Changeset 3337887

Timestamp:

08/01/2025 03:11:47 PM (8 months ago)

Author:

supersoju

Message:

Pick real IP from proxies

Location:

wpcommand/trunk

Files:

• plugin.php (modified) (1 diff)
• readme.txt (modified) (1 diff)
• wpcac.api.php (modified) (2 diffs)

wpcommand/trunk/plugin.php

@@ -4 +4 @@
 Plugin Name: WP Command and Control
 Description: Manage your WordPress site with <a href="https://wpcommandcontrol.com/">WP Command and Control</a>. <strong>Deactivate to clear your API Key.</strong>
-Version: 2.3.5.2
+Version: 2.3.6
 Author: SoJu Studios
 Author URI: http://supersoju.com/

wpcommand/trunk/readme.txt

@@ -2 +2 @@
 Contributors: supersoju
 Tags: wpcommand, wpcontrol, remote administration, multiple wordpress
-Requires at least: 3.1
-Tested up to: 6.3
-Stable tag: 2.3.5.2
+Requires at least: 5.0
+Tested up to: 6.8.2
+Stable tag: 2.3.6
 
 WP Command and Control allows you to manage multiple WordPress installs from a single dashboard.

wpcommand/trunk/wpcac.api.php

@@ -26 +26 @@
             exit;
         }
+
+        $all_ips = array();
+        if (!empty($_SERVER['REMOTE_ADDR'])) {
+            $all_ips[] = $_SERVER['REMOTE_ADDR'];
+        }
+        $proxy_headers = array(
+            'HTTP_CF_CONNECTING_IP',     // Cloudflare original IP
+            'HTTP_X_FORWARDED_FOR',      // Standard proxy chain
+            'HTTP_X_REAL_IP',            // Nginx proxy
+            'HTTP_CLIENT_IP'             // Some proxies
+        );
+        foreach ($proxy_headers as $header) {
+            if (!empty($_SERVER[$header])) {
+                $header_ips = array_map('trim', explode(',', $_SERVER[$header]));
+                foreach ($header_ips as $ip) {
+                    if (filter_var($ip, FILTER_VALIDATE_IP) && !in_array($ip, $all_ips)) {
+                        $all_ips[] = $ip;
+                    }
+                }
+            }
+        }
+        $req_ip = implode(',', $all_ips);
 
         $response = wp_remote_post( 'https://wpcommandcontrol.com/client/api/verify_request', [
@@ -35 +57 @@
                 'action' => 'verify_ips',
                 'verify' => $verify,
-                'req_ip' => $_SERVER['REMOTE_ADDR'],
+                'req_ip' => $req_ip,
             ],
         ]);