Kimirock/freescout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitize HTTP_CF_CONNECTING_IP in Request and escape values in Logs Monitor email - GHSA-9cm3-qvj2-8hg4

Browse Source
This commit is contained in:
FreeScout
2026-08-14 07:42:13 -07:00
parent 21768e1090
commit 0f41f5cabb
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Console/Commands/LogsMonitor.php
View File

@@ -103,18 +103,18 @@ class LogsMonitor extends Command
$text = 'Logs having new records for the last '.$options['alert_logs_period'].':<ul>';
foreach ($names as $name) {
$text .= '<li>';
$text .= '<strong>'.\App\ActivityLog::getLogTitle($name).'</strong>';
$text .= '<strong>'.htmlspecialchars(\App\ActivityLog::getLogTitle($name)).'</strong>';
$text .= '</li>';
}
$text .= '</ul>';
foreach ($names as $name) {
$text .= '<br/><strong>'.\App\ActivityLog::getLogTitle($name).'</strong><br/>';
$text .= '<br/><strong>'.htmlspecialchars(\App\ActivityLog::getLogTitle($name)).'</strong><br/>';
foreach ($logs as $log) {
if ($log->log_name != $name) {
continue;
}
$text .= '● ['.$log->created_at.'] '.$log->getEventDescription().' <code>'.$log->properties.'</code><br/>';
$text .= '● ['.$log->created_at.'] '.htmlspecialchars($log->getEventDescription()).' <code>'.htmlspecialchars($log->properties).'</code><br/>';
}
}
// Send alert.

2
overrides/symfony/http-foundation/Request.php
View File

@@ -894,6 +894,8 @@ class Request
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])
&& $_SERVER['REMOTE_ADDR'] != $_SERVER["HTTP_CF_CONNECTING_IP"]
&& config('app.cloudflare_is_used')
// https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4
&& \Helper::isValidIp($_SERVER["HTTP_CF_CONNECTING_IP"])
) {
$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
$this->server->set('REMOTE_ADDR', $_SERVER["HTTP_CF_CONNECTING_IP"]);