Ticket #41083: 41083.2.diff

src/wp-admin/includes/class-wp-community-events.php

@@ -224 +224 @@
          *                      or false on failure.
          */
         public static function get_unsafe_client_ip() {
-                $client_ip = false;
+                $client_ip = $netmask = false;
 
                 // In order of preference, with the best ones for this purpose first.
                 $address_headers = array(
@@ -237 +237 @@
                         'REMOTE_ADDR',
                 );
 
+                // Determine the best address to use
                 foreach ( $address_headers as $header ) {
                         if ( array_key_exists( $header, $_SERVER ) ) {
                                 /*
@@ -251 +252 @@
                         }
                 }
 
-                // These functions are not available on Windows until PHP 5.3.
-                if ( function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
-                        if ( 4 === strlen( inet_pton( $client_ip ) ) ) {
-                                $netmask = '255.255.255.0'; // ipv4.
-                        } else {
-                                $netmask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000'; // ipv6.
-                        }
+                $address_format = self::detect_ip_address_format( (string) $client_ip );
+
+                if ( ! $address_format ) {
+                        $client_ip = false;
+                }
 
+                if ( $client_ip ) {
+                        $client_ip = self::strip_ip_address_port( $client_ip, $address_format );
+                        $netmask   = 4 === $address_format ? '255.255.255.0' : 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
+                }
+
+                // Partially anonymize the IP by reducing it to the corresponding network ID
+                // These functions are not available on Windows until PHP 5.3.
+                if ( $client_ip && $netmask && function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
                         $client_ip = inet_ntop( inet_pton( $client_ip ) & inet_pton( $netmask ) );
                 }
 
@@ -266 +273 @@
         }
 
         /**
+         * Detect the format of an IP address.
+         *
+         * `filter_var()` is avoided because it can be disabled in PHP builds, and
+         * `WP_Http::is_ip_address()` is avoided because it will return false if the address
+         * contains a port number.
+         *
+         * A valid IPv4 address must have exactly 3 periods and at most 1 colon.
+         * A valid IPv6 address cannot have periods, and must have at least two colons (because
+         * addresses like `0:0:0:0:0:0:0:0` can be reduced to `::`).
+         *
+         * @param string $address
+         *
+         * @return false|int todo document false, 4, 6
+         */
+        protected static function detect_ip_address_format( $address ) {
+                $format = false;
+
+                if ( 3 === substr_count( $address, '.' ) ) {
+                        $format = 4;
+                } elseif ( substr_count( $address, ':' ) >= 2 ) {
+                        $format = 6;
+                }
+
+                return $format;
+        }
+
+        // todo document
+        protected static function strip_ip_address_port( $ip_address, $address_format ) {
+                if ( 4 === $address_format ) {
+                        $port_delimiter = strpos( $ip_address, ':' );
+
+                        if ( $port_delimiter ) {
+                                $ip_address = substr( $ip_address, 0, $port_delimiter );
+                        }
+                } elseif ( 6 === $address_format ) {
+                        $port_delimiter = strpos( $ip_address, ']' );
+
+                        if ( $port_delimiter ) {
+                                $ip_address = substr( $ip_address, 1, $port_delimiter - 1 );
+                                // todo verify it always has the brackets when there's a port
+                        }
+                }
+
+                return $ip_address;
+        }
+
+
+        /**
          * Test if two pairs of latitude/longitude coordinates match each other.
          *
          * @since 4.8.0

tests/phpunit/tests/admin/includesCommunityEvents.php

@@ -255 +255 @@
                         'filename' => '',
                 );
         }
+
+        /**
+         * Test that get_unsafe_client_ip() properly anonymizes all possible address formats
+         *
+         * @ticket 41083
+         * @since 4.8.1
+         */
+        public function test_get_unsafe_client_ip_anonymization() {
+                $test_cases = array(
+                        false                                      => false,                    // Invalid IP
+                        'unknown'                                  => false,                    // Invalid IP
+                        '10.20.30.45'                              => '10.20.30.0',             // IPv4, no port
+                        '10.20.30.45:20000'                        => '10.20.30.0',             // IPv4, port
+                        '2a03:2880:2110:df07:face:b00c::1'         => '2a03:2880:2110:df07::',  // IPv6, no port
+                        '[2a03:2880:2110:df07:face:b00c::1]:20000' => '2a03:2880:2110:df07::',  // IPv6, port
+                        '::'                                       => '::',                     // IPv6, no port, reduced representation
+                        '[::]:20000'                               => '::',                     // IPv6, port, reduced representation
+                );
+
+                foreach ( $test_cases as $raw_ip => $expected_result ) {
+                        $_SERVER['REMOTE_ADDR'] = $raw_ip;
+                        $actual_result          = WP_Community_Events::get_unsafe_client_ip();
+
+                        $this->assertEquals( $expected_result, $actual_result );
+                }
+        }
 }