[ZCM] [ZC] 2321/ 1 Request "trusted_proxies in x-forwarded-for should not be used when setting request._client_addr"

Issue #2321 Update (Request) "trusted_proxies in x-forwarded-for should not be used when setting request._client_addr"
 Status Accepted, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2321

==============================================================
= Request - Entry #1 by mj on May 4, 2007 8:26 am

 Status: Pending => Accepted

 Supporters added: mj


Uploaded:  "forwarded-for.diff"
 - http://www.zope.org/Collectors/Zope/2321/forwarded-for.diff/view
When setting request._client_addr based on X-Forwarded-For and trusted_proxies, HTTPRequest uses the last ip-address in the X-Forwarded-For header. Unfortunately, in multiple-proxy situations, trusted proxies themselves can be added to this header, resulting in '<real remote ip>, <upstream proxy>' and such.

The attached patch (against the trunk) fixes this by skipping any ip in the trusted_proxies list, plus adds tests. 
==============================================================