-
Notifications
You must be signed in to change notification settings - Fork 5
Open
Description
Let's adjust the feature/symfony-3 branch to work like this:
Usage
- concrete5 boots
- The request is told to trust the IPs stored in the
concrete.security.trusted_proxies.ips
configuration keyIP update/configuration (
cf:ip:update
command and/orUpdate Cloudflare IPs
job)
- read the contents of a new
cloudflare_proxy::ips.last_fetched
config key (see later) (call itPreviousCloudFlare
)- fetch the CloudFlare IP addresses (call it
NewCloudFlare
)- read the contents of
concrete.security.trusted_proxies.ips
configuration key (call itCurrentlyTrusted
)- from this last list, we remove the IPs read at point 1, and we add the IPs fetched at point 2 (call it
NewlyTrusted
)- store
NewlyTrusted
in theconcrete.security.trusted_proxies.ips
configuration key- store
NewCloudFlare
in thecloudflare_proxy::ips.last_fetched
configuration keyAfter package uninstallation
- we remove from
cloudflare_proxy::ips.last_fetched
the IPs present incloudflare_proxy::ips.last_fetched
With this approach, in addition to the previous pros of this pull request, we'll:
- let users to add their trusted IP addresses by using the default
concrete.security.trusted_proxies.ips
configuration key (for example, via the GUI implemented in Add a dashboard page to configure trusted proxy IPs concretecms#6703)- have clean list of trusted IP addresses when the package is uninstalled (that is, Cloudflare IPs won't be trusted anymore)
Metadata
Metadata
Assignees
Labels
No labels