Just a note to everyone that there is a minor security issue in the handling of IP addresses.
function public
String getRemoteAddr() in src/net/jforum/context/web/WebRequestContext will try and get an IP address from the x-forwarded-for HTTP header. It is possible to send a fake header and therefore fake the IP address. A fake IP address can be targeted to any other user on the site, and by posting illegal content, they might be able to trick a mod into banning an IP address, and therefore banning an innocent user.
You can fix this by changing the content of this function to just:
return super.getRemoteAddr();
but this will return proxy server IP addresses instead of specific IP addresses, which could lead to innocent users getting blocked as well. It is probably marginally safer to use this option though as it prevents deliberate targeting of established innocent users and it prevents users from setting up unblockable abusive accounts.
Thanks again for the great forum software! I have not found any other security issues whilst auditing it so far
[originally posted on jforum.net by legoburner]
