Security: Sanitize Remote IP address

Dunno quite how, but evidently, request.ip is manipulable. Make sure it consists of a dotted-quad.
Also, correct a typo from the previous revision.
This commit is contained in:
Jacques Distler 2008-03-14 10:50:06 -05:00
parent 827fb77ad3
commit d46798dd08
2 changed files with 2 additions and 2 deletions

View file

@ -412,7 +412,7 @@ class WikiController < ApplicationController
def remote_ip
ip = request.remote_ip
logger.info(ip)
ip
ip.gsub!(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/, '\1')
end
def render_atom(hide_description = false, limit = 15)

View file

@ -77,7 +77,7 @@ class Page < ActiveRecord::Base
# Returns the original wiki-word name as separate words, so "MyPage" becomes "My Page".
def plain_name
web.brackets_only? ? CGI.escapeHTML(name) : CGI.escapHTML(WikiWords.separate(name))
web.brackets_only? ? CGI.escapeHTML(name) : CGI.escapeHTML(WikiWords.separate(name))
end
LOCKING_PERIOD = 30.minutes