From b63956a1736c260bf49646c5983f8cb43cb55577 Mon Sep 17 00:00:00 2001
From: Riccardo Graziosi <31478034+riggraz@users.noreply.github.com>
Date: Sun, 24 Mar 2024 18:06:36 +0100
Subject: [PATCH] Fix custom domains (#318)

* Configure trusted proxies
* Fix tenant signup route not working
* Use HTTP_X_FORWARDED_HOST if present
* Update reserved subdomains
---
 app/controllers/application_controller.rb  | 2 +-
 app/helpers/application_helper.rb          | 7 ++++---
 config/application.rb                      | 6 ++++++
 config/initializers/rack_attack.rb         | 6 +++---
 config/initializers/reserved_subdomains.rb | 3 ++-
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 54b50ca9..9d8d5a88 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -20,6 +20,7 @@ class ApplicationController < ActionController::Base
 
     def load_tenant_data
       current_tenant = get_tenant_from_request(request)
+      return unless current_tenant
 
       if current_tenant.status == "pending" and controller_name != "confirmation" and action_name != "show"
         redirect_to pending_tenant_path; return
@@ -29,7 +30,6 @@ class ApplicationController < ActionController::Base
         redirect_to blocked_tenant_path; return
       end
 
-      return unless current_tenant
       Current.tenant = current_tenant
 
       # Load tenant data
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index f33b8885..72f56fac 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -52,15 +52,16 @@ module ApplicationHelper
 
   def get_tenant_from_request(request)
     if Rails.application.multi_tenancy?
-      request_host_splitted = request.host.split('.')
+      request_host = request.headers['HTTP_X_FORWARDED_HOST'] || request.host
+      request_host_splitted = request_host.split('.')
       app_host_splitted = URI.parse(Rails.application.base_url).host.split('.')
 
       if app_host_splitted.join('.') == request_host_splitted.last(app_host_splitted.length).join('.')
-        return if request.subdomain.blank? or RESERVED_SUBDOMAINS.include?(request.subdomain)
+        return nil if request.subdomain.blank? or RESERVED_SUBDOMAINS.include?(request.subdomain)
 
         tenant = Tenant.find_by(subdomain: request.subdomain)
       else
-        tenant = Tenant.find_by(custom_domain: request.host)
+        tenant = Tenant.find_by(custom_domain: request_host)
       end
     else
       tenant = Tenant.first
diff --git a/config/application.rb b/config/application.rb
index 927f9a54..4b79210b 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -16,6 +16,12 @@ module App
     # -- all .rb files in that directory are automatically loaded after loading
     # the framework and any gems in your application.
 
+    # If configured, add trusted proxy to the list of trusted proxies
+    config.middleware.insert_after ActionDispatch::RemoteIp, Rack::Attack
+    if ENV["TRUSTED_PROXY"]
+      config.action_dispatch.trusted_proxies = ActionDispatch::RemoteIp::TRUSTED_PROXIES + [IPAddr.new(ENV["TRUSTED_PROXY"])]
+    end
+
     def base_url
       ENV["BASE_URL"]
     end
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index a41d5fbf..568b8d75 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -13,7 +13,7 @@ class Rack::Attack
   #
   # Key: "rack::attack:#{Time.now.to_i/:period}:req/ip:#{req.ip}"
   throttle('req/ip', limit: 300, period: 5.minutes) do |req|
-    req.ip # unless req.path.start_with?('/assets')
+    req.get_header("action_dispatch.remote_ip") # unless req.path.start_with?('/assets')
   end
 
   ### Prevent Brute-Force Login Attacks ###
@@ -30,7 +30,7 @@ class Rack::Attack
   # Key: "rack::attack:#{Time.now.to_i/:period}:logins/ip:#{req.ip}"
   throttle('logins/ip', limit: 5, period: 20.seconds) do |req|
     if req.path == '/users/sign_in' && req.post?
-      req.ip
+      req.get_header("action_dispatch.remote_ip")
     end
   end
 
@@ -53,7 +53,7 @@ class Rack::Attack
   # Throttle POST requests to /tenants by IP address
   throttle('tenant_signups/ip', limit: 5, period: 20.seconds) do |req|
     if req.path == '/tenants' && req.post?
-      req.ip
+      req.get_header("action_dispatch.remote_ip")
     end
   end
 
diff --git a/config/initializers/reserved_subdomains.rb b/config/initializers/reserved_subdomains.rb
index 096e499c..c8eb6560 100644
--- a/config/initializers/reserved_subdomains.rb
+++ b/config/initializers/reserved_subdomains.rb
@@ -9,5 +9,6 @@ RESERVED_SUBDOMAINS = [
   'admin',
   'logs',
   'dashboard',
-  'analytics'
+  'analytics',
+  'cname'
 ]
\ No newline at end of file