removing non-ip chars

EricAndrechek · Mar 18, 2024 · 0ae7853 · 0ae7853
1 parent a98d42c
commit 0ae7853
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/tracking-dashboard/backend/utils/api.py b/tracking-dashboard/backend/utils/api.py
@@ -231,4 +231,8 @@ def get_client_ip(self, request):
             if ip is None:
                 ip = request.remote_addr
 
+        # only allow valid ip addresses
+        # remove invalid characters (ipv4 and ipv6)
+        ip = "".join([c for c in ip if c in "0123456789abcdef.:"])
+
         self.data["ip"] = ip if ip is not None else "unknown"