diff --git a/CHANGELOG.md b/CHANGELOG.md index 383f89a8..a5d1339d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com), and this The new conditions match as soon as a query param exists with any or no value (in the case of `any-value-query-param`), or if a query param exists with no value at all (in the case of `valueless-query-param`). +* [#2387](https://github.com/shlinkio/shlink/issues/2387) Add `TRUSTED_PROXIES` env var and corresponding config option, to configure a comma-separated list of all the proxies in front of Shlink, or simply the amount of trusted proxies in front of Shlink. + + This is important to properly detect visitor's IP addresses instead of incorrectly matching one of the proxy's IP address, and if provided, it disables a workaround introduced in https://github.com/shlinkio/shlink/pull/2359. + ### Changed * [#2406](https://github.com/shlinkio/shlink/issues/2406) Remove references to bootstrap from error templates, and instead inline the very minimum required styles. diff --git a/composer.json b/composer.json index 26031b7c..720a7089 100644 --- a/composer.json +++ b/composer.json @@ -47,7 +47,7 @@ "shlinkio/shlink-config": "^4.0", "shlinkio/shlink-event-dispatcher": "^4.2", "shlinkio/shlink-importer": "^5.6", - "shlinkio/shlink-installer": "dev-develop#9005232 as 9.6", + "shlinkio/shlink-installer": "dev-develop#eef3749 as 9.6", "shlinkio/shlink-ip-geolocation": "^4.3", "shlinkio/shlink-json": "^1.2", "spiral/roadrunner": "^2025.1", diff --git a/config/autoload/installer.global.php b/config/autoload/installer.global.php index e9270eb6..9a7bff04 100644 --- a/config/autoload/installer.global.php +++ b/config/autoload/installer.global.php @@ -80,6 +80,7 @@ return [ Option\Cors\CorsAllowOriginConfigOption::class, Option\Cors\CorsAllowCredentialsConfigOption::class, Option\Cors\CorsMaxAgeConfigOption::class, + Option\TrustedProxiesConfigOption::class, ], 'installation_commands' => [ diff --git a/config/autoload/ip-address.global.php b/config/autoload/ip-address.global.php index 1bac74c2..11902091 100644 --- a/config/autoload/ip-address.global.php +++ b/config/autoload/ip-address.global.php @@ -13,6 +13,7 @@ use const Shlinkio\Shlink\IP_ADDRESS_REQUEST_ATTRIBUTE; return (static function (): array { $trustedProxies = EnvVars::TRUSTED_PROXIES->loadFromEnv(); + $proxiesIsHopCount = is_numeric($trustedProxies); return [ @@ -21,7 +22,10 @@ return (static function (): array { 'ip_address' => [ 'attribute_name' => IP_ADDRESS_REQUEST_ATTRIBUTE, 'check_proxy_headers' => true, - 'trusted_proxies' => splitByComma($trustedProxies), + // List of trusted proxies + 'trusted_proxies' => $proxiesIsHopCount ? [] : splitByComma($trustedProxies), + // Amount of addresses to skip from the right, before finding the visitor IP address + 'hop_count' => $proxiesIsHopCount ? (int) $trustedProxies : 0, 'headers_to_inspect' => [ 'CF-Connecting-IP', 'X-Forwarded-For',