From a520f331c16fc703cc92d5b9853fb91805f82305 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 17 Dec 2013 09:21:05 +0100
Subject: Fix handling of X-Forwarded-For header with multiple addresses
 (#1489481)

---
 program/steps/mail/sendmail.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'program/steps/mail')

diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
index fe966a4d4..f26034fa4 100644
--- a/program/steps/mail/sendmail.inc
+++ b/program/steps/mail/sendmail.inc
@@ -345,9 +345,10 @@ if ($CONFIG['http_received_header'])
   $nldlm = "\r\n\t";
   // FROM/VIA
   $http_header = 'from ';
-  if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-    $host = $_SERVER['HTTP_X_FORWARDED_FOR'];
-    $hostname = gethostbyaddr($host);
+  if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+    $hosts    = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'], 2);
+    $hostname = gethostbyaddr($hosts[0]);
+
     if ($CONFIG['http_received_header_encrypt']) {
       $http_header .= rcmail_encrypt_header($hostname);
       if ($host != $hostname)
-- 
cgit v1.2.3