[ZCM] [ZC] 2321/ 2 Resolve "trusted_proxies in x-forwarded-for should not be used when setting request._client_addr"

Issue #2321 Update (Resolve) "trusted_proxies in x-forwarded-for should not be used when setting request._client_addr"
 Status Resolved, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2321

==============================================================
= Resolve - Entry #2 by mj on May 4, 2007 9:09 am

 Status: Accepted => Resolved

Fixed for trunk, 2.10 and 2.9:

http://svn.zope.org/Zope/?rev=75431&view=rev
http://svn.zope.org/Zope/?rev=75433&view=rev
http://svn.zope.org/Zope/?rev=75435&view=rev

________________________________________
= Request - Entry #1 by mj on May 4, 2007 8:26 am

 Status: Pending => Accepted

 Supporters added: mj


Uploaded:  "forwarded-for.diff"
 - http://www.zope.org/Collectors/Zope/2321/forwarded-for.diff/view
When setting request._client_addr based on X-Forwarded-For and trusted_proxies, HTTPRequest uses the last ip-address in the X-Forwarded-For header. Unfortunately, in multiple-proxy situations, trusted proxies themselves can be added to this header, resulting in '<real remote ip>, <upstream proxy>' and such.

The attached patch (against the trunk) fixes this by skipping any ip in the trusted_proxies list, plus adds tests. 
==============================================================