From b17aaae81139cdbe4452b498400d125d77cafbfc Mon Sep 17 00:00:00 2001 From: Keenan Brock Date: Fri, 3 Jan 2020 13:32:44 -0500 Subject: [PATCH] trusted IP changelog --- actionpack/CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index bdd81f41ff..62de6f949a 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -1,3 +1,9 @@ +* `ActionDispatch::Request.remote_ip` has ip address even when all sites are trusted. + + Before, if all `X-Forwarded-For` sites were trusted, the `remote_ip` would default to `127.0.0.1`. + Now, the furthest proxy site is used. e.g.: It now gives an ip address when using curl from the load balancer. + + *Keenan Brock* * Fix possible information leak / session hijacking vulnerability. The `ActionDispatch::Session::MemcacheStore` is still vulnerable given it requires the -- GitLab