website: fix proxy configuration

timvideos · Jan 10, 2015 · 62452d6 · 62452d6
1 parent c1c5420
commit 62452d6
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 7 deletions.
diff --git a/website/conf/nginx.conf b/website/conf/nginx.conf
@@ -23,12 +23,12 @@ server {
 	}
 
 	location / {
-	    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Real-IP  $remote_addr;
-	    proxy_set_header Host $http_host;
-	    proxy_redirect off;
-
-	    proxy_pass   http://localhost:8000/;
+		# Use remote_addr here so clients can't inject their own additional
+		# X-Forwarded-For headers
+		proxy_set_header X-Forwarded-For $remote_addr;
+		proxy_set_header Host $http_host;
+		proxy_redirect off;
+		proxy_pass   http://localhost:8000/;
 	}
 }
 

diff --git a/website/frontend/views.py b/website/frontend/views.py
@@ -61,7 +61,7 @@ def group(request, group):
         template = "group"
         # Is the request coming from the room?
         for ipregex in LOCALIPS:
-            if ipregex.match(request.META['HTTP_X_REAL_IP']):
+            if ipregex.match(request.META[settings.HTTP_REMOTE_ADDR_META]):
                 template = 'inroom'
                 break
 

diff --git a/website/settings.py b/website/settings.py
@@ -182,6 +182,13 @@
 
 TEST_RUNNER = "django_testing_fixes.suite.TestSuiteRunner"
 
+# This is the field that is used to check the remote IP of a user.
+#  - Set to 'REMOTE_ADDR' if you want to use the IP of the host you're
+#    connecting from.
+#  - Set to 'HTTP_X_FORWARDED_FOR' if you have a reverse proxy.
+#
+HTTP_REMOTE_ADDR_META = 'REMOTE_ADDR'
+
 try:
     from private.settings import *
 except ImportError: