Remove Request::getIp()

[akrabat]

This method was using the 'X-Forwarded-For' header which is unsafe as it's client settable. A better solution is to use middleware that sets an "ip" attribute onto the Request object.

Resolves #1528

[silentworks]

I am going to leave this on hold for the minute. We need to check the impact this is going to have and find a viable solution to suggest to people first.

[akrabat]

This is a stab at doing it in middleware: https://github.com/akrabat/rka-ip-address-middleware

[piotr-cz]

Good catch.

[piotr-cz]

For the exact same reason the check for secure connection shouldn't be based on the HTTP_X_FORWARDED_PROTO header inside the Uri class (more details are here).

Anyway base path resolution is wrong determining when using server rewrites (the L flag in .htaccess file).
There should be an option to define base path (and possibly secure connection) as an application setting which can be read from an environment variable.

[akrabat]

Anyway base path resolution is wrong determining when using server rewrites (the L flag in .htaccess file).
There should be an option to define base path (and possibly secure connection) as an application setting which can be read from an environment variable.

Please open as a separate issue with the apache rewrite settings the show the problem.

[akrabat]

See #1567 for the Uri() usage of HTTP_X_FORWARDED_PROTO.