Add utility to get IP address

doc/admin/config.rst

@@ -82,6 +82,11 @@ Example::
     Enables or disables obligatory usage of Two-Factor Authentication for users of the pretix backend.
     Defaults to ``False``
 
+``trust_x_forwarded_for``
+    Specifies whether the ``X-Forwarded-For`` header can be trusted. Only set to ``on`` if you have a reverse
+    proxy that actively removes and re-adds the header to make sure the correct client IP is the first value.
+    Defaults to ``off``.
+
 
 Locale settings
 ---------------

src/pretix/helpers/http.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.http import StreamingHttpResponse
 
 
@@ -9,3 +10,12 @@ class ChunkBasedFileResponse(StreamingHttpResponse):
         streaming_content = streaming_content.chunks(self.block_size)
         super().__init__(streaming_content, *args, **kwargs)
         self['Content-Length'] = filelike.size
+
+
+def get_client_ip(request):
+    ip = request.META.get('REMOTE_ADDR')
+    if settings.TRUST_X_FORWARDED_FOR:
+        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(',')[0]
+    return ip

src/pretix/settings.py

@@ -130,6 +130,8 @@ if SITE_URL.endswith('/'):
 
 CSRF_TRUSTED_ORIGINS = [urlparse(SITE_URL).hostname]
 
+TRUST_X_FORWARDED_FOR = config.get('pretix', 'trust_x_forwarded_for', fallback=False)
+
 PRETIX_PLUGINS_DEFAULT = config.get('pretix', 'plugins_default',
                                     fallback='pretix.plugins.sendmail,pretix.plugins.statistics,pretix.plugins.checkinlists')
 PRETIX_PLUGINS_EXCLUDE = config.get('pretix', 'plugins_exclude', fallback='').split(',')