From 14addf3fdbebe77329d04dabcf1240e79292476c Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Tue, 26 Mar 2024 12:30:57 +0100 Subject: [PATCH] fix(settings): Also verify that `trusted_proxies` only contains IP addresses (with range) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com> Signed-off-by: Ferdinand Thiessen --- apps/settings/lib/SetupChecks/ForwardedForHeaders.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/apps/settings/lib/SetupChecks/ForwardedForHeaders.php b/apps/settings/lib/SetupChecks/ForwardedForHeaders.php index daf84e265af53..98252c31247d9 100644 --- a/apps/settings/lib/SetupChecks/ForwardedForHeaders.php +++ b/apps/settings/lib/SetupChecks/ForwardedForHeaders.php @@ -59,6 +59,16 @@ public function run(): SetupResult { return SetupResult::error($this->l10n->t('Your "trusted_proxies" setting is not correctly set, it should be an array.')); } + foreach ($trustedProxies as $proxy) { + $addressParts = explode('/', $proxy, 2); + if (filter_var($addressParts[0], FILTER_VALIDATE_IP) === false || !ctype_digit($addressParts[1] ?? '24')) { + return SetupResult::error( + $this->l10n->t('Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation.'), + $this->urlGenerator->linkToDocs('admin-reverse-proxy'), + ); + } + } + if (($remoteAddress === '') && ($detectedRemoteAddress === '')) { if (\OC::$CLI) { /* We were called from CLI */