC| |pedro.amorim@openfifth.co.u | |k -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #29 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Hi guys, 1) The 4th patch causes t/Koha/Middleware/RealIP.t to fail. 2) Would it also be okay to squash the 1st and 3rd patches? 3rd patch is effectivelly rewriting 3) 4th patch is checking for a require_trusted_proxy_for_headers config. Should this not be added to debian/templates/koha-conf-site.xml.in and possible about.pl + about.tt? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182847|0 |1 is obsolete| | --- Comment #30 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 188379 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188379&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #31 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 188380 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188380&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #32 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 188381 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188381&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #33 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182848|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182849|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #183215|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188379|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188380|0 |1 is obsolete| | --- Comment #34 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 188382 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188382&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188381|0 |1 is obsolete| | --- Comment #35 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 188383 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188383&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #36 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Hi Kyle, I want to PQA but, even though my initial comments were addressed, this: 1) Lacks a reproducible test plan 2) Lacks new unit tests for the new config options it's adding 3) Adds a new config option that is 'on' by default? I may very well be missing the reasons why it is the way it is, as I'm not familiar with this particular part of the code. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #37 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Comment on attachment 188382 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188382 Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Review of attachment 188382: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=39789&attachment=188382) ----------------------------------------------------------------- ::: debian/templates/koha-conf-site.xml.in @@ +345,4 @@
<!-- <koha_trusted_proxies>1.2.3.4 2.3.4.5 3.4.5.6</koha_trusted_proxies> + <reverse_proxy_ip_header>HTTP_X_FORWARDED_FOR</reverse_proxy_ip_header> + <enable_trusted_proxy_for_headers>1</enable_trusted_proxy_for_headers>
This needs to be integrated in etc/koha-conf.xml The way to maintain these files is unclear, here are the pieces of the puzzle that I've found so far: https://wiki.koha-community.org/wiki/Talk:Coding_Guidelines#debian.2Ftemplat... (more pieces welcome) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #38 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 196506 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196506&action=edit Bug 39789: Add unit tests Test Plan: 1) Apply this patch set 2) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196506|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #39 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 196507 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196507&action=edit Bug 39789: Add unit tests Test Plan: 1) Apply this patch set 2) prove t/Koha/Middleware/RealIP.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #40 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 196508 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196508&action=edit Bug 39789: Update koha-conf.xml Patch from commit e45eb21 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #41 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- (In reply to Pedro Amorim from comment #36)
Hi Kyle, I want to PQA but, even though my initial comments were addressed, this: 1) Lacks a reproducible test plan 2) Lacks new unit tests for the new config options it's adding
Yeah, a test plan requires the use of a proxy, so non-trivial to set up. I think the new unit tests are sufficient to show it works!
3) Adds a new config option that is 'on' by default?
It was permanently on previously, so this is a new feature to allow it to be turned 'off'! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188382|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188383|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196507|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Pedro Amorim <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196508|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #42 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 197205 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197205&action=edit Bug 39789: Add ability to specify an alternative header to X-Forwarded-For for finding the real ip address Some services ( such as CloudFlare ) use alternative heads to X-Forwarded-For. Koha should be able to use a custom header instead of X-Forwarded-For if needed. This patch updates the feature to allow both the custom header and X-Forwarded-For to work harmoniously For example, CloudFlare has it's own custom header. This patch allows a site to be configured for Cloudflare's proxy before the proxy is enabled. Test Plan: 1) prove t/Koha/Middleware/RealIP.t Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #43 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 197206 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197206&action=edit Bug 39789: Display the trusted proxy IP addresses and reverse proxy IP header on about page Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com> Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #44 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 197207 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197207&action=edit Bug 39789: Add unit tests Test Plan: 1) Apply this patch set 2) prove t/Koha/Middleware/RealIP.t Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #45 from Pedro Amorim <pedro.amorim@openfifth.co.uk> --- Created attachment 197208 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197208&action=edit Bug 39789: Update koha-conf.xml Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #46 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 197759 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197759&action=edit Bug 39789: (QA follow-up) fix redundancy in koha-conf.xml Some of the changes were already in the file. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |26.05.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 --- Comment #47 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting --- Comment #48 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- This will not be backported to 25.11.x due to it being deemed an enhancement or a dependancy not being met -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39789 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #49 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Nothing to add or edit in the Koha manual regarding this change. Please reopen and provide more information is this is not the case. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org