[BUG] Session reuse detected

[nickchomey]

Sometimes we get blocked from logging in when using a Cloudflare domain. It is well documented here with a solution https://community.cyberpanel.net/t/session-reuse-detected/56247/9

Can this change be incorporated into the next release?

This code should change to the following.

try:
            uID = request.session['userID']
            admin = Administrator.objects.get(pk=uID)
            ipAddr = secMiddleware.get_client_ip('True-Client-IP')

            if ipAddr.find('.') > -1:
                if request.session['ipAddr'] == ipAddr or admin.securityLevel == secMiddleware.LOW:
                    pass
                else:
                    del request.session['userID']
                    del request.session['ipAddr']
                    logging.writeToFile(secMiddleware.get_client_ip('True-Client-IP'))
                    final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                                 "errorMessage": "Session reuse detected, IPAddress logged."}
                    final_json = json.dumps(final_dic)
                    return HttpResponse(final_json)
            else:
                ipAddr = secMiddleware.get_client_ip('True-Client-IP').split(':')[:3]
                if request.session['ipAddr'] == ipAddr or admin.securityLevel == secMiddleware.LOW:
                    pass
                else:
                    del request.session['userID']
                    del request.session['ipAddr']
                    logging.writeToFile(secMiddleware.get_client_ip('True-Client-IP'))
                    final_dic = {'error_message': "Session reuse detected, IPAddress logged.",
                                 "errorMessage": "Session reuse detected, IPAddress logged."}
                    final_json = json.dumps(final_dic)
                    return HttpResponse(final_json)
        except:
            pass

I dont know/remember how cyberpanel branches work, so it would be much easier if you can just implement it @usmannasir

It probably needs to have some conditional logic to handle cloudflare vs not cloudflare - perhaps check for the existence of True-Client-IP, and use it if it is there. Otherwise use request

[hlshell]

#1371

This is the effective way to solve the problem.