X-Forwarded-For is not the user's IP

fixes #3036
craftcms · Jun 28, 2018 · dc9ac62 · dc9ac62
1 parent e3802f0
commit dc9ac62
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 1 deletion.
diff --git a/CHANGELOG-v3.md b/CHANGELOG-v3.md
@@ -7,6 +7,7 @@
 
 # Fixed
 - Fixed a bug where user verification links could get mangled when emails were parsed as Markdown, if the verification code contained two or more underscores.
+- Fixed a bug where Craft was misinterpreting `X-Forwarded-For` headers as the user’s IP instead of the server’s IP. ([#3036](https://github.com/craftcms/cms/issues/3036))
 
 ## 3.0.13.2 - 2018-06-27
 

diff --git a/src/web/Request.php b/src/web/Request.php
@@ -52,7 +52,6 @@ class Request extends \yii\web\Request
      */
     public $ipHeaders = [
         'Client-IP',
-        'X-Forwarded-For',
         'X-Forwarded',
         'X-Cluster-Client-IP',
         'Forwarded-For',
-Original file line number
+Diff line change
@@ Expand Up / @@ -7,6 +7,7 @@ @@
     # Fixed
     - Fixed a bug where user verification links could get mangled when emails were parsed as Markdown, if the verification code contained two or more underscores.
+    - Fixed a bug where Craft was misinterpreting `X-Forwarded-For` headers as the user’s IP instead of the server’s IP. ([#3036](https://github.com/craftcms/cms/issues/3036))
     ## 3.0.13.2 - 2018-06-27
@@ Expand Down @@