Proxy endpoint was checking real client ip instead of proxy ip

for validating PROXY_AUTH_WHITELIST

core/admin/mailu/sso/views/base.py

@@ -92,9 +92,10 @@ def _has_usable_redirect():
 https://mailu.io/master/configuration.html#header-authentication-using-an-external-proxy
 """
 def _proxy():
-    ip = ipaddress.ip_address(flask.request.remote_addr)
+    proxy_ip = flask.request.headers.get('X-Forwarded-By')
+    ip = ipaddress.ip_address(proxy_ip)
     if not any(ip in cidr for cidr in app.config['PROXY_AUTH_WHITELIST']):
-        return flask.abort(500, '%s is not on PROXY_AUTH_WHITELIST' % flask.request.remote_addr)
+        return flask.abort(500, '%s is not on PROXY_AUTH_WHITELIST' % proxy_ip)
 
     email = flask.request.headers.get(app.config['PROXY_AUTH_HEADER'])
     if not email:

core/nginx/conf/nginx.conf

@@ -231,6 +231,7 @@ http {
         auth_request /internal/auth/admin;
         proxy_set_header X-Real-IP "";
         proxy_set_header X-Forwarded-For "";
+        proxe_set_header X-Forwarded-By: "";
         proxy_pass http://$antispam;
         error_page 403 @sso_login;
       }

core/nginx/conf/proxy.conf

@@ -7,6 +7,7 @@ proxy_hide_header CF-Connecting-IP;
 proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
 {% if REAL_IP_HEADER and REAL_IP_FROM %}
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-By $realip_remote_addr;
 {% else %}
 proxy_set_header X-Forwarded-For $remote_addr;
 {% endif %}

towncrier/newsfragments/2708.bugfix

@@ -0,0 +1,3 @@
+Proxy authentication was using the real client ip instead of the proxy
+IP for checking the PROXY_AUTH_WHITELIST.
+