Cloudflare IP in uploader IP instead of real IP

[mkerala]

Today I noticed that I can't access my site as I was "banned". On further investigation I found I had banned a Cloudflare IP when I was doing moderation. Further looking into this I found certain uploads from Asia region has Cloudflare IP instead of real uploader IP. However, for other regions images have correct uploader IP. I'm not sure if this is an issue with Cloudflare or Chevereto.

▶🚶‍Reproduction steps

1. Enable cloudflare
2. Upload an image using Singapore or Thailand IP address
3. Check "Uploader IP"

Sample uploaded to demo site: https://demo.chevereto.com/i/img-20181226-101727.wVD

😢Unexpected result

"Uploader IP" has a cloudflare IP address.

📃Error log message

No errors

 

[Rodolfo]

Sample uploaded to demo site: https://demo.chevereto.com/i/img-20181226-101727.wVD

I'm getting this: 172.69.134.133 (which is a CloudFlare IP).

You should try debugging this function: G\get_client_ip()

    function get_client_ip()
    {
        if(isset($_SERVER['G_CLIENT_IP'])) {
            return $_SERVER['G_CLIENT_IP'];
        }
        $client_ip = !empty($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : (!empty($_ENV['REMOTE_ADDR']) ? $_ENV['REMOTE_ADDR'] : null);

        if (array_key_exists('HTTP_CF_CONNECTING_IP', $_SERVER) && $_SERVER['HTTP_CF_CONNECTING_IP'] == $_SERVER['REMOTE_ADDR']) {
            return $_SERVER['HTTP_CF_CONNECTING_IP'];
        }

        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $entries = preg_split('/[\s,]/', $_SERVER['HTTP_X_FORWARDED_FOR'], -1, PREG_SPLIT_NO_EMPTY);

            reset($entries);

            foreach ($entries as $entry) {
                $entry = trim($entry);
                if (preg_match('/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/', $entry, $ip_list)) {
                    $private_ip = array(
                          '/^0\./',
                          '/^127\.0\.0\.1/',
                          '/^192\.168\..*/',
                          '/^172\.((1[6-9])|(2[0-9])|(3[0-1]))\..*/',
                          '/^10\..*/');

                    $found_ip = preg_replace($private_ip, $client_ip, $ip_list[1]);
                    if ($client_ip != $found_ip) { //  and !isset($_SERVER['HTTP_CF_CONNECTING_IP']
                        $client_ip = $found_ip;
                        break;
                    }
                }
            }
        }
        $_SERVER['G_CLIENT_IP'] = $client_ip;
        return $client_ip;
    }

I've added this route to test purposes: https://demo.chevereto.com/hello-world (G_CLIENT_IP) is the IP that Chevereto will try to use.

 

[mkerala]

I got below and G_CLIENT_IP is my correct IP.

Array
(
    [REMOTE_ADDR] => 172.68.146.120
    [HTTP_CF_CONNECTING_IP] => 2405:204:d404:6d7d:2856:4468:1fbf:57ca
    [HTTP_X_FORWARDED_FOR] => 2405:204:d404:6d7d:2856:4468:1fbf:57ca
    [G_CLIENT_IP] => 2405:204:d404:6d7d:2856:4468:1fbf:57ca
)
hello world!

Today, I also found Cloudflare US IP in one of the images on the site https://ipinfo.io/108.162.216.67

 

[mkerala]

I think the problem is with IPv6 address. I got two internet connection with one having IPv6 and another normal IPv4. The issue occurs on the one with IPv6 address. To confirm this I have configured one of my servers in Canada with a IPv6 and uploaded a image and Cloudflare IP was picked instead of IPv6.

Sample: https://demo.chevereto.com/i/nmp.wVB

 

[Rodolfo]

I can't see the sample, the image got deleted. Upload it again, without expiration to tell you the IP.

 

[mkerala]

Demo site seems to have default gust image expire time of 2 hours. Can't edit at unless logged in.

https://demo.chevereto.com/i/images.wcn

Result from https://demo.chevereto.com/hello-world

Array
(
    [REMOTE_ADDR] => 172.68.65.220
    [HTTP_CF_CONNECTING_IP] => 2607:5300:60:1cb4:0:0:0:1
    [HTTP_X_FORWARDED_FOR] => 2607:5300:60:1cb4:0:0:0:1
    [G_CLIENT_IP] => 2607:5300:60:1cb4:0:0:0:1
)

hello world!

 

[Rodolfo]

IP for demo image is 2607:5300:60:1cb4:0:0:0:1

 

[mkerala]

That's strange, I am getting only cloudflare IPs on both on my main site and test site when uploading from IPv6.

https://gifyu.com/image/w9tw

Also looking at the image table, there is no IPv6 for any recent uploads. I used get at least 30% traffic from IPv6 address.

 

[Rodolfo]

Fixed in Chevereto v3.12.9