Incorrect visitor's IP detection

You should untick the “Disable Proxy IP Detection” checkbox.

Then study the get_ip() method/function in the core/class-itsec-lib.php file. Code of this function might need a fix … or two … or three.

dwinden

Untick the “Disable Proxy IP Detection” checkbox.
Click on “Save All Changes” button.

Create a copy of the core/class-itsec-lib.php file.
Then try to replace the last line in get_ip() method/function with:

return esc_sql( explode(', ', $the_ip)[0] );

This is hopefully the only fix needed to solve your issue.
Note this fix is untested. So I’m not sure about the result.
Make sure to create a copy of the core/class-itsec-lib.php file
before testing it. This way it should be easy to undo the fix
in case the result is negative.

dwinden

Please ignore my previous post.
The suggested fix does not work.

Basically the get_ip() function\method is not dealing with the possibility of multiple ip addresses in the headers.

So here is the fixed code:

public static function get_ip() {

	global $itsec_globals;

	if ( isset( $itsec_globals['settings']['proxy_override'] ) && true === $itsec_globals['settings']['proxy_override'] ) {

		return esc_sql( $_SERVER['REMOTE_ADDR'] );

	}

	//Just get the headers if we can or else use the SERVER global
	if ( function_exists( 'apache_request_headers' ) ) {

		$headers = apache_request_headers();

	} else {

		$headers = $_SERVER;

	}

	//Get the forwarded IP if it exists
	if ( array_key_exists( 'X-Forwarded-For', $headers ) &&
	(
		filter_var( explode(', ', $headers['X-Forwarded-For'])[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ||
		filter_var( explode(', ', $headers['X-Forwarded-For'])[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) )
	) {

		$the_ip = explode(', ', $headers['X-Forwarded-For'])[0];

	} elseif (
		array_key_exists( 'HTTP_X_FORWARDED_FOR', $headers ) &&
		(
		filter_var( explode(', ', $headers['HTTP_X_FORWARDED_FOR'])[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ||
		filter_var( explode(', ', $headers['HTTP_X_FORWARDED_FOR'])[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 )
		)
	) {

		$the_ip = explode(', ', $headers['HTTP_X_FORWARDED_FOR'])[0];

		} else {

			$the_ip = $_SERVER['REMOTE_ADDR'];

		}

	return esc_sql( $the_ip );

}

dwinden

Thank you very much, dwinden!
The code works like a charm.