Changeset 805 for trunk/Modules/User/User.php

Timestamp:

May 24, 2014, 11:35:47 PM (10 years ago)

Author:

chronos

Message:

• Fixed: Do not log client proxy IP address as remote address because it can be faked and also there can be multiple client proxy addresses.
• Modified: Do not use directly $_SERVER variables REMOTE_ADDR and REQUEST_URI as they are not initialized if script is executed from command line.
• Fixed: Default configuration was not complete.

File:

• trunk/Modules/User/User.php (modified) (4 diffs)

trunk/Modules/User/User.php

@@ -137 +137 @@
       $this->Database->query('UPDATE `UserTrace` SET '.
         '`LastLogin` = NOW(), '.
-        '`LastIP` = "'.$_SERVER['REMOTE_ADDR'].'", '.
+        '`LastIP` = "'.GetRemoteAddress().'", '.
         '`UserAgent` = "'.$this->System->Database->real_escape_string($_SERVER['HTTP_USER_AGENT']).'" '.
         ' WHERE `User` = '.$this->Id);
@@ -194 +194 @@
   function Licence($Licence)
   {
-    if(!isset($_SERVER['REMOTE_ADDR'])) return(true); // Execution from command line
-    else return($this->Role >= $Licence);
+    if(GetRemoteAddress() == '') return(true); // Execution from command line
+      else return($this->Role >= $Licence);
   }
 
@@ -229 +229 @@
       // Refresh time of last access
       $this->Database->update('UserOnline', 'SessionId="'.$SID.'"', array('ActivityTime' => 'NOW()'));
-    } else $this->Database->insert('UserOnline', array('SessionId' => $SID,
+    } else {
+        if(GetRemoteAddress() != '') $HostName = gethostbyaddr(GetRemoteAddress());
+          else $HostName = '';
+        $this->Database->insert('UserOnline', array('SessionId' => $SID,
       'User' => null, 'LoginTime' => 'NOW()', 'ActivityTime' => 'NOW()',
-      'IpAddress' => GetRemoteAddress(), 'HostName' => gethostbyaddr(GetRemoteAddress()),
-      'ScriptName' => $_SERVER['REQUEST_URI']));
-
+      'IpAddress' => GetRemoteAddress(), 'HostName' => $HostName,
+      'ScriptName' => GetRequestURI()));
+    }
+        
     // Logged permanently?
           if(array_key_exists('LoginHash', $_COOKIE))
@@ -281 +285 @@
     $UserId = $this->Database->insert_id;
     $this->Database->query('INSERT INTO `UserTrace` (`User`, `LastIP`, `UserAgent`) '.
-        'VALUES ('.$UserId.', "'.$_SERVER['REMOTE_ADDR'].'", '.
+        'VALUES ('.$UserId.', "'.GetRemoteAddress().'", '.
         '"'.$this->Database->real_escape_string($_SERVER['HTTP_USER_AGENT']).'")');
   }