Merge lp:~gesha/linaro-license-protection/remove-x-forwarded-for into lp:~linaro-automation/linaro-license-protection/trunk

[Georgy Redkozubov]

This branch removes X-FORWARDED-FOR support since it is easy to spoof even with wget.

[Данило Шеган (danilo)]

Looks good, thanks.

review: Approve

=== modified file 'license_protected_downloads/tests/test_views.py'
--- license_protected_downloads/tests/test_views.py	2012-08-28 17:15:06 +0000
+++ license_protected_downloads/tests/test_views.py	2012-08-30 10:04:18 +0000
@@ -353,18 +353,6 @@
              r'lp:linaro-license-protection</a> r' +
              str(bzr_version.get_my_bzr_revno())))
 
-    def test_exception_ip_x_forwarded_for(self):
-        internal_host = INTERNAL_HOSTS[0]
-        target_file = 'build-info/origen-blob.txt'
-        url = urlparse.urljoin("http://testserver/", target_file)
-        response = self.client.get(url, follow=True,
-            HTTP_X_FORWARDED_FOR=internal_host)
-
-        # If we have access to the file, we will get an X-Sendfile response
-        self.assertEqual(response.status_code, 200)
-        file_path = os.path.join(TESTSERVER_ROOT, target_file)
-        self.assertEqual(response['X-Sendfile'], file_path)
-
     def test_exception_ip_remote_addr(self):
         internal_host = INTERNAL_HOSTS[0]
         target_file = 'build-info/origen-blob.txt'

=== modified file 'license_protected_downloads/views.py'
--- license_protected_downloads/views.py	2012-08-28 17:15:06 +0000
+++ license_protected_downloads/views.py	2012-08-30 10:04:18 +0000
@@ -232,11 +232,7 @@
 
 
 def get_client_ip(request):
-    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
-    if x_forwarded_for:
-        ip = x_forwarded_for.split(',')[-1].strip()
-    else:
-        ip = request.META.get('REMOTE_ADDR')
+    ip = request.META.get('REMOTE_ADDR')
     return ip