From 11edf87f597a18298fc0290fa32f1cee44213132 Mon Sep 17 00:00:00 2001 From: ViolanteCodes Date: Wed, 24 Feb 2021 14:46:11 -0500 Subject: [PATCH 1/4] removed rate_limit_decorator for ip --- shared/middleware/__init__.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 shared/middleware/__init__.py diff --git a/shared/middleware/__init__.py b/shared/middleware/__init__.py new file mode 100644 index 0000000..e69de29 -- GitLab From 96d4153dc8dea2a4d49a37913f1f46d0593fb99f Mon Sep 17 00:00:00 2001 From: ViolanteCodes Date: Wed, 24 Feb 2021 14:46:27 -0500 Subject: [PATCH 2/4] added middlware fiel --- shared/middleware/reverse_proxy_ip.py | 40 +++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 shared/middleware/reverse_proxy_ip.py diff --git a/shared/middleware/reverse_proxy_ip.py b/shared/middleware/reverse_proxy_ip.py new file mode 100644 index 0000000..1c4442b --- /dev/null +++ b/shared/middleware/reverse_proxy_ip.py @@ -0,0 +1,40 @@ +from django.core.validators import validate_ipv46_address +from django.core.exceptions import ValidationError + + +class XForwardedForMiddleware: + """ + Set REMOTE_ADDR if it's missing because of a reverse proxy (nginx + gunicorn) deployment. + https://stackoverflow.com/questions/34251298/empty-remote-addr-value-in-django-application-when-using-nginx-as-reverse-proxy + """ + def __init__(self, get_response): + self.get_response = get_response + + def __call__(self, request): + if 'HTTP_X_FORWARDED_FOR' in request.META: + remote_addrs = request.META['HTTP_X_FORWARDED_FOR'].split(',') + remote_addr = None + + # for some bots, 'unknown' was prepended as the first value: `unknown, ***.***.***.***` + # in which case the second value actually is the correct one + for ip in remote_addrs: + ip = self._validated_ip(ip) + if ip is not None: + remote_addr = ip + break + + if remote_addr is None: + raise SuspiciousOperation('Malformed X-Forwarded-For.') + + request.META['HTTP_X_PROXY_REMOTE_ADDR'] = request.META['REMOTE_ADDR'] + request.META['REMOTE_ADDR'] = remote_addr + + return self.get_response(request) + + def _validated_ip(self, ip): + ip = ip.strip() + try: + validate_ipv46_address(ip) + except ValidationError: + return None + return ip \ No newline at end of file -- GitLab From aee2b58672b9e7cd452ff1850bdb9fab9ad83853 Mon Sep 17 00:00:00 2001 From: ViolanteCodes Date: Wed, 24 Feb 2021 14:46:33 -0500 Subject: [PATCH 3/4] added middleware to settings.py --- ticketlobby/settings.py | 1 + 1 file changed, 1 insertion(+) diff --git a/ticketlobby/settings.py b/ticketlobby/settings.py index ee319d6..d211d67 100644 --- a/ticketlobby/settings.py +++ b/ticketlobby/settings.py @@ -46,6 +46,7 @@ INSTALLED_APPS = [ ] MIDDLEWARE = [ + 'shared.middlware.reverse_proxy_ip.XForwardedForMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', -- GitLab From a876bfa21478f48f9901cb8fe030dfa650e722e8 Mon Sep 17 00:00:00 2001 From: ViolanteCodes Date: Wed, 24 Feb 2021 15:40:59 -0500 Subject: [PATCH 4/4] added middleware to settings.py --- ticketlobby/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ticketlobby/settings.py b/ticketlobby/settings.py index d211d67..7233e59 100644 --- a/ticketlobby/settings.py +++ b/ticketlobby/settings.py @@ -46,7 +46,7 @@ INSTALLED_APPS = [ ] MIDDLEWARE = [ - 'shared.middlware.reverse_proxy_ip.XForwardedForMiddleware', + 'shared.middleware.reverse_proxy_ip.XForwardedForMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', -- GitLab