sec: disallow global IPs from proxying

main.py

@@ -19,17 +19,29 @@ redirect_filename = config["app"].get("redirect", "redirect")
 
 
 class MainApp:
+    def _can_ip_be_proxy(self):
+        self.remoteip = cherrypy.request.remote.ip
+        try:
+            ipobj = IPv4Address(self.remoteip)
+        except AddressValueError:
+            try:
+                ipobj = IPv6Address(self.remoteip)
+            except AddressValueError:
+                return False
+        return not ipobj.is_global
+
     def _init_ip(self):
         """
         Get remote IP
         """
+        if self._can_ip_be_proxy():
             try:
                 self.remoteip = cherrypy.request.headers.get(
                     'X-Real-Ip',
                     cherrypy.request.remote.ip
                 )
-        except BaseException:
-            self.remoteip = cherrypy.request.remote.ip
+            except KeyError:
+                pass
 
         try:
             self.hostinfo = socket.gethostbyaddr(self.remoteip)