Checker.php

<?php

/**
 * IP Block Protection - a XenForo 2 add-on.
 *
 * @copyright 2026 ip-block.com
 * @license   GNU General Public License v2.0 only
 */

namespace IpBlock\Protection;

/**
 * IP screening decision engine.
 *
 *   - resolve the real client IP (respecting behind_proxy),
 *   - honour the whitelist,
 *   - cache decisions keyed by md5(ip|user_agent|referrer),
 *   - apply the fail mode (default FAIL OPEN = allow) on any error,
 *   - block by redirect or 403 message.
 */
class Checker
{
	/** @var \XF\App */
	protected $app;

	public function __construct(\XF\App $app)
	{
		$this->app = $app;
	}

	/**
	 * Screen the current request. When the visitor must be blocked this throws a
	 * reply exception which XenForo turns into the response, halting dispatch.
	 *
	 * @param \XF\Mvc\Controller $controller
	 *
	 * @throws \XF\Mvc\Reply\Exception
	 */
	public function guard(\XF\Mvc\Controller $controller)
	{
		$options = $this->app->options();

		if (empty($options->ipBlockEnabled) || $options->ipBlockSiteId === '' || $options->ipBlockApiKey === '')
		{
			return;
		}

		$ip = $this->getClientIp();
		if ($ip === '')
		{
			return;
		}

		// The whitelist is always honoured.
		if ($this->isWhitelisted($ip, $options->ipBlockWhitelist))
		{
			return;
		}

		$request   = $this->app->request();
		$userAgent = (string) $request->getServer('HTTP_USER_AGENT', '');
		$referrer  = (string) $request->getServer('HTTP_REFERER', '');

		if ($this->decide($ip, $userAgent, $referrer) === 'block')
		{
			$this->block($controller);
		}
	}

	/**
	 * Resolve a decision, using the XenForo cache when enabled.
	 *
	 * @return string 'allow' | 'block'
	 */
	protected function decide($ip, $userAgent, $referrer)
	{
		$options = $this->app->options();
		$ttl     = (int) $options->ipBlockCacheTtl;
		$cache   = $this->app->cache();
		$key     = 'ipblock_' . md5($ip . '|' . $userAgent . '|' . $referrer);

		if ($ttl > 0 && $cache)
		{
			$cached = $cache->fetch($key);
			if ($cached === 'allow' || $cached === 'block')
			{
				return $cached;
			}
		}

		$result = (new Client($this->app))->check($ip, $userAgent, $referrer);

		if ($result === null)
		{
			// Any error/timeout => apply fail mode (default FAIL OPEN = allow).
			$action = !empty($options->ipBlockFailOpen) ? 'allow' : 'block';
		}
		else
		{
			$action = $result;
		}

		if ($ttl > 0 && $cache)
		{
			$cache->save($key, $action, $ttl);
		}

		return $action;
	}

	/**
	 * Determine the real client IP address.
	 *
	 * When behind_proxy is on we trust CF-Connecting-IP first (Cloudflare), then
	 * the first entry of X-Forwarded-For. Otherwise we use REMOTE_ADDR.
	 *
	 * @return string A valid IP, or '' when none could be determined.
	 */
	protected function getClientIp()
	{
		$request    = $this->app->request();
		$candidates = [];

		if (!empty($this->app->options()->ipBlockBehindProxy))
		{
			$cf = trim((string) $request->getServer('HTTP_CF_CONNECTING_IP', ''));
			if ($cf !== '')
			{
				$candidates[] = $cf;
			}

			$xff = (string) $request->getServer('HTTP_X_FORWARDED_FOR', '');
			if ($xff !== '')
			{
				$parts = explode(',', $xff);
				$candidates[] = trim($parts[0]);
			}
		}

		$candidates[] = (string) $request->getServer('REMOTE_ADDR', '');

		foreach ($candidates as $candidate)
		{
			if ($candidate !== '' && filter_var($candidate, FILTER_VALIDATE_IP) !== false)
			{
				return $candidate;
			}
		}

		return '';
	}

	/**
	 * Is the IP explicitly whitelisted? (one IP per line)
	 *
	 * @param string $ip
	 * @param string $whitelist
	 *
	 * @return bool
	 */
	protected function isWhitelisted($ip, $whitelist)
	{
		$whitelist = (string) $whitelist;
		if ($whitelist === '')
		{
			return false;
		}

		foreach (preg_split('/\r\n|\r|\n/', $whitelist) as $line)
		{
			if (trim($line) === $ip)
			{
				return true;
			}
		}

		return false;
	}

	/**
	 * Build and throw the block reply.
	 *
	 * @param \XF\Mvc\Controller $controller
	 *
	 * @throws \XF\Mvc\Reply\Exception
	 */
	protected function block(\XF\Mvc\Controller $controller)
	{
		$options = $this->app->options();

		if ($options->ipBlockBlockAction === 'message')
		{
			$message = $options->ipBlockBlockMessage ?: 'Access to this site has been denied.';
			throw $controller->exception($controller->error($message, 403));
		}

		throw $controller->exception($controller->redirect('https://www.ip-block.com/blocked.php'));
	}
}