Ilia Ross 463fcea730 Fix to require trusted proxies for SSL client cert headers ...

This PR tightens handling of proxied SSL client certificate headers so they are only honored when Webmin is configured to trust SSL headers and the direct TCP peer matches an explicit `trusted_proxies` entry.

The change preserves legacy forwarded-IP behavior for `trust_real_ip`, but prevents ambiguous legacy configs with no trusted proxy from accepting spoofable `X-SSL-Client-*` headers as authentication identity. During postinstall, such legacy configs now default to `no_trust_ssl=1`.

2026-06-30 14:23:01 +02:00

209 KiB

Executable File

Raw Permalink Blame History

View Raw