concrete5/concrete5 — pull request #1078 by mlocati (2013-06-11 15:00:33+00:00)
Title: Avoid detection of private IP addresses

ValidationIpHelper::getRequestIP() scans the following $_SERVER vars:
HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_X_CLUSTER_CLIENT_IP, HTTP_FORWARDED_FOR, HTTP_FORWARDED, REMOTE_ADDR (in this order).
If the client is visiting the website via a proxy server located in his own private network the function may return his local private IP address.

Let's change this behavior, trying to detect only public IP addresses (but still returning the private IP address if no public address is found).