From 332a01b5f36492facea9fc1152dc20073933a14c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B8=A9=E6=B3=89?= <80071319@qq.com>
Date: Fri, 1 May 2020 14:20:41 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=8E=B7=E5=8F=96=E7=94=A8?=
 =?UTF-8?q?=E6=88=B7IP=E5=AF=BC=E8=87=B4=E7=9A=84=E6=8A=A5=E9=94=99?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 function/function_core.php | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/function/function_core.php b/function/function_core.php
index 9211764..b4d5a57 100644
--- a/function/function_core.php
+++ b/function/function_core.php
@@ -166,19 +166,17 @@ function tips($message, $url = 'javascript:history.go(-1);')
  */
 function get_real_ip()
 {
-    $ip = false;
-    if (!empty($_SERVER["HTTP_CLIENT_IP"])) {
+    $ip=FALSE;
+    //客户端IP 或 NONE
+    if(!empty($_SERVER["HTTP_CLIENT_IP"])){
         $ip = $_SERVER["HTTP_CLIENT_IP"];
     }
+    //多重代理服务器下的客户端真实IP地址（可能伪造）,如果没有使用代理，此字段为空
     if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-        $ips = explode(", ", $_SERVER['HTTP_X_FORWARDED_FOR']);
-        if ($ip) {
-            array_unshift($ips, $ip);
-            $ip = FALSE;
-        }
+        $ips = explode (", ", $_SERVER['HTTP_X_FORWARDED_FOR']);
+        if ($ip) { array_unshift($ips, $ip); $ip = FALSE; }
         for ($i = 0; $i < count($ips); $i++) {
-            $istart = substr($str , 0 , 3);
-            if ($istart != "10." && $istart != "172" && $istart != "16." && $istart != "192" && $istart != "168"){
+            if (!preg_match ("/^(10│172.16│192.168)./", $ips[$i])) {
                 $ip = $ips[$i];
                 break;
             }