Repository navigation
chore(lib): update the bundled XMF library to 1.3.3 and document proxy_trusted - #267
Conversation
Add a commented-out proxy_trusted entry next to proxy_env describing the trusted-proxy list that gates use of the proxy_env header. The bundled XMF does not read it yet; it takes effect once XMF is bumped to a release that includes XOOPS/xmf#197.
Brings the trusted-proxy gate for proxy_env (the proxy_trusted setting documented in xoopsconfig.dist.php in the previous commit), RFC 7239 Forwarded parsing, the SendmailRunner delivery timeout, and the Tables, Serializer and TokenReader fixes from XOOPS/xmf 1.3.3.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the bundled XMF library from 1.3.2 to 1.3.3 with regenerated Composer metadata, bringing trusted-proxy and RFC 7239 handling, mail timeout and upstream fixes; documents the required proxy_trusted configuration and records the change for the unreleased 2.7.4 cycle. Sequence diagram for trusted proxy client IP resolutionsequenceDiagram
participant Client
participant Proxy
participant XOOPS
participant ProxyCheck
Client->>Proxy: HTTP request
Proxy->>XOOPS: Request with REMOTE_ADDR and proxy_env header
XOOPS->>ProxyCheck: getClientIp()
ProxyCheck->>ProxyCheck: isTrustedProxy(REMOTE_ADDR, proxy_trusted)
alt direct peer is trusted
ProxyCheck->>ProxyCheck: parse proxy_env
ProxyCheck-->>XOOPS: First untrusted client address
else direct peer is not trusted
ProxyCheck-->>XOOPS: REMOTE_ADDR
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe Composer template now requires XMF ^1.3.3. The sample configuration documents the commented ChangesXMF 1.3.3 update
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~8 minutes Change: Other Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes both primary changes: updating the bundled XMF library to 1.3.3 and documenting the proxy_trusted setting. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 PHPStan (2.2.14)
-
PHP Fatal error: Uncaught Error: Class "Nette\DI\ServiceCreationException" not found in /.cache/phpstan/phpstan/cache/nette.configurator/Container_d0f87d58a8.php:9129
Stack trace:
#0phar:///usr/bin/phpstan/vendor/nette/di/src/DI/Container.php(51): Container_d0f87d58a8->getDynamicParameter()
#1phar:///usr/bin/phpstan/vendor/nette/di/src/DI/Container.php(245): _PHPStan_395468aef\Nette\DI\Container->_PHPStan_395468aef\Nette\DI{closure}()
#2phar:///usr/bin/phpstan/vendor/nette/di/src/DI/Container.php(50): _PHPStan_395468aef\Nette\DI\Container->preventDeadLock()
#3[internal function]: _PHPStan_395468aef\Nette\DI\Container->getParameter()
#4/.cache/phpstan/phpstan/cache/nette.configurator/Container_d0f87d58a8.php(9142): array_map()
#5phar:///usr/bin/phpstan/src/DependencyInjection/Nette/NetteContainer.php(94): Container_d0f87d58a8->getParameters()
#6phar:///usr/bin/phpstan/src/DependencyInjection/MemoizingContainer.php(57): PHPStan\DependencyInjection\Nette\NetteContainer->getParame... [truncated 2699 characters] ...
an\Command\AnalyseCommand->execute()
#11phar:///usr/bin/phpstan/vendor/symfony/console/Application.php(868): _PHPStan_395468aef\Symfony\Component\Console\Command\Command->run()
#12phar:///usr/bin/phpstan/vendor/symfony/console/Application.php(261): _PHPStan_395468aef\Symfony\Component\Console\Application->doRunCommand()
#13phar:///usr/bin/phpstan/vendor/symfony/console/Application.php(157): _PHPStan_395468aef\Symfony\Component\Console\Application->doRun()
#14phar:///usr/bin/phpstan/bin/phpstan(116): _PHPStan_395468aef\Symfony\Component\Console\Application->run()
#15phar:///usr/bin/phpstan/bin/phpstan(117): _PHPStan_395468aef{closure}()
#16/usr/bin/phpstan(7): require('...')
#17{main}
thrown in /.cache/phpstan/phpstan/cache/nette.configurator/Container_d0f87d58a8.php on line 9129
Comment @coderabbitai help to get the list of available commands.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #267 +/- ##
=========================================
Coverage 22.54% 22.54%
Complexity 8666 8666
=========================================
Files 685 685
Lines 46316 46316
=========================================
Hits 10444 10444
Misses 35872 35872 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
xoops_lib/composer.dist.json,xoops_lib/vendor/xoops/xmf).proxy_trustedsetting besideproxy_envinxoops_data/configs/xoopsconfig.dist.php.XMF 1.3.3 (XOOPS/xmf#197) only honours the
proxy_envheader whenREMOTE_ADDRis listed in$xoopsConfig['proxy_trusted'](addresses or CIDR ranges, array or comma separated). Sites that setproxy_envmust addproxy_trusted; until then the peer address is used. The release also brings RFC 7239Forwardedparsing, a delivery timeout inXmf\Mail\SendmailRunner, and theTables,SerializerandTokenReaderfixes listed in the XMF changelog.Changelog entry added under 2.7.4 NOT RELEASED.
Verification
vendor/composer/installed.jsonreportsxoops/xmfv1.3.3;Xmf\ProxyCheck::TRUSTED_PROXIES_VARIABLEresolves through the bundled autoloader; the classmap is unchanged.composer update xoops/xmf --no-dev -aagainstcomposer.dist.json).Summary by Sourcery
Update the bundled XMF library to 1.3.3 and document trusted proxy configuration for forwarded client addresses.
New Features:
Bug Fixes:
Build:
Documentation:
Summary by CodeRabbit
Forwardedheaders and client IP detection.