get_client_ip_address detects Server IP if on Cloudflare

[eightam]

Describe the bug
If the website is served through Cloudflare DNS, all the headers listed in get_client_ip_address() are filled with the server IP address. Then the plugin doesn't work and is actually a "security risk" for inexperienced users (for example if the "Add My Current IP Address" button is clicked in the settings, the servers IP address is added which leads to a fully accessible site for any IP, as get_client_ip_address() always returns the server IP).

Cloudflare fills in the clients address into an extra header HTTP_CF_CONNECTING_IP. The solution is to add this to the list of queried headers:

$headers = array(
			'HTTP_CF_CONNECTING_IP',
			'HTTP_CLIENT_IP',
			'HTTP_X_FORWARDED_FOR',
			'HTTP_X_FORWARDED',
			'HTTP_X_CLUSTER_CLIENT_IP',
			'HTTP_FORWARDED_FOR',
			'HTTP_FORWARDED',
			'REMOTE_ADDR',
		);

Steps to Reproduce

1. Use Cloudflare as DNS
2. Click on 'Add My Current IP Address'

Expected behavior
get_client_ip_address() should return the real client address if Cloudflare is active.

Environment information
Wordpress 5.3.2 through Cloudflare

[jeffpaul]

Welcome to Restricted Site Access and thanks for the feedback and potential solution @eightam! If you're able to work up a PR to resolve this, then I'd gladly get that through review and into the next milestoned release.

[jeffpaul]

Merged in via #110.