Skip to content

Workaround security issues in django-axes

Sunil Mohan Adapa requested to merge sunilmohan/freedombox:fix-axes into master

Newer versions of Django axes have newly way to get the IP address of a client using ipware library. This has multiple security issues https://github.com/jazzband/django-axes/issues/286 . Workaround them by controlling the X-FORWARDED-FOR header sent from Apache to FreedomBox and by limiting the headers that ipware uses.

Signed-off-by: Sunil Mohan Adapa sunil@medhas.org

Merge request reports