对来源ip进行访问控制

HTTP_CLIENT_IP：可通过http头伪造
HTTP_X_FORWARDED_FOR：可通过http头伪造
REMOTE_ADDR：可能是用户真实IP也可能是代理IP
服务端获取IP地址 http://www.taoyiz.com/util/ip 其代码如下:
$s_onlineip = getenv(‘HTTP_CLIENT_IP’);
echo “HTTP_CLIENT_IP:”.$s_onlineip.”<br/>\n”;
$s_onlineip = getenv(‘HTTP_X_FORWARDED_FOR’);
echo “HTTP_X_FORWARDED_FOR:”.$s_onlineip.”<br/>\n”;
$s_onlineip = getenv(‘REMOTE_ADDR’);
echo “REMOTE_ADDR:”.$s_onlineip.”<br/>\n”;
$s_onlineip = $_SERVER['REMOTE_ADDR'];
echo “\$_SERVER['REMOTE_ADDR']:”.$s_onlineip.”<br/>\n”;
客户端代码：
伪造IP测试：
$url = ‘http://www.taoyiz.com/util/ip’;
$data_string = ‘test=test’;
$URL_Info    =    parse_url($url);
$request = ”;
if (!isset($URL_Info["port"]))
$URL_Info["port"]=80;
$request.=”POST “.$URL_Info["path"].” HTTP/1.1\n”;
$request.=”Host: “.$URL_Info["host"].”\n”;
$request.=”Referer: “.$URL_Info["host"].”\n”;
$request.=”Content-type: application/x-www-form-urlencoded\n”;
$request.=”X-Forwarded-For:192.168.1.4\n”;//HTTP_X_FORWARDED_FOR的值
$request.=”client_ip:192.168.1.5\n”;//HTTP_CLIENT_IP的值
$request.=”Content-length: “.strlen($data_string).”\n”;
$request.=”Connection: close\n”;
$request.=”\n”;
$request.=$data_string.”\n”;
$fp = fsockopen($URL_Info["host"], $URL_Info["port"]);
fputs($fp, $request);
$result = ”;
while(!feof($fp)) {
$result .= fgets($fp, 1024);
}
fclose($fp);
echo $result;
输出：
HTTP_CLIENT_IP:192.168.1.5
HTTP_X_FORWARDED_FOR:192.168.1.4
REMOTE_ADDR:127.0.0.1
$_SERVER['REMOTE_ADDR']:127.0.0.1
代理IP测试：
$cUrl = curl_init();
curl_setopt($cUrl, CURLOPT_URL, $url);
curl_setopt($cUrl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($cUrl, CURLOPT_HEADER, 1);
curl_setopt($cUrl, CURLOPT_USERAGENT, “Mozilla/99.99″);
//curl_setopt($cUrl, CURLOPT_TIMEOUT, 10);
curl_setopt($cUrl, CURLOPT_PROXY, ’125.77.194.103:80′);
$c = curl_exec($cUrl);
curl_close($cUrl);
echo $c;
输出：
HTTP_CLIENT_IP:
HTTP_X_FORWARDED_FOR:
REMOTE_ADDR:125.77.194.103
$_SERVER['REMOTE_ADDR']:125.77.194.103

 

如果通过客户端ip来进行访问控制：

public function login() {
        //设定IP段登录
        if(getenv("HTTP_CLIENT_IP")) {
            $onlineip = getenv('HTTP_CLIENT_IP');
                 }
                 elseif(getenv('HTTP_X_FORWARDED_FOR')){
                         $onlineip = getenv('HTTP_X_FORWARDED_FOR');
                 }
                 elseif(getenv('REMOTE_ADDR')){
                         $onlineip = getenv('REMOTE_ADDR');
                 }
                 else{
                         $onlineip = $HTTP_SERVER_VARS['REMOTE_ADDR'];
                 }
//                 echo $onlineip;
                 $adminip = $onlineip;
                 $arrayip = array('117.121.48.*','127.0.0.*');//ip段
                 $ipregexp = implode('|', str_replace( array('*','.'), array('\d+','\.') ,$arrayip) );
                 $allow = preg_match("/^(".$ipregexp.")$/", $adminip);
       
                 if ($allow != 1) {
                         showmessage(L('你的ip地址不在被允许的范围内！'),'?m=admin&c=index&a=login',6000);

                 }