From 274481bc77ba6ba3d529ab3736603ff43215e24a Mon Sep 17 00:00:00 2001
From: rxdn <29165304+rxdn@users.noreply.github.com>
Date: Fri, 30 Jul 2021 18:28:34 +0100
Subject: [PATCH] trusted proxies

---
 app/http/endpoints/api/panel/multipaneldelete.go |  1 +
 app/http/server.go                               |  5 +++++
 config/config.go                                 | 14 ++++++++------
 envvars.md                                       |  1 +
 go.mod                                           |  2 +-
 5 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/app/http/endpoints/api/panel/multipaneldelete.go b/app/http/endpoints/api/panel/multipaneldelete.go
index 38cf4be..da73f8e 100644
--- a/app/http/endpoints/api/panel/multipaneldelete.go
+++ b/app/http/endpoints/api/panel/multipaneldelete.go
@@ -13,6 +13,7 @@ import (
 
 func MultiPanelDelete(ctx *gin.Context) {
 	guildId := ctx.Keys["guildid"].(uint64)
+	ctx.ClientIP()
 
 	multiPanelId, err := strconv.Atoi(ctx.Param("panelid"))
 	if err != nil {
diff --git a/app/http/server.go b/app/http/server.go
index 030476b..2bc8194 100644
--- a/app/http/server.go
+++ b/app/http/server.go
@@ -31,6 +31,11 @@ func StartServer() {
 
 	router := gin.Default()
 
+	router.RemoteIPHeaders = append(router.RemoteIPHeaders, "CF-Connecting-IP")
+	if err := router.SetTrustedProxies(config.Conf.Server.TrustedProxies); err != nil {
+		panic(err)
+	}
+
 	// Sessions
 	session.Store = session.NewRedisStore()
 
diff --git a/config/config.go b/config/config.go
index f70cb70..faa6b6c 100644
--- a/config/config.go
+++ b/config/config.go
@@ -22,12 +22,13 @@ type (
 	}
 
 	Server struct {
-		Host      string
-		BaseUrl   string
-		MainSite  string
-		Ratelimit Ratelimit
-		Session   Session
-		Secret    string
+		Host           string
+		BaseUrl        string
+		MainSite       string
+		Ratelimit      Ratelimit
+		Session        Session
+		Secret         string
+		TrustedProxies []string
 	}
 
 	Ratelimit struct {
@@ -137,6 +138,7 @@ func fromEnvvar() {
 				Secret:  os.Getenv("SESSION_SECRET"),
 			},
 			Secret: os.Getenv("JWT_SECRET"),
+			TrustedProxies: strings.Split(os.Getenv("TRUSTED_PROXIES"), ","),
 		},
 		Oauth: Oauth{
 			Id:          oauthId,
diff --git a/envvars.md b/envvars.md
index 15fdcaf..600f7fc 100644
--- a/envvars.md
+++ b/envvars.md
@@ -32,3 +32,4 @@
 - REDIS_PASSWORD
 - REDIS_THREADS
 - CACHE_URI
+- TRUSTED_PROXIES
diff --git a/go.mod b/go.mod
index efdec5b..32771a6 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
 	github.com/gin-contrib/static v0.0.0-20191128031702-f81c604d8ac2
 	github.com/gin-gonic/contrib v0.0.0-20191209060500-d6e26eeaa607
-	github.com/gin-gonic/gin v1.7.1
+	github.com/gin-gonic/gin v1.7.2-0.20210726235953-11aa11a65618
 	github.com/go-redis/redis v6.15.9+incompatible
 	github.com/golang-jwt/jwt v3.2.1+incompatible
 	github.com/gorilla/sessions v1.2.0 // indirect