implement a protection against transparent proxies

2 files changed, 28 insertions, 12 deletions

diff --git a/inc/config.php b/inc/config.php
index 42e1c32b..0ba1952b 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -290,6 +290,12 @@
 	// Ability to lock a board for normal users and still allow mods to post.  Could also be useful for making an archive board
 	$config['board_locked'] = false;
 
+	// If poster's proxy supplies X-Forwarded-For header, check if poster's real IP is banned.
+	$config['proxy_check'] = false;
+
+	// If poster's proxy supplies X-Forwarded-For header, save it for further inspection and/or filtering.
+	$config['proxy_save'] = false;
+
 	/*
 	 * Custom filters detect certain posts and reject/ban accordingly. They are made up of a condition and an
 	 * action (for when ALL conditions are met). As every single post has to be put through each filter,
diff --git a/inc/functions.php b/inc/functions.php
index ca918e0a..0f70d447 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -810,12 +810,29 @@ function checkBan($board = false) {
 	if (event('check-ban', $board))
 		return true;
 
-	$bans = Bans::find($_SERVER['REMOTE_ADDR'], $board, $config['show_modname']);
+	$ips = array();
+
+	$ips[] = $_SERVER['REMOTE_ADDR'];
+
+	if ($config['proxy_check'] && isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+		$ips = array_merge($ips, explode(", ", $_SERVER['HTTP_X_FORWARDED_FOR']));
+	}
+
+	foreach ($ips as $ip) {
+		$bans = Bans::find($_SERVER['REMOTE_ADDR'], $board, $config['show_modname']);
 	
-	foreach ($bans as &$ban) {
-		if ($ban['expires'] && $ban['expires'] < time()) {
-			Bans::delete($ban['id']);
-			if ($config['require_ban_view'] && !$ban['seen']) {
+		foreach ($bans as &$ban) {
+			if ($ban['expires'] && $ban['expires'] < time()) {
+				Bans::delete($ban['id']);
+				if ($config['require_ban_view'] && !$ban['seen']) {
+					if (!isset($_POST['json_response'])) {
+						displayBan($ban);
+					} else {
+						header('Content-Type: text/json');
+						die(json_encode(array('error' => true, 'banned' => true)));
+					}
+				}
+			} else {
 				if (!isset($_POST['json_response'])) {
 					displayBan($ban);
 				} else {
@@ -823,13 +840,6 @@ function checkBan($board = false) {
 					die(json_encode(array('error' => true, 'banned' => true)));
 				}
 			}
-		} else {
-			if (!isset($_POST['json_response'])) {
-				displayBan($ban);
-			} else {
-				header('Content-Type: text/json');
-				die(json_encode(array('error' => true, 'banned' => true)));
-			}
 		}
 	}