Ticket #41083: 41083.1.diff

src/wp-admin/includes/class-wp-community-events.php

@@ -236 +236 @@
          *                      or false on failure.
          */
         public static function get_unsafe_client_ip() {
-                $client_ip = false;
+                $client_ip = $netmask = false;
 
                 // In order of preference, with the best ones for this purpose first.
                 $address_headers = array(
@@ -263 +263 @@
                         }
                 }
 
-                // These functions are not available on Windows until PHP 5.3.
-                if ( function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
-                        if ( 4 === strlen( inet_pton( $client_ip ) ) ) {
-                                $netmask = '255.255.255.0'; // ipv4.
-                        } else {
-                                $netmask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000'; // ipv6.
+                /*
+                 * The filter extension is enabled by default, but some configurations
+                 * disable it. Skipping this has the effect of disabling the IP geolocation,
+                 * but the user can still manually enter their location, so it's an acceptable
+                 * fallback.
+                 */
+                if ( $client_ip && function_exists( 'filter_var' ) ) {
+                        if ( filter_var( $client_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
+                                $ip_parts  = explode( ':', $client_ip );
+                                $client_ip = $ip_parts[0];
+                                $netmask   = '255.255.255.0';
+                        } elseif ( filter_var( $client_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) ) {
+                                // todo - $client_ip = $client_ip with ports stripped off
+                                $netmask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
                         }
+                }
 
+                // These functions are not available on Windows until PHP 5.3.
+                if ( $client_ip && $netmask && function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
                         $client_ip = inet_ntop( inet_pton( $client_ip ) & inet_pton( $netmask ) );
                 }
 

tests/phpunit/tests/admin/includesCommunityEvents.php

@@ -255 +255 @@
                         'filename' => '',
                 );
         }
+
+        /**
+         * Test that get_unsafe_client_ip() properly anonymizes all possible address formats
+         *
+         * @ticket 41083
+         * @since 4.8.1
+         */
+        public function test_get_unsafe_client_ip_anonymization() {
+                $test_cases = array(
+                        '127.0.0.1'                    => '127.0.0.0',              // Local IPv4
+                        '104.205.87.98'                => '104.205.87.0',           // Public IPv4
+                        '104.205.87.98:58749'          => '104.205.87.0',           // IPv4 with port
+                        '1fff:0:a88:85a3::ac1f'        => '1fff:0:a88:85a3::ac1f',  // IPv6
+                        '[1fff:0:a88:85a3::ac1f]:8001' => '1fff:0:a88:85a3::ac1f',  // IPv6 with port
+                        // todo - add test cases from https://github.com/geertw/php-ip-anonymizer
+                );
+
+                foreach ( $test_cases as $raw_ip => $expected_result ) {
+                        $_GET['REMOTE_ADDR'] = $raw_ip;
+                        $actual_result       = WP_Community_Events::get_unsafe_client_ip();
+
+                        $this->assertEquals( $expected_result, $actual_result );
+                }
+        }
 }