WP Manifestindependent plugin directory
manifest / ecommerce / bh-wc-csp-condition-ip-address

IP Address Condition for WooCSP WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Use customer IP address as input for WooCommerce Conditional Shipping and Payments

★ 2stars
25release downloads
≈10active sites
1.2.1latest · 4 years ago

Install

Download bh-wc-csp-condition-ip-address.1.2.1.zip From the 1.2.1 release on GitHub, Oct 1, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/brianhenryie/bh-wc-csp-condition-ip-address/releases/download/1.2.1/bh-wc-csp-condition-ip-address.1.2.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

IP Address Condition for WooCommerce Conditional Shipping and Payments

WooCommerce Conditional Shipping and Payments

e.g. only show cheque payment option to schools in Ireland:

Example

Development

Clone this repo, open PhpStorm, then run composer install to install the dependencies.

git clone https://github.com/brianhenryie/bh-wc-csp-condition-ip-address.git;
cd bh-wc-csp-condition-ip-address;
open -a PhpStorm ./;
composer install;

For integration and acceptance tests, a local webserver must be running with localhost:8080/bh-wc-csp-condition-ip-address/ pointing at the root of the repo. MySQL must also be running locally – with two databases set up with:

mysql_username="root"
mysql_password="secret"

# export PATH=${PATH}:/usr/local/mysql/bin

# Make .env available 
# To bash:
# export $(grep -v '^#' .env.testing | xargs)
# To zsh:
# source .env.testing

# Create the database user:
# MySQL
# mysql -u $mysql_username -p$mysql_password -e "CREATE USER '"$TEST_DB_USER"'@'%' IDENTIFIED WITH mysql_native_password BY '"$TEST_DB_PASSWORD"';";
# or MariaDB
# mysql -u $mysql_username -p$mysql_password -e "CREATE USER '"$TEST_DB_USER"'@'%' IDENTIFIED BY '"$TEST_DB_PASSWORD"';";

# Create the databases:
mysql -u $mysql_username -p$mysql_password -e "CREATE DATABASE "$TEST_SITE_DB_NAME"; USE "$TEST_SITE_DB_NAME"; GRANT ALL PRIVILEGES ON "$TEST_SITE_DB_NAME".* TO '"$TEST_DB_USER"'@'%';";
mysql -u $mysql_username -p$mysql_password -e "CREATE DATABASE "$TEST_DB_NAME"; USE "$TEST_DB_NAME"; GRANT ALL PRIVILEGES ON "$TEST_DB_NAME".* TO '"$TEST_DB_USER"'@'%';";

# Import the acceptance database:
mysql -u $mysql_username -p$mysql_password $TEST_SITE_DB_NAME < tests/_data/dump.sql 

WordPress Coding Standards

See documentation on WordPress.org and GitHub.com.

Correct errors where possible and list the remaining with:

vendor/bin/phpcbf; vendor/bin/phpcs

Tests

Tests use the Codeception add-on WP-Browser and include vanilla PHPUnit tests with WP_Mock.

Run tests with:

vendor/bin/codecept run unit;
vendor/bin/codecept run wpunit;
vendor/bin/codecept run integration;
vendor/bin/codecept run acceptance;

Show code coverage (unit+wpunit):

XDEBUG_MODE=coverage composer run-script coverage-tests 

Static analysis:

vendor/bin/phpstan analyse --memory-limit 1G

To save changes made to the acceptance database:

export $(grep -v '^#' .env.testing | xargs)
mysqldump -u $TEST_SITE_DB_USER -p$TEST_SITE_DB_PASSWORD $TEST_SITE_DB_NAME > tests/_data/dump.sql

To clear Codeception cache after moving/removing test files:

vendor/bin/codecept clean

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.1 latest
Oct 1, 2022 4 years ago
bh-wc-csp-condition-ip-address.1.2.1.zip
15
Oct 1, 2022 4 years ago
bh-wc-csp-condition-ip-address.1.2.0.zip
10

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

IP Address Condition for WooCSP 1.2.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.2.1
Findings
1
Worst severity
high
Content hash
5a910ad0d1301f7deed30e2e…

Findings

  • high Client-controlled CF-Connecting-IP trusted as customer IP (payment/shipping restriction bypass)

    auth_bypass

    WC_CSP_Condition_IP_Address::check_condition and WC_CSP_Condition_Behind_VPN::check_condition, invoked by WooCommerce Conditional Shipping and Payments on cart/checkout for guests and customers, copy $_SERVER['HTTP_CF_CONNECTING_IP'] into $_SERVER['HTTP_X_REAL_IP'] whenever the header is present. There is no check that REMOTE_ADDR is a Cloudflare edge address (the in-code comment even says this should be handled by the Cloudflare plugin). WooCommerce WC_Geolocation::get_ip_address() returns HTTP_X_REAL_IP first, so the spoofed value becomes the IP used for CIDR/pattern matching and for the getipintel.net VPN lookup. Because X-Real-IP is preferred over X-Forwarded-For, this also overwrites a reverse-proxy-assigned real IP on hosts that were otherwise correctly configured. Observable: an unauthenticated shopper sends CF-Connecting-IP: <an allowlisted or residential IP> and a CSP restriction that was supposed to hide a payment gateway, shipping method, or shipping country based on IP/VPN does not apply; subsequent geolocation on the same request sees the fake IP as well.

    src/WooCommerce_Conditional_Shipping_And_Payments/class-wc-csp-condition-ip-address.php:74-79

    Recommendation

    Do not trust CF-Connecting-IP (or write it into HTTP_X_REAL_IP) unless REMOTE_ADDR is in Cloudflare's published IPv4/IPv6 ranges, or delegate restoration to the official Cloudflare plugin / a correctly configured trusted-proxy layer. Prefer WC_Geolocation::get_ip_address() without mutating $_SERVER. If Cloudflare support is required, validate the connecting IP against the current Cloudflare range list before copying the header.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.