EllisLab/CodeIgniter — pull request #1816 by exnor (2012-09-20 00:22:32+00:00)
Title: Fixes issue #1815 - input::ip_address() returns incorrect IP behind prox...

...y when multiple IPs are sent back from the server in HTTP_X_FORWARDED_FOR.

Problematic code:

if (strpos($this->ip_address, ',') !== FALSE)
{
$x = explode(',', $this->ip_address);
$this->ip_address = trim(end($x));
}

This is due to it taking the last IP.

As far as I can tell (let http://en.wikipedia.org/wiki/X-Forwarded-For be my witness), the client is generally listed as the first IP address, not the last, so this is a simple case of changing the line:

$this->ip_address = trim(end($x));
to
$this->ip_address = trim($x[0]);

[TESTED USING APACHE/HAPROXY]