Fixed web services for use through proxies

main/webservices/cm_webservice.php

@@ -108,7 +108,14 @@ class WSCM {
 	 * @return mixed WSError in case of failure, null in case of success
 	 */
 	protected function verifyKey($secret_key) {
-		$security_key = $_SERVER['REMOTE_ADDR'].$this->_configuration['security_key'];
+		$ip = trim($_SERVER['REMOTE_ADDR']);
+		// if we are behind a reverse proxy, assume it will send the 
+		// HTTP_X_FORWARDED_FOR header and use this IP instead
+		if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+		  list($ip1,$ip2) = split(',',$_SERVER['HTTP_X_FORWARDED_FOR']);
+		  $ip = trim($ip1);
+		}
+		$security_key = $ip.$this->_configuration['security_key'];
 
 		if(!api_is_valid_secret_key($secret_key, $security_key)) {
 			return new WSCMError(1, "API key is invalid");

main/webservices/registration.soap.php

@@ -21,7 +21,14 @@ function WSHelperVerifyKey($params) {
     } else {
         $secret_key = $params;
     }
-    $security_key = $_SERVER['REMOTE_ADDR'].$_configuration['security_key'];
+    $ip = trim($_SERVER['REMOTE_ADDR']);
+    // if we are behind a reverse proxy, assume it will send the 
+    // HTTP_X_FORWARDED_FOR header and use this IP instead
+    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+      list($ip1,$ip2) = split(',',$_SERVER['HTTP_X_FORWARDED_FOR']);
+      $ip = trim($ip1);
+    }
+    $security_key = $ip.$_configuration['security_key'];
 
     $result = api_is_valid_secret_key($secret_key, $security_key);
     if ($debug) error_log('WSHelperVerifyKey result '.$result);

main/webservices/testip.php

@@ -3,4 +3,9 @@
 /**
  *  @package chamilo.webservices
  */
-echo htmlentities($_SERVER['REMOTE_ADDR']);
+$ip = trim($_SERVER['REMOTE_ADDR']);
+if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+  list($ip1,$ip2) = split(',',$_SERVER['HTTP_X_FORWARDED_FOR']);
+  $ip = trim($ip1);
+}
+echo htmlentities($ip);

main/webservices/webservice.php

@@ -108,7 +108,14 @@ class WS {
 	 * @return mixed WSError in case of failure, null in case of success
 	 */
 	protected function verifyKey($secret_key) {
-		$security_key = $_SERVER['REMOTE_ADDR'].$this->_configuration['security_key'];
+		$ip = trim($_SERVER['REMOTE_ADDR']);
+		// if we are behind a reverse proxy, assume it will send the 
+		// HTTP_X_FORWARDED_FOR header and use this IP instead
+		if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+			list($ip1,$ip2) = split(',',$_SERVER['HTTP_X_FORWARDED_FOR']);
+			$ip = trim($ip1);
+		}
+		$security_key = $ip.$this->_configuration['security_key'];
 
 		if(!api_is_valid_secret_key($secret_key, $security_key)) {
 			return new WSError(1, "API key is invalid");