mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-11-06 10:03:26 -08:00
46cdbac830
trusted_sources was checked with QString::contains. A dual-stack listener reports a local proxy as ::ffff:127.0.0.1, which never matches the default "127.0.0.1,::1". Behind nginx the forwarded client IP header was then ignored, every websocket user shared the proxy's address, and logins failed with "too many concurrent connections" once max_users_per_address was reached. Add isTrustedSource(), which parses each entry as a QHostAddress and compares exact addresses with IPv4-mapped addresses normalized, and use it at all four call sites. The ban command also read server/trusted_sources instead of the documented security/trusted_sources; it now uses the same getter. Entries that are not IP addresses are logged at startup since they no longer match anything. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
685 B
C++
23 lines
685 B
C++
#include "trusted_sources.h"
|
|
|
|
#include <QStringList>
|
|
|
|
bool isTrustedSource(const QString &trustedSources, const QHostAddress &address)
|
|
{
|
|
if (address.isNull()) {
|
|
return false;
|
|
}
|
|
const QStringList entries = trustedSources.split(',', Qt::SkipEmptyParts);
|
|
for (const QString &entry : entries) {
|
|
const QHostAddress trusted(entry.trimmed());
|
|
if (!trusted.isNull() && trusted.isEqual(address, QHostAddress::ConvertV4MappedToIPv4)) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
bool isTrustedSource(const QString &trustedSources, const QString &address)
|
|
{
|
|
return isTrustedSource(trustedSources, QHostAddress(address.trimmed()));
|
|
}
|