From ddd7b8fdae167564bf7af3978e0de417e266ab02 Mon Sep 17 00:00:00 2001
From: francis <francis>
Date: Thu, 4 Sep 2008 09:43:09 +0000
Subject: Remove silly failsafe thing
 http://groups.google.com/group/rubyonrails-talk/browse_thread/thread/63127dc2bda58ace/000f7d4d8098a0a4?lnk=raot
 http://www.ruby-forum.com/topic/154836
 http://rails.lighthouseapp.com/attachments/25763/forwarded_client_ip_with_test.patch

---
 vendor/rails-2.1.0/actionpack/lib/action_controller/request.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'vendor/rails-2.1.0/actionpack/lib/action_controller')

diff --git a/vendor/rails-2.1.0/actionpack/lib/action_controller/request.rb b/vendor/rails-2.1.0/actionpack/lib/action_controller/request.rb
index a35b90419..f275ec11b 100755
--- a/vendor/rails-2.1.0/actionpack/lib/action_controller/request.rb
+++ b/vendor/rails-2.1.0/actionpack/lib/action_controller/request.rb
@@ -140,8 +140,10 @@ module ActionController
         return @env['REMOTE_ADDR']
       end
 
+      remote_ips = @env['HTTP_X_FORWARDED_FOR'] && @env['HTTP_X_FORWARDED_FOR'].split(',')
+
       if @env.include? 'HTTP_CLIENT_IP'
-        if @env.include? 'HTTP_X_FORWARDED_FOR'
+        if remote_ips and !remote_ips.include?(@env['HTTP_CLIENT_IP'])
           # We don't know which came from the proxy, and which from the user
           raise ActionControllerError.new(<<EOM)
 IP spoofing attack?!
@@ -152,8 +154,7 @@ EOM
         return @env['HTTP_CLIENT_IP']
       end
 
-      if @env.include? 'HTTP_X_FORWARDED_FOR' then
-        remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',')
+      if remote_ips
         while remote_ips.size > 1 && TRUSTED_PROXIES =~ remote_ips.last.strip
           remote_ips.pop
         end
-- 
cgit v1.2.3