? .directory
? drupal-705718.patch
? includes/.directory
Index: includes/bootstrap.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v
retrieving revision 1.206.2.15
diff -u -p -r1.206.2.15 bootstrap.inc
--- includes/bootstrap.inc	7 May 2010 18:33:20 -0000	1.206.2.15
+++ includes/bootstrap.inc	7 May 2010 23:36:19 -0000
@@ -1210,9 +1210,12 @@ function ip_address() {
       // the XFF header if request really comes from one of them.
       $reverse_proxy_addresses = variable_get('reverse_proxy_addresses', array());
       if (!empty($reverse_proxy_addresses) && in_array($ip_address, $reverse_proxy_addresses, TRUE)) {
-        // If there are several arguments, we need to check the most
-        // recently added one, i.e. the last one.
-        $ip_address = array_pop(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']));
+        // If there are several arguments, we need to check the most recently
+        // added IP that does not match in reverse_proxy_addresses.
+        $ip_list = explode(', ', $_SERVER['HTTP_X_FORWARDED_FOR']);
+        while (in_array($ip_address, $reverse_proxy_addresses, TRUE)) {
+          $ip_address = array_pop($ip_list);
+        }
       }
     }
   }