Please upgrade here. These earlier versions are no longer being updated and have security issues.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.

Disabling IP recording?

Hi,

I'm using Vanilla 2.1.3 and was wondering if there is anyway to completely disable IP recording?

As far as I can tell, I'd need to change this in \library\core\class.request.php:

   public function IpAddress() {
      //return $this->RequestAddress();
      return 0;
   }

But is there any way to change that so that I won't have to override a core file? i.e. if we update the forum the change will still be there?

Thanks!

Comments

  • BleistivtBleistivt Moderator
    edited October 2014

    Yes, you should be able to unset it like that:

    <?php if (!defined('APPLICATION')) exit();
    
    $PluginInfo['UnsetIP'] = array(
       'Name' => 'Unset IP address',
       'Description' => 'This plugin removes the IP address from all requests.',
       'Version' => '1.0',
       'Author' => 'Bleistivt',
       'MobileFriendly' => true
    );
    
    class UnsetIPPlugin extends Gdn_Plugin {
    
        public function __construct() {
            parent::__construct();
    
            Gdn::Request()->RequestAddress(null);
        }
    
    }
    
  • Thank you! I've copied it into /plugins/UnsetIP/default.php and enabled the plugin, but it's still recording IP addresses.

  • peregrineperegrine MVP
    edited October 2014

    You are aware changing core, or whatever you do, only stops the logging of ip address in the user table (i.e. Vanilla).

    all routers, switches, firewalls, still have a record of it, not to mention apache logs, still have a record of it. It's a false sense of anonymity.

    same with http://vanillaforums.org/discussion/28298/removing-the-discussion-name-from-urls - "they" can still figure things out.

    http://vanillaforums.org/discussion/comment/166767/#Comment_166767

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • BleistivtBleistivt Moderator
    edited October 2014

    Sorry, for some reason I can't explain, the constructor isn't called.
    Tested this locally and it works:

    <?php if (!defined('APPLICATION')) exit();
        $PluginInfo['UnsetIP'] = array(
        'Name' => 'Unset IP address',
        'Description' => 'This plugin removes the IP address from all requests.',
        'Version' => '1.0',
        'Author' => 'Bleistivt',
        'MobileFriendly' => true
    );
    class UnsetIPPlugin extends Gdn_Plugin {
        public function Base_AppStartup_Handler() {
            Gdn::Request()->RequestAddress('');
        }
    }
    
  • LincLinc Detroit Admin
    edited October 2014

    I'd be interested in seeing this as a plugin. If it requires a core change like a new hook, let me know or send a PR.

  • LincLinc Detroit Admin

    @peregrine said:
    all routers, switches, firewalls, still have a record of it, not to mention apache logs, still have a record of it. It's a false sense of anonymity.

    That's an uncorrelated list that's nearly worthless, if it's even logging. Vanilla associates it with particular users and comments, and establishes patterns over long courses of time. I think it's a worthy objective. I've had long thinks about this myself.

    My own particular goal might be to expunge long-term records but keep short-term ones for moderation purposes. That may be splitting hairs, tho.

  • @linc The second one I posted works, but I have no explanation to why the constructor on the first plugin I posted was never called.

    Is there an earlier event than AppStartup that is always fired?

  • peregrineperegrine MVP
    edited October 2014

    @linc said: That's an uncorrelated list that's nearly worthless

    my point still stands. that it can be correlated. but it would be alot of work. I'm not saying its a good idea or bad idea, just saying it can be done, no matter what you think about correlation. And if someone thinks it perfectly masks a user's identity they would be completely wrong. Granted it would be harder to discern.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • LincLinc Detroit Admin

    AppStartup is earliest, I believe.

    PHP's __construct gets called when the object is instantiated, which in Vanilla I don't think is done unless a method in it is invoked.

  • Works perfectly now, thank you so much Bleistivt! Also, based on what Linc has said (and thank you for the clarity on that) it could be worth you uploading this as an actual add-on! :)

Sign In or Register to comment.