diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php index 4a47369e1..44ec47d6d 100644 --- a/classes/context/Context.class.php +++ b/classes/context/Context.class.php @@ -1478,7 +1478,7 @@ class Context } // Allow if the current user is in the list of allowed IPs. - if (Rhymix\Framework\IpFilter::inRanges(RX_CLIENT_IP, config('lock.allow'))) + if (Rhymix\Framework\Security\IpFilter::inRanges(RX_CLIENT_IP, config('lock.allow'))) { return; } diff --git a/classes/security/IpFilter.class.php b/classes/security/IpFilter.class.php index 455485329..23159dc79 100644 --- a/classes/security/IpFilter.class.php +++ b/classes/security/IpFilter.class.php @@ -6,12 +6,12 @@ class IpFilter public function filter($ip_list, $ip = NULL) { if(!$ip) $ip = $_SERVER['REMOTE_ADDR']; - return Rhymix\Framework\IpFilter::inRanges($ip, $ip_list); + return Rhymix\Framework\Security\IpFilter::inRanges($ip, $ip_list); } public function validate($ip_list = array()) { - return Rhymix\Framework\IpFilter::validateRanges($ip_list); + return Rhymix\Framework\Security\IpFilter::validateRanges($ip_list); } } diff --git a/common/constants.php b/common/constants.php index cab1fd256..d3d992896 100644 --- a/common/constants.php +++ b/common/constants.php @@ -53,8 +53,8 @@ else */ if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) { - include_once __DIR__ . '/framework/ipfilter.php'; - Rhymix\Framework\IpFilter::getCloudFlareRealIP(); + include_once __DIR__ . '/framework/security/ipfilter.php'; + Rhymix\Framework\Security\IpFilter::getCloudFlareRealIP(); } if (isset($_SERVER['REMOTE_ADDR']) && preg_match('/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/', $_SERVER['REMOTE_ADDR'], $matches)) { diff --git a/common/framework/debug.php b/common/framework/debug.php index dd2cee5a4..4c69a4484 100644 --- a/common/framework/debug.php +++ b/common/framework/debug.php @@ -445,7 +445,7 @@ class Debug return $cache = true; case 'ip': - if (IpFilter::inRanges(RX_CLIENT_IP, Config::get('debug.allow'))) + if (Security\IpFilter::inRanges(RX_CLIENT_IP, Config::get('debug.allow'))) { return $cache = true; } diff --git a/common/framework/ipfilter.php b/common/framework/security/ipfilter.php similarity index 99% rename from common/framework/ipfilter.php rename to common/framework/security/ipfilter.php index e80170974..b52f13ac1 100644 --- a/common/framework/ipfilter.php +++ b/common/framework/security/ipfilter.php @@ -1,6 +1,6 @@ sitelock_locked === 'Y') { - if (!Rhymix\Framework\IpFilter::inRanges('127.0.0.1', $allowed_ip)) + if (!Rhymix\Framework\Security\IpFilter::inRanges('127.0.0.1', $allowed_ip)) { array_unshift($allowed_ip, '127.0.0.1'); } - if (!Rhymix\Framework\IpFilter::inRanges(RX_CLIENT_IP, $allowed_ip)) + if (!Rhymix\Framework\Security\IpFilter::inRanges(RX_CLIENT_IP, $allowed_ip)) { array_unshift($allowed_ip, RX_CLIENT_IP); } } - if (!Rhymix\Framework\IpFilter::validateRanges($allowed_ip)) + if (!Rhymix\Framework\Security\IpFilter::validateRanges($allowed_ip)) { return new Object(-1, 'msg_invalid_ip'); } diff --git a/modules/admin/admin.admin.view.php b/modules/admin/admin.admin.view.php index 6cac017c9..a74801f38 100644 --- a/modules/admin/admin.admin.view.php +++ b/modules/admin/admin.admin.view.php @@ -518,11 +518,11 @@ class adminAdminView extends admin Context::set('sitelock_message', escape(Rhymix\Framework\Config::get('lock.message'))); $allowed_ip = Rhymix\Framework\Config::get('lock.allow') ?: array(); - if (!Rhymix\Framework\IpFilter::inRanges('127.0.0.1', $allowed_ip)) + if (!Rhymix\Framework\Security\IpFilter::inRanges('127.0.0.1', $allowed_ip)) { array_unshift($allowed_ip, '127.0.0.1'); } - if (!Rhymix\Framework\IpFilter::inRanges(RX_CLIENT_IP, $allowed_ip)) + if (!Rhymix\Framework\Security\IpFilter::inRanges(RX_CLIENT_IP, $allowed_ip)) { array_unshift($allowed_ip, RX_CLIENT_IP); } diff --git a/modules/member/member.admin.model.php b/modules/member/member.admin.model.php index 0c0c59887..8e9682bb6 100644 --- a/modules/member/member.admin.model.php +++ b/modules/member/member.admin.model.php @@ -298,12 +298,12 @@ class memberAdminModel extends member { if ($allow_list = ($allow_list === null) ? config('admin.allow') : $allow_list) { - return Rhymix\Framework\IpFilter::inRanges(RX_CLIENT_IP, $allow_list); + return Rhymix\Framework\Security\IpFilter::inRanges(RX_CLIENT_IP, $allow_list); } if ($deny_list = ($deny_list === null) ? config('admin.deny') : $deny_list) { - return !Rhymix\Framework\IpFilter::inRanges(RX_CLIENT_IP, $deny_list); + return !Rhymix\Framework\Security\IpFilter::inRanges(RX_CLIENT_IP, $deny_list); } return true; diff --git a/tests/unit/framework/IpFilterTest.php b/tests/unit/framework/IpFilterTest.php deleted file mode 100644 index 13bb96318..000000000 --- a/tests/unit/framework/IpFilterTest.php +++ /dev/null @@ -1,77 +0,0 @@ -assertTrue(Rhymix\Framework\IpFilter::inRange('10.0.127.191', '10.0.127.191')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('10.1.131.177', '10.1.131.178')); - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('127.0.0.1', '127.0.0.0/8')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('172.34.0.0', '172.16.0.0/12')); - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('192.168.18.214', '192.168.16.0/22')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('192.168.18.214', '192.168.16.0/23')); - } - - public function testIPv6CIDR() - { - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('::1', '::1/128')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('::1', '::2')); - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('2400:cb00::1234', '2400:cb00::/32')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('2405:8100::1234', '2400:cb00::/32')); - } - - public function testIPv4Wildcard() - { - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.134.*')); - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.*.*')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.136.*')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.172.*.*')); - } - - public function testIPv4Hyphen() - { - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.134.0-192.168.134.255')); - $this->assertTrue(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.128.16-192.168.145.0')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.134.242-192.168.244.7')); - $this->assertFalse(Rhymix\Framework\IpFilter::inRange('192.168.134.241', '192.168.100.255-192.168.133.19')); - } - - public function testValidator() - { - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('192.168.0.1')); - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('192.168.0.0/16')); - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('192.168.*.*')); - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('192.168.*')); - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('192.168.0.0-192.168.255.255')); - $this->assertTrue(Rhymix\Framework\IpFilter::validateRange('2400:cb00::/32')); - $this->assertFalse(Rhymix\Framework\IpFilter::validateRange('192.168.0.0~192.168.255.255')); - } - - public function testLegacy() - { - $this->assertTrue(\IpFilter::filter(array('192.168.134.241'), '192.168.134.241')); - $this->assertTrue(\IpFilter::filter(array('192.168.134.0-192.168.134.255'), '192.168.134.241')); - $this->assertTrue(\IpFilter::filter(array('127.0.0.1', '192.168.134.241'), '192.168.134.241')); - $this->assertTrue(\IpFilter::filter(array('192.168.134.*'), '192.168.134.241')); - $this->assertTrue(\IpFilter::filter(array('192.168.