isohuntto/openbay — pull request #72 by PeeHaa (2014-12-24 21:33:51+00:00)
Title: Prevent potential security issues arising from using untrusted IP addresses

Currently [this](https://github.com/isohuntto/openbay/blob/master/src/protected/components/AHttpRequest.php#L35-L42) list of server variables is checked to find the client's IP address:

array(
'HTTP_X_REAL_IP',
'HTTP_CLIENT_IP',
'HTTP_X_FORWARDED_FOR',
'HTTP_X_FORWARDED',
'HTTP_X_CLUSTER_CLIENT_IP',
'HTTP_FORWARDED_FOR',
'HTTP_FORWARDED',
'REMOTE_ADDR'
)

which means that when at some point the [`CAccessControlFilter`](https://github.com/isohuntto/openbay/blob/master/src/protected/vendor/yiisoft/yii/framework/web/auth/CAccessControlFilter.php) is used to validate a user based on the IP address it is trivially exploitable, because everybody can easily fake any of those values (except for the `REMOTE_ADDR`) potentially allowing an attacker access.

This PR fixes this to only use `REMOTE_ADDR` when trying to get the client's IP in security contexts. The original method is renamed with the `Unsafe` prefix so it can still be used to try to determine the location of the client using geoip.

This PR also fixes the errors introduced in https://github.com/isohuntto/openbay/commit/030b6e2cd48f57cc8867cadce0c5da7f15b4bfa9 (ping @writemorecode).