Skip to content

Use the first two octets of ip addresses in fingerprint() #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Klakurka merged 1 commit into from
May 29, 2025
Merged

Use the first two octets of ip addresses in fingerprint() #69

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions includes/class-paybutton-state.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,36 @@ private static function fingerprint() {
// Get and validate IP address (support IPv4 and IPv6)
$ip_raw = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? '';
// Handle multiple IPs in X-Forwarded-For
$ip_raw = trim(explode(',', $ip_raw)[0]); // Trim after selecting first IP
$ip = filter_var($ip_raw, FILTER_VALIDATE_IP) ? $ip_raw : '';
$ip_raw = sanitize_text_field( trim( explode( ',', $ip_raw )[0] ) ); // Trim after selecting first IP

// Default if we can’t extract a stable prefix
$ip_prefix = '';

// IPv4: grab the first two octets
if ( filter_var( $ip_raw, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
$octets = explode( '.', $ip_raw );
if ( count( $octets ) >= 2 ) {
$ip_prefix = $octets[0] . '.' . $octets[1];
}

// IPv6: first two hextets
} elseif ( filter_var( $ip_raw, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) ) {
// Normalize IP to its full canonical form (optional)
// https://www.php.net/manual/en/function.inet-ntop.php
// Inet_pton converts IPv6 to binary, inet_ntop converts it back to string
$normalized_ip = inet_ntop( inet_pton( $ip_raw ) );
$hextets = explode( ':', $normalized_ip );
if ( count( $hextets ) >= 2 ) {
$ip_prefix = strtolower( $hextets[0] . ':' . $hextets[1] );
}
}

// Get and sanitize Accept-Language
$lang_raw = $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '';
$lang_clean = sanitize_text_field(wp_unslash($lang_raw));
$lang = preg_match('/^[a-zA-Z]{1,3}(?:-[a-zA-Z]{1,3})?(?:,[a-zA-Z]{1,3}(?:-[a-zA-Z]{1,3})?)*$/i', $lang_clean) ? $lang_clean : '';

return "{$ua}|{$ip}|{$lang}";
return "{$ua}|{$ip_prefix}|{$lang}";
}

/**
Expand Down