| @@ -507,26 +507,15 @@ | ||
| 507 | 507 | |
| 508 | 508 | /** |
| 509 | 509 | * Get the current user's IP address |
| 510 | 510 | * |
| 511 | + * Uses REMOTE_ADDR only to prevent IP spoofing via X-Forwarded-For headers. | |
| 512 | + * | |
| 511 | 513 | * @return string|null IP address or null if not available |
| 512 | 514 | */ |
| 513 | 515 | private function get_user_ip() { |
| 514 | - // Check for forwarded IP first (behind proxy/load balancer) | |
| 515 | - $headers = [ 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'REMOTE_ADDR' ]; | |
| 516 | - foreach( $headers as $header ) { | |
| 517 | - if( ! empty( $_SERVER[ $header ] ) ) { | |
| 518 | - $ip = $_SERVER[ $header ]; | |
| 519 | - // HTTP_X_FORWARDED_FOR can contain multiple IPs, get the first one | |
| 520 | - if( strpos( $ip, ',' ) !== false ) { | |
| 521 | - $ip = trim( explode( ',', $ip )[0] ); | |
| 522 | - } | |
| 523 | - if( filter_var( $ip, FILTER_VALIDATE_IP ) ) { | |
| 524 | - return $ip; | |
| 525 | - } | |
| 526 | - } | |
| 527 | - } | |
| 528 | - return null; | |
| 516 | + $ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ); | |
| 517 | + return filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : null; | |
| 529 | 518 | } |
| 530 | 519 | |
| 531 | 520 | /** |
| 532 | 521 | * Get post count for a user since a specific time |
