Proxy: change default offset to take final IP

docs/admin/config.rst

@@ -940,19 +940,24 @@ Defaults to ``HTTP_X_FORWARDED_FOR``.
 IP_PROXY_OFFSET
 ---------------
 
+.. versionchanged:: 5.0.1
+
+    The default changed from 1 to -1.
+
 Indicates which part of :setting:`IP_PROXY_HEADER` is used as client IP
 address.
 
 Depending on your setup, this header might consist of several IP addresses,
-(for example ``X-Forwarded-For: a, b, client-ip``) and you can configure
+(for example ``X-Forwarded-For: client-ip, proxy-a, proxy-b``) and you can configure
 which address from the header is used as client IP address here.
 
 .. warning::
 
    Setting this affects the security of your installation. You should only
    configure it to use trusted proxies for determining the IP address.
+   Please check <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#security_and_privacy_concerns> for more details.
 
-Defaults to 0.
+Defaults to -1.
 
 .. seealso::
 

docs/changes.rst

@@ -23,7 +23,7 @@ Not yet released.
 **Compatibility**
 
 * `pyahocorasick` dependency has been replaced by `ahocorasick_rs`.
-
+* The default value of :setting::`IP_PROXY_OFFSET` has been changed from 1 to -1.
 
 **Upgrading**
 

weblate/settings_docker.py

@@ -1001,7 +1001,7 @@
 # Reverse proxy settings
 IP_PROXY_HEADER = get_env_str("WEBLATE_IP_PROXY_HEADER")
 IP_BEHIND_REVERSE_PROXY = bool(IP_PROXY_HEADER)
-IP_PROXY_OFFSET = 0
+IP_PROXY_OFFSET = -1
 
 # Sending HTML in mails
 EMAIL_SEND_HTML = True

weblate/settings_example.py

@@ -669,7 +669,7 @@
 # Reverse proxy settings
 IP_PROXY_HEADER = "HTTP_X_FORWARDED_FOR"
 IP_BEHIND_REVERSE_PROXY = False
-IP_PROXY_OFFSET = 0
+IP_PROXY_OFFSET = -1
 
 # Sending HTML in mails
 EMAIL_SEND_HTML = True

weblate/trans/models/_conf.py

@@ -146,7 +146,7 @@ class WeblateConf(AppConf):
     # Rate limiting
     IP_BEHIND_REVERSE_PROXY = False
     IP_PROXY_HEADER = "HTTP_X_FORWARDED_FOR"
-    IP_PROXY_OFFSET = 0
+    IP_PROXY_OFFSET = -1
 
     # Authentication
     AUTH_TOKEN_VALID = 172800

weblate/utils/tests/test_middleware.py

@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from unittest import TestCase
+from unittest.mock import patch
 
 from django.http.request import HttpRequest
 from django.test.utils import override_settings
@@ -61,3 +62,17 @@ def test_proxy_invalid(self):
         request.META["HTTP_X_FORWARDED_FOR"] = "2.3.4"
         middleware = ProxyMiddleware(self.get_response)
         self.assertEqual(middleware(request), "response")
+
+    @override_settings(
+        IP_BEHIND_REVERSE_PROXY=True,
+        IP_PROXY_HEADER="HTTP_X_FORWARDED_FOR",
+        IP_PROXY_OFFSET=-1,
+    )
+    def test_proxy_invalid_last(self):
+        with patch("weblate.middleware.report_error") as mock_report_error:
+            request = HttpRequest()
+            request.META["REMOTE_ADDR"] = "1.2.3.4"
+            request.META["HTTP_X_FORWARDED_FOR"] = "2.3.4, 1.2.3.4"
+            middleware = ProxyMiddleware(self.get_response)
+            self.assertEqual(middleware(request), "response")
+            mock_report_error.assert_not_called()