spree/spree — pull request #2216 by radar (2012-11-29 04:33:10+00:00)
Title: Need to capture real client IP for credit card payments

A long, long time ago we hardcoded the ip_address that's passed in the gateway_options hash here:

https://github.com/spree/spree/blob/master/core/app/models/spree/payment/processing.rb#L112

It was to work around a problem with HAProxy not being able to pass the real client ip during an SSL session, which I'm sure has long been fixed (and doesn't seem to be an issue with a sane nginx config anyway).

So we need to populate the Spree::CreditCard ip_address attribute during the payment step of the checkout, and we need to ensure it's passed to the gateway_options as well.

WHY NOW? Well it turns out certain payment processors will start blocking authorizations if you get a lot of orders in a short period of time (and they all use the same client ip_address), as a fraud protection against people testing stolen CC numbers.

This needs to be fixed on master, and back ported to at least 1-2-stable.