| @@ -1493,36 +1493,15 @@ | ||
| 1493 | 1493 | |
| 1494 | 1494 | /** |
| 1495 | 1495 | * Get client IP address |
| 1496 | 1496 | * |
| 1497 | + * Uses REMOTE_ADDR only to prevent IP spoofing via X-Forwarded-For headers. | |
| 1498 | + * | |
| 1497 | 1499 | * @return string|null |
| 1498 | 1500 | */ |
| 1499 | 1501 | private function get_client_ip() { |
| 1500 | - $ip_keys = [ | |
| 1501 | - 'HTTP_CF_CONNECTING_IP', | |
| 1502 | - 'HTTP_CLIENT_IP', | |
| 1503 | - 'HTTP_X_FORWARDED_FOR', | |
| 1504 | - 'HTTP_X_FORWARDED', | |
| 1505 | - 'HTTP_X_CLUSTER_CLIENT_IP', | |
| 1506 | - 'HTTP_FORWARDED_FOR', | |
| 1507 | - 'HTTP_FORWARDED', | |
| 1508 | - 'REMOTE_ADDR', | |
| 1509 | - ]; | |
| 1510 | - | |
| 1511 | - foreach ( $ip_keys as $key ) { | |
| 1512 | - if ( ! empty( $_SERVER[ $key ] ) ) { | |
| 1513 | - $ip = sanitize_text_field( $_SERVER[ $key ] ); | |
| 1514 | - // Handle comma-separated list (X-Forwarded-For) | |
| 1515 | - if ( strpos( $ip, ',' ) !== false ) { | |
| 1516 | - $ip = trim( explode( ',', $ip )[0] ); | |
| 1517 | - } | |
| 1518 | - if ( filter_var( $ip, FILTER_VALIDATE_IP ) ) { | |
| 1519 | - return $ip; | |
| 1520 | - } | |
| 1521 | - } | |
| 1522 | - } | |
| 1523 | - | |
| 1524 | - return null; | |
| 1502 | + $ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ); | |
| 1503 | + return filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : null; | |
| 1525 | 1504 | } |
| 1526 | 1505 | |
| 1527 | 1506 | /** |
| 1528 | 1507 | * Get action type display label |
