contao/core — pull request #4925 by vbinsider (2012-10-12 10:29:09+00:00)
Title: System::anonymizeIp anonymizing too much

The function `System::anonymizeIp()` uses `str_replace` to zero out the last part of an IP address. However, if you want to track requests originating from providers with smaller IP ranges (smaller than /8 or /16) this leads to a problem if the last IP address value occurs more than once in the given string because any occurrence of the last address part will be replaced by '.0' or ':0000', depending on the IP version.

For example, the address '8.8.8.8' would be anonymized into '8.0.0.0'. If you check the WHOIS records for both addresses, you get two different results. This is IMHO far beyond the interests of anonymization. ;-)

The function can easily be fixed, though. I have used `substr_replace` instead of `str_replace` to ensure that only the last part will be replaced. As `str_replace` scans the whole string for the given substring, this also might lead to a slight performance improvement, although I haven't checked that.