Bug 1442520 - move inbound_proxies to localconfig

diff --git a/Bugzilla/Config/Advanced.pm b/Bugzilla/Config/Advanced.pm
index e2c00f9106aaa7ad088c15b7f832aa62871ee615..2eec11dbe19ee11d1511caeeaebe14348cb5f344 100644 (file)
--- a/Bugzilla/Config/Advanced.pm
+++ b/Bugzilla/Config/Advanced.pm
@@ -17,13 +17,6 @@ use Bugzilla::Util qw(validate_ip);
 our $sortkey = 1700;
 
 use constant get_param_list => (
-    {
-        name    => 'inbound_proxies',
-        type    => 't',
-        default => '',
-        checker => \&check_inbound_proxies
-    },
-
     {
         name    => 'proxy_url',
         type    => 't',
@@ -82,15 +75,4 @@ use constant get_param_list => (
     },
 );
 
-sub check_inbound_proxies {
-    my $inbound_proxies = shift;
-
-    return "" if $inbound_proxies eq "*";
-    my @proxies = split( /[\s,]+/, $inbound_proxies );
-    foreach my $proxy (@proxies) {
-        validate_ip($proxy) || return "$proxy is not a valid IPv4 or IPv6 address";
-    }
-    return "";
-}
-
 1;

diff --git a/Bugzilla/DaemonControl.pm b/Bugzilla/DaemonControl.pm
index 97ecb84e00e11e1c2071398f4de3d07271a07ec7..1de8350c1c49d7a49f4c1209d411c46790153eb8 100644 (file)
--- a/Bugzilla/DaemonControl.pm
+++ b/Bugzilla/DaemonControl.pm
@@ -10,6 +10,7 @@ use 5.10.1;
 use strict;
 use warnings;
 
+use Bugzilla::Logging;
 use Bugzilla::Constants qw(bz_locations);
 use Cwd qw(realpath);
 use English qw(-no_match_vars $PROGRAM_NAME);
@@ -131,16 +132,19 @@ sub run_httpd {
 sub run_cereal_and_httpd {
     my @httpd_args = @_;
 
-    my $lc = Bugzilla::Install::Localconfig::read_localconfig();
-    if ( ($lc->{inbound_proxies} // '') eq '*' && $lc->{urlbase} =~ /^https/) {
-        push @httpd_args, '-DHTTPS';
-    }
     push @httpd_args, '-DNETCAT_LOGS';
     my $signal_f      = catch_signal("TERM", 0);
     my $cereal_exit_f = run_cereal();
 
     return assert_cereal()->then(
         sub {
+            my $lc = Bugzilla::Install::Localconfig::read_localconfig();
+            if ( ($lc->{inbound_proxies} // '') eq '*' && $lc->{urlbase} =~ /^https/) {
+                push @httpd_args, '-DHTTPS';
+            }
+            elsif (not $lc->{urlbase} =~ /^https/) {
+                WARN("HTTPS urlbase but inbound_proxies is not '*'");
+            }
             my $httpd_exit_f  = run_httpd(@httpd_args);
 
             return Future->wait_any($cereal_exit_f, $httpd_exit_f, $signal_f);

diff --git a/Bugzilla/Install/Localconfig.pm b/Bugzilla/Install/Localconfig.pm
index 646dbc1a73f6054daae4564533484f719d88f25a..ba8e8dc578850cca5f6a29b4090b9b3c7e2cdd8f 100644 (file)
--- a/Bugzilla/Install/Localconfig.pm
+++ b/Bugzilla/Install/Localconfig.pm
@@ -43,7 +43,7 @@ our @EXPORT_OK = qw(
 
 # might want to change this for upstream
 use constant ENV_PREFIX     => 'BMO_';
-use constant PARAM_OVERRIDE => qw( inbound_proxies shadowdb shadowdbhost shadowdbport shadowdbsock );
+use constant PARAM_OVERRIDE => qw( shadowdb shadowdbhost shadowdbport shadowdbsock );
 
 sub _sensible_group {
     return '' if ON_WINDOWS;
@@ -135,7 +135,6 @@ use constant LOCALCONFIG_VARS => (
     {
         name    => 'param_override',
         default => {
-            inbound_proxies     => undef,
             memcached_servers   => undef,
             memcached_namespace => undef,
             shadowdb            => undef,
@@ -172,6 +171,10 @@ use constant LOCALCONFIG_VARS => (
         name    => 'ses_password',
         default => '',
     },
+    {
+        name => 'inbound_proxies',
+        default => _migrate_param( 'inbound_proxies', '' ),
+    },
 );
 
 

diff --git a/Bugzilla/Util.pm b/Bugzilla/Util.pm
index c23e738e66dbb24ae7f942be4ff55a467aa44b54..91f06e650d74951430c4863c4babb74d47fd97e7 100644 (file)
--- a/Bugzilla/Util.pm
+++ b/Bugzilla/Util.pm
@@ -270,7 +270,7 @@ sub do_ssl_redirect_if_required {
 # Returns the real remote address of the client,
 sub remote_ip {
     my $remote_ip       = $ENV{'REMOTE_ADDR'} || '127.0.0.1';
-    my @proxies         = split(/[\s,]+/, Bugzilla->get_param_with_override('inbound_proxies'));
+    my @proxies         = split(/[\s,]+/, Bugzilla->localconfig->{inbound_proxies});
     my @x_forwarded_for = split(/[\s,]+/, $ENV{HTTP_X_FORWARDED_FOR} // '');
 
     return $remote_ip unless @x_forwarded_for;

diff --git a/template/en/default/admin/params/advanced.html.tmpl b/template/en/default/admin/params/advanced.html.tmpl
index 75885b3f477169ae684338d3a4af7114793f2bf9..92c84d7031b7c0f20af4ef357d49065dd6976408 100644 (file)
--- a/template/en/default/admin/params/advanced.html.tmpl
+++ b/template/en/default/admin/params/advanced.html.tmpl
@@ -54,15 +54,6 @@
 [% END %]
 
 [% param_descs = {
-  inbound_proxies =>
-    "When inbound traffic to $terms.Bugzilla goes through a proxy,"
-    _ " $terms.Bugzilla thinks that the IP address of every single"
-    _ " user is the IP address of the proxy. If you enter a comma-separated"
-    _ " list of IPs in this parameter, then $terms.Bugzilla will trust any"
-    _ " <code>X-Forwarded-For</code> header sent from those IPs,"
-    _ " and use the value of that header as the end user's IP address."
-    _ " If set to a *, $terms.Bugzilla will trust the first value in the "
-    _ " X-Forwarded-For header.",
 
   proxy_url =>
     "$terms.Bugzilla may have to access the web to get notifications about"

diff --git a/template/en/default/setup/strings.txt.pl b/template/en/default/setup/strings.txt.pl
index ce4785b04fa96fc10ace06099bc6ff046228cf20..9de42697277362c93562d22c5007ff7095f194c6 100644 (file)
--- a/template/en/default/setup/strings.txt.pl
+++ b/template/en/default/setup/strings.txt.pl
@@ -180,6 +180,11 @@ END
 For the "Difference Between Two Patches" feature to work, we need to know
 what directory the "diff" bin is in. (You only need to set this if you
 are using that feature of the Patch Viewer.)
+END
+    localconfig_inbound_proxies => <<'END',
+This is a list of IP addresses that we expect proxies to come from.
+This can be '*' if only the load balancer can connect.
+Setting this to '*' means that we can trust the X-Forwarded-For header.
 END
     localconfig_index_html => <<'END',
 Most web servers will allow you to use index.cgi as a directory