Ticket #41083: 41083.diff

src/wp-admin/includes/class-wp-community-events.php

@@ -233 +233 @@
          *                      or false on failure.
          */
         public static function get_unsafe_client_ip() {
-                $client_ip = false;
+                $client_ip = $netmask = false;
+                $ip_prefix = '';
 
                 // In order of preference, with the best ones for this purpose first.
                 $address_headers = array(
@@ -260 +261 @@
                         }
                 }
 
-                // These functions are not available on Windows until PHP 5.3.
-                if ( function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
-                        if ( 4 === strlen( inet_pton( $client_ip ) ) ) {
-                                $netmask = '255.255.255.0'; // ipv4.
-                        } else {
-                                $netmask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000'; // ipv6.
-                        }
+                if ( ! $client_ip ) {
+                        return false;
+                }
+
+                // Detect what kind of IP address this is
+                $is_ipv6 = substr_count( $client_ip, ':' ) > 1;
+                $is_ipv4 = ( 3 === substr_count( $client_ip, '.' ) );
+
+                if ( $is_ipv6 && $is_ipv4 ) {
+                        // IPv6 compatibility mode, strip the IPv6 part, and treat it like IPv4
+                        $ip_prefix = '::ffff:';
+                        $client_ip = preg_replace( '/^\[?[0-9a-f:]*:/i', '', $client_ip );
+                        $client_ip = str_replace( ']', '', $client_ip );
+                        $is_ipv6   = false;
+                }
 
+                if ( $is_ipv6 ) {
+                        // IPv6 addresses will always be enclosed in [] if there's a port
+                        $ip_start = 1;
+                        $ip_end   = (int) strpos( $client_ip, ']' ) - 1;
+                        $netmask  = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
+                } elseif ( $is_ipv4 ) {
+                        // IPv4 addresses will have a : if there's a port
+                        $ip_start = 0;
+                        $ip_end   = (int) strpos( $client_ip, ':' );
+                        $netmask  = '255.255.255.0';
+                } else {
+                        return false;
+                }
+
+                // Strip the port (and [] from IPv6 addresses), if they exist.
+                if ( $ip_end > 0 ) {
+                        $client_ip = substr( $client_ip, $ip_start, $ip_end );
+                }
+
+                // Partially anonymize the IP by reducing it to the corresponding network ID
+                // These functions are not available on Windows until PHP 5.3.
+                if ( $client_ip && function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {
                         $client_ip = inet_ntop( inet_pton( $client_ip ) & inet_pton( $netmask ) );
                 }
 
-                return $client_ip;
+                return $ip_prefix . $client_ip;
         }
 
         /**

tests/phpunit/tests/admin/includesCommunityEvents.php

@@ -255 +255 @@
                         'filename' => '',
                 );
         }
+
+        /**
+         * Test that get_unsafe_client_ip() properly anonymizes all possible address formats
+         *
+         * @dataProvider data_get_unsafe_client_ip_anonymization
+         *
+         * @ticket 41083
+         */
+        public function test_get_unsafe_client_ip_anonymization( $raw_ip, $expected_result ) {
+                $_SERVER['REMOTE_ADDR'] = $raw_ip;
+                $actual_result          = WP_Community_Events::get_unsafe_client_ip();
+
+                $this->assertEquals( $expected_result, $actual_result );
+        }
+
+        public function data_get_unsafe_client_ip_anonymization() {
+                return array(
+                        // Invalid IP.
+                        array(
+                                '',    // Raw IP address
+                                false, // Expected result
+                        ),
+                        // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'unknown',
+                                false,
+                        ),
+                        // IPv4, no port
+                        array(
+                                '10.20.30.45',
+                                '10.20.30.0',
+                        ),
+                        // IPv4, port
+                        array(
+                                '10.20.30.45:20000',
+                                '10.20.30.0',
+                        ),
+                        // IPv6, no port
+                        array(
+                                '2a03:2880:2110:df07:face:b00c::1',
+                                '2a03:2880:2110:df07::',
+                        ),
+                        // IPv6, port
+                        array(
+                                '[2a03:2880:2110:df07:face:b00c::1]:20000',
+                                '2a03:2880:2110:df07::',
+                        ),
+                        // IPv6, no port, reducible representation
+                        array(
+                                '0000:0000:0000:0000:0000:0000:0000:0001',
+                                '::',
+                        ),
+                        // IPv6, no port, partially reducible representation
+                        array(
+                                '1000:0000:0000:0000:0000:0000:0000:0001',
+                                '1000::',
+                        ),
+                        // IPv6, port, reducible representation
+                        array(
+                                '[0000:0000:0000:0000:0000:0000:0000:0001]:1234',
+                                '::',
+                        ),
+                        // IPv6, port, partially reducible representation
+                        array(
+                                '[1000:0000:0000:0000:0000:0000:0000:0001]:5678',
+                                '1000::',
+                        ),
+                        // IPv6, no port, reduced representation
+                        array(
+                                '::',
+                                '::',
+                        ),
+                        // IPv6, no port, reduced representation
+                        array(
+                                '::1',
+                                '::',
+                        ),
+                        // IPv6, port, reduced representation
+                        array(
+                                '[::]:20000',
+                                '::',
+                        ),
+                        // IPv6, address brackets without port delimiter and number, reduced representation
+                        array(
+                                '[::1]',
+                                '::',
+                        ),
+                        // IPv6, no port, compatibility mode
+                        array(
+                                '::ffff:10.15.20.25',
+                                '::ffff:10.15.20.0',
+                        ),
+                        // IPv6, port, compatibility mode
+                        array(
+                                '[::ffff:10.15.20.25]:30000',
+                                '::ffff:10.15.20.0',
+                        ),
+                        // IPv6, no port, compatibility mode shorthand
+                        array(
+                                '::127.0.0.1',
+                                '::ffff:127.0.0.0',
+                        ),
+                        // IPv6, port, compatibility mode shorthand
+                        array(
+                                '[::127.0.0.1]:30000',
+                                '::ffff:127.0.0.0',
+                        ),
+                );
+        }
 }