PLGVIR4-50: Hardening of getIpForwarded method (#45)

MultiSafepay · Sep 6, 2023 · 1949d92 · 1949d92
1 parent 4bdd724
commit 1949d92
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/plg_vmpayment_multisafepay/multisafepay/library/multisafepay.php b/plg_vmpayment_multisafepay/multisafepay/library/multisafepay.php
@@ -779,11 +779,16 @@ private function getReferrer(): string
      */
     private function getIpForwarded(): string
     {
-        $ip_forwarded = '';
         if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-            $ip_forwarded = filter_var($_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_VALIDATE_IP);
+            $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
+            foreach ($ips as $ip) {
+                $filtered_ip = filter_var(trim($ip), FILTER_VALIDATE_IP);
+                if ($filtered_ip !== false) {
+                    return $filtered_ip;
+                }
+            }
         }
-        return $ip_forwarded;
+        return '';
     }
 
     /**