Skip to content

[feature/symfony-3] Cloudflare IPs remain authorized after uninstalling the package #6

@KorvinSzanto

Description

@KorvinSzanto

Let's adjust the feature/symfony-3 branch to work like this:

From @mlocati in #5

  • Usage

    1. concrete5 boots
    2. The request is told to trust the IPs stored in the concrete.security.trusted_proxies.ips configuration key
  • IP update/configuration (cf:ip:update command and/or Update Cloudflare IPs job)

    1. read the contents of a new cloudflare_proxy::ips.last_fetched config key (see later) (call it PreviousCloudFlare)
    2. fetch the CloudFlare IP addresses (call it NewCloudFlare)
    3. read the contents of concrete.security.trusted_proxies.ips configuration key (call it CurrentlyTrusted)
    4. from this last list, we remove the IPs read at point 1, and we add the IPs fetched at point 2 (call it NewlyTrusted)
    5. store NewlyTrusted in the concrete.security.trusted_proxies.ips configuration key
    6. store NewCloudFlare in the cloudflare_proxy::ips.last_fetched configuration key
  • After package uninstallation

    1. we remove from cloudflare_proxy::ips.last_fetched the IPs present in cloudflare_proxy::ips.last_fetched

With this approach, in addition to the previous pros of this pull request, we'll:

  • let users to add their trusted IP addresses by using the default concrete.security.trusted_proxies.ips configuration key (for example, via the GUI implemented in Add a dashboard page to configure trusted proxy IPs concretecms#6703)
  • have clean list of trusted IP addresses when the package is uninstalled (that is, Cloudflare IPs won't be trusted anymore)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions