fix(security): authorize site uploads and harden tokens, media and request identity

2026-09-13 19:24:43 +02:00
parent 52f6d1491f
commit 8abfe352ef
70 changed files with 1609 additions and 204 deletions
@@ -4,6 +4,7 @@ import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { issueSsoTicket } from "@/lib/auth/sso-ticket";
 import { cached } from "@/lib/cache";
+import { resolveClientIp } from "@/lib/client-ip";
 import { db, User } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { siteSettings } from "@/lib/services/site-settings";
@@ -20,7 +21,7 @@ export default async function ClientPage() {
 		siteSettings.get("nitro_client_url", ""),
 	]);

-	const ip = (await headers()).get("x-real-client-ip") ?? "0.0.0.0";
+	const ip = resolveClientIp(await headers());

 	// Ticket write and online count run in parallel — the client page should
 	// render as fast as possible since the player is waiting for the game.