This commit is contained in:
Javier Casares 2026-08-10 16:21:45 +00:00
commit cc1bca74fa
29 changed files with 770 additions and 204 deletions

View file

@ -300,18 +300,21 @@ class Logger {
/**
* Get client IP address.
*
* Validates the address with filter_var() so malformed or spoofed
* REMOTE_ADDR values are rejected rather than sanitised into garbage.
*
* @since 0.3.1
*
* @return string Client IP address.
* @return string Client IP address, or empty string if invalid.
*/
private function get_client_ip(): string {
$ip = '';
if ( isset( $_SERVER['REMOTE_ADDR'] ) && is_string( $_SERVER['REMOTE_ADDR'] ) ) {
$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
if ( ! isset( $_SERVER['REMOTE_ADDR'] ) || ! is_string( $_SERVER['REMOTE_ADDR'] ) ) {
return '';
}
return $ip;
$valid_ip = filter_var( wp_unslash( $_SERVER['REMOTE_ADDR'] ), FILTER_VALIDATE_IP );
return is_string( $valid_ip ) ? $valid_ip : '';
}
/**