*'), '192.168.134.241')); - $this->assertFalse(\IpFilter::filter(array('127.0.0.1'), '192.168.134.241')); - } - - public function testCloudFlareRealIP() - { - $_SERVER['HTTP_CF_CONNECTING_IP'] = '192.168.134.241'; - - $_SERVER['REMOTE_ADDR'] = '192.168.10.1'; - $this->assertFalse(Rhymix\Framework\IpFilter::getCloudFlareRealIP()); - $this->assertEquals('192.168.10.1', $_SERVER['REMOTE_ADDR']); - - $_SERVER['REMOTE_ADDR'] = '108.162.192.121'; - $this->assertEquals('192.168.134.241', Rhymix\Framework\IpFilter::getCloudFlareRealIP()); - $this->assertEquals('192.168.134.241', $_SERVER['REMOTE_ADDR']); - - unset($_SERVER['HTTP_CF_CONNECTING_IP']); - $_SERVER['REMOTE_ADDR'] = '192.168.10.1'; - $this->assertFalse(Rhymix\Framework\IpFilter::getCloudFlareRealIP()); - $this->assertEquals('192.168.10.1', $_SERVER['REMOTE_ADDR']); - } -} diff --git a/tests/unit/framework/security/IpFilterTest.php b/tests/unit/framework/security/IpFilterTest.php new file mode 100644 index 000000000..235939253 --- /dev/null +++ b/tests/unit/framework/security/IpFilterTest.php @@ -0,0 +1,77 @@ +assertTrue(Rhymix\Framework\Security\IpFilter::inRange('10.0.127.191', '10.0.127.191')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('10.1.131.177', '10.1.131.178')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('127.0.0.1', '127.0.0.0/8')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('172.34.0.0', '172.16.0.0/12')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('192.168.18.214', '192.168.16.0/22')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('192.168.18.214', '192.168.16.0/23')); + } + + public function testIPv6CIDR() + { + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('::1', '::1/128')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('::1', '::2')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('2400:cb00::1234', '2400:cb00::/32')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('2405:8100::1234', '2400:cb00::/32')); + } + + public function testIPv4Wildcard() + { + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.134.*')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.*.*')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.136.*')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.172.*.*')); + } + + public function testIPv4Hyphen() + { + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.134.0-192.168.134.255')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.128.16-192.168.145.0')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.134.242-192.168.244.7')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::inRange('192.168.134.241', '192.168.100.255-192.168.133.19')); + } + + public function testValidator() + { + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('192.168.0.1')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('192.168.0.0/16')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('192.168.*.*')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('192.168.*')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('192.168.0.0-192.168.255.255')); + $this->assertTrue(Rhymix\Framework\Security\IpFilter::validateRange('2400:cb00::/32')); + $this->assertFalse(Rhymix\Framework\Security\IpFilter::validateRange('192.168.0.0~192.168.255.255')); + } + + public function testLegacy() + { + $this->assertTrue(\IpFilter::filter(array('192.168.134.241'), '192.168.134.241')); + $this->assertTrue(\IpFilter::filter(array('192.168.134.0-192.168.134.255'), '192.168.134.241')); + $this->assertTrue(\IpFilter::filter(array('127.0.0.1', '192.168.134.241'), '192.168.134.241')); + $this->assertTrue(\IpFilter::filter(array('192.168.134.*'), '192.168.134.241')); + $this->assertTrue(\IpFilter::filter(array('192.168.*'), '192.168.134.241')); + $this->assertFalse(\IpFilter::filter(array('127.0.0.1'), '192.168.134.241')); + } + + public function testCloudFlareRealIP() + { + $_SERVER['HTTP_CF_CONNECTING_IP'] = '192.168.134.241'; + + $_SERVER['REMOTE_ADDR'] = '192.168.10.1'; + $this->assertFalse(Rhymix\Framework\Security\IpFilter::getCloudFlareRealIP()); + $this->assertEquals('192.168.10.1', $_SERVER['REMOTE_ADDR']); + + $_SERVER['REMOTE_ADDR'] = '108.162.192.121'; + $this->assertEquals('192.168.134.241', Rhymix\Framework\Security\IpFilter::getCloudFlareRealIP()); + $this->assertEquals('192.168.134.241', $_SERVER['REMOTE_ADDR']); + + unset($_SERVER['HTTP_CF_CONNECTING_IP']); + $_SERVER['REMOTE_ADDR'] = '192.168.10.1'; + $this->assertFalse(Rhymix\Framework\Security\IpFilter::getCloudFlareRealIP()); + $this->assertEquals('192.168.10.1', $_SERVER['REMOTE_ADDR']); + } +}