1From 6b5dfdb31aa503bb0358784c632ff3a04e7a8ff4 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Wed, 4 Jan 2023 13:51:03 +0800
4Subject: [PATCH] [DEV-2301] fixed spoofing X-Forwarded-For request header
5 allows to access Frontend in maintenace mode
6
7Upstream-Status: Backport [https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/50668e9d64af32cdc67a45082c556699ff86565e]
8CVE: CVE-2022-43515
9
10Signed-off-by: Changqing Li <changqing.li@windriver.com>
11---
12 ui/include/classes/user/CWebUser.php | 6 ++----
13 1 file changed, 2 insertions(+), 4 deletions(-)
14
15diff --git a/ui/include/classes/user/CWebUser.php b/ui/include/classes/user/CWebUser.php
16index e6e651e..bfacce7 100644
17--- a/ui/include/classes/user/CWebUser.php
18+++ b/ui/include/classes/user/CWebUser.php
19@@ -231,13 +231,11 @@ class CWebUser {
20 	}
21
22 	/**
23-	 * Get user ip address.
24+	 * Get user IP address.
25 	 *
26 	 * @return string
27 	 */
28 	public static function getIp(): string {
29-		return (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER) && $_SERVER['HTTP_X_FORWARDED_FOR'] !== '')
30-			? $_SERVER['HTTP_X_FORWARDED_FOR']
31-			: $_SERVER['REMOTE_ADDR'];
32+		return $_SERVER['REMOTE_ADDR'];
33 	}
34 }
35--
362.25.1
37
38