trusted proxies

app/http/endpoints/api/panel/multipaneldelete.go

@@ -13,6 +13,7 @@ import (
 
 func MultiPanelDelete(ctx *gin.Context) {
 	guildId := ctx.Keys["guildid"].(uint64)
+	ctx.ClientIP()
 
 	multiPanelId, err := strconv.Atoi(ctx.Param("panelid"))
 	if err != nil {

app/http/server.go

@@ -31,6 +31,11 @@ func StartServer() {
 
 	router := gin.Default()
 
+	router.RemoteIPHeaders = append(router.RemoteIPHeaders, "CF-Connecting-IP")
+	if err := router.SetTrustedProxies(config.Conf.Server.TrustedProxies); err != nil {
+		panic(err)
+	}
+
 	// Sessions
 	session.Store = session.NewRedisStore()
 

config/config.go

@@ -22,12 +22,13 @@ type (
 	}
 
 	Server struct {
-		Host      string
-		BaseUrl   string
-		MainSite  string
-		Ratelimit Ratelimit
-		Session   Session
-		Secret    string
+		Host           string
+		BaseUrl        string
+		MainSite       string
+		Ratelimit      Ratelimit
+		Session        Session
+		Secret         string
+		TrustedProxies []string
 	}
 
 	Ratelimit struct {
@@ -137,6 +138,7 @@ func fromEnvvar() {
 				Secret:  os.Getenv("SESSION_SECRET"),
 			},
 			Secret: os.Getenv("JWT_SECRET"),
+			TrustedProxies: strings.Split(os.Getenv("TRUSTED_PROXIES"), ","),
 		},
 		Oauth: Oauth{
 			Id:          oauthId,

envvars.md

@@ -32,3 +32,4 @@
 - REDIS_PASSWORD
 - REDIS_THREADS
 - CACHE_URI
+- TRUSTED_PROXIES

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
 	github.com/gin-contrib/static v0.0.0-20191128031702-f81c604d8ac2
 	github.com/gin-gonic/contrib v0.0.0-20191209060500-d6e26eeaa607
-	github.com/gin-gonic/gin v1.7.1
+	github.com/gin-gonic/gin v1.7.2-0.20210726235953-11aa11a65618
 	github.com/go-redis/redis v6.15.9+incompatible
 	github.com/golang-jwt/jwt v3.2.1+incompatible
 	github.com/gorilla/sessions v1.2.0 // indirect