view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

  * GET /api/v1/object/device/{ip}/port/{port}/ssid returned only one SSID
    for a port that has several, and now answers with a list
  * checksitelocal named the wrong release for the do_search deprecation
  * #1667 the Show all Ports tooltip stayed on screen, at the top left of the
    window, after clicking the bin to clear the ports filter
  * a tooltip could be left on screen the same way when the sidebar, the CSV
    download link or a port control icon was hidden
  * a page fragment could 404 for the rest of a web worker's life after one
    request to its URL from outside the application
  * behind_proxy, which no deployment needs to set, made the client address
    read as the whole X-Forwarded-For chain where more than one proxy stood in
    front of the web server, so an API token restricted by an ACL was refused
    and every login failed to log

2.107000 - 2026-09-04

  [NEW FEATURES]

  * #1651 change user's API token allowed IPs from a list to a managed ACL

  [ENHANCEMENTS]

lib/App/Netdisco/Web.pm  view on Meta::CPAN

      }
      Dancer::Continuation::Route::ErrorSent->new(
          return_value => Dancer::Error->new(
              message => $body,
              code => $status || 500)->render()
      )->throw;
  };

  # behind_proxy is documented as a setting nobody needs, since
  # Plack::Middleware::ReverseProxy is always in the stack, but a site that
  # sets it makes Dancer answer with the X-Forwarded-For header verbatim, and
  # more than one proxy makes that a chain rather than an address. Take the
  # last element, as ReverseProxy does: anything left of it is client supplied.
  *Dancer::Request::address = sub {
      my $self = shift;
      return $self->env->{REMOTE_ADDR} unless setting('behind_proxy');
      my $forwarded = $self->forwarded_for_address;
      my ($client) = (defined $forwarded ? ($forwarded =~ m/([^,\s]+)\s*$/) : ());
      return ($client || $self->env->{REMOTE_ADDR});
  };

xt/58-behind-proxy-address.t  view on Meta::CPAN

use strict;
use warnings;

use Test::More 0.88;

# The testing environment, as xt/57 uses it: it supplies session_cookie_key,
# without which loading the web app dies before the first assertion.
BEGIN { $ENV{DANCER_ENVIRONMENT} = 'testing'; }

# With behind_proxy set, Dancer answers request->address with the
# X-Forwarded-For header exactly as it arrived. One proxy puts one address in
# that header and everything works, which is why this survived; two proxies put
# a comma separated chain there, and a chain is not an address:
#
#   NetAddr::IP::Lite->new('203.0.113.5, 198.51.100.1') is undef, so
#   acl_matches_only() rejects, and every API token carrying a token_acl gets
#   401 with nothing in the log naming the cause.
#
#   user_log.userip is an inet column (schema_versions 1-2), so the three
#   login and logout inserts in AuthN.pm fail on the chain as well.
#