jQuery in Action, 3rd edition
The moose likes JForum and the fly likes Minor security issue with IP address detection... Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

Win a copy of Introducing JavaFX 8 Programming this week in the JavaFX forum!
JavaRanch » Java Forums » Products » JForum
Bookmark "Minor security issue with IP address detection..." Watch "Minor security issue with IP address detection..." New topic

Minor security issue with IP address detection...

Migrated From Jforum.net
Ranch Hand

Joined: Apr 22, 2012
Posts: 17424
Just a note to everyone that there is a minor security issue in the handling of IP addresses.
function public String getRemoteAddr() in src/net/jforum/context/web/WebRequestContext will try and get an IP address from the x-forwarded-for HTTP header. It is possible to send a fake header and therefore fake the IP address. A fake IP address can be targeted to any other user on the site, and by posting illegal content, they might be able to trick a mod into banning an IP address, and therefore banning an innocent user.
You can fix this by changing the content of this function to just:
return super.getRemoteAddr();
but this will return proxy server IP addresses instead of specific IP addresses, which could lead to innocent users getting blocked as well. It is probably marginally safer to use this option though as it prevents deliberate targeting of established innocent users and it prevents users from setting up unblockable abusive accounts.

Thanks again for the great forum software! I have not found any other security issues whilst auditing it so far
[originally posted on jforum.net by legoburner]
I agree. Here's the link: http://aspose.com/file-tools
subject: Minor security issue with IP address detection...
It's not a secret anymore!