This week's book giveaway is in the Other Languages forum.
We're giving away four copies of Functional Reactive Programming and have Stephen Blackheath and Anthony Jones on-line!
See this thread for details.
Win a copy of Functional Reactive Programming this week in the Other Languages forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Minor security issue with IP address detection...

Migrated From
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Just a note to everyone that there is a minor security issue in the handling of IP addresses.
function public String getRemoteAddr() in src/net/jforum/context/web/WebRequestContext will try and get an IP address from the x-forwarded-for HTTP header. It is possible to send a fake header and therefore fake the IP address. A fake IP address can be targeted to any other user on the site, and by posting illegal content, they might be able to trick a mod into banning an IP address, and therefore banning an innocent user.
You can fix this by changing the content of this function to just:
return super.getRemoteAddr();
but this will return proxy server IP addresses instead of specific IP addresses, which could lead to innocent users getting blocked as well. It is probably marginally safer to use this option though as it prevents deliberate targeting of established innocent users and it prevents users from setting up unblockable abusive accounts.

Thanks again for the great forum software! I have not found any other security issues whilst auditing it so far
[originally posted on by legoburner]
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic