IP Address

LankyBox01

There is an account on my forum under suspicion, which hasn't posted anything yet.
And i wanna ban his IP, but how can i find out his IP without a post from him?

clarkwinkelmann

LankyBox01 Flarum natively only logs IPs when posting.

Other extensions might log additional information. My own Audit extension logs IP for every action.

You might also be able to find their IP via the webserver visit logs, by looking up the date of registration or last activity.

poVoq

clarkwinkelmann
Somewhat related, but is there a way to completely disable IP logging in Flarum?

We want our forum to collect as little personal information (as defined by the GDPR) as possible and permanent storage of IP with all posts seems a bit excessive and not needed for us. However I can't find any option to disable this logging.

Thanks!

clarkwinkelmann

poVoq you could use an Apache Header rule or a custom Flarum middleware to replace all IPs sent to Flarum and set them to an identical value.

You could also periodically clear the data from the database with a custom script.

poVoq

clarkwinkelmann Ah ok, so there is no way to disable it in Flarum itself? That's a pity. Maybe something to consider adding (maybe with the option to only delete IPs after 90 days or so?).

Do you accept feature requests like this to flarum-core on your Github page?

poVoq

Would patching it out like this cause any issues?

Aka an one line patch in ProcessIp.php at line 22:

-  $ipAddress = Arr::get($request->getServerParams(), 'REMOTE_ADDR', '127.0.0.1');
+  $ipAddress = '127.0.0.1';

This might temporarily solve the issue without the need to touch other parts of the codebase?

luceos

poVoq a forward compatible solution would be to remove that middleware.

in your extend.php:

return [
    (new \Flarum\Extend\Middleware('forum'))->remove(\Flarum\Http\Middleware\ProcessIp::class),
];

poVoq

luceos Indeed that sounds like a better solution. Thanks

poVoq

@luceos I tried adding this to the extend.php in multiple ways and cleared the Flarum cache, but IPs still get added to the database for each post. Anything I might be overlooking for it to work?

luceos

I don't know, if this isn't possible it is most likely a bug. I have no time to dive into it right now though.

clarkwinkelmann

It seems like the ProcessIp middleware is added to the root middleware stack, not forum/admin/api, so extensions cannot remove it https://github.com/flarum/core/blob/v1.0.2/src/Foundation/InstalledApp.php#L58

However you can achieve the same by adding $_SERVER['REMOTE_ADDR'] = '127.0.0.1'; at the top of index.php before the $site = line. Since this file isn't in the vendor folder, it won't be overridden on Flarum updates.

poVoq

clarkwinkelmann great, that seems to work. So it would only have to be re-done on major version upgrades?

clarkwinkelmann

poVoq only if we ever give instructions to replace the index.php file with another, then you would likely have to copy-paste from the old to the new.

We kept everything outside of vendor (what we call the "skeleton") very minimal so it shouldn't have to be edited very often. The current skeleton has been identical for all the latest betas and now stable.