From b6ea558de8e55922d645f3a0da2fca0e62208b95 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 9 Mar 2026 15:14:17 -0400
Subject: [PATCH] Move TrackTrueClientIp middleware into saas engine (#2677)

The True-Client-IP header is set by Cloudflare and is only trustworthy
when behind a Cloudflare proxy. In non-Cloudflare deployments, this
header is attacker-controlled and can be used to spoof IP addresses.

Moving the middleware into the saas engine ensures it only loads for our
Cloudflare-fronted production deployment, not for self-hosted OSS
instances.

GHSA-cpch-9qg2-x8fq
---
 saas/lib/fizzy/saas/engine.rb                                | 5 +++++
 .../initializers => saas/lib/fizzy/saas}/true_client_ip.rb   | 2 --
 {test => saas/test}/lib/true_client_ip_test.rb               | 0
 3 files changed, 5 insertions(+), 2 deletions(-)
 rename {config/initializers => saas/lib/fizzy/saas}/true_client_ip.rb (87%)
 rename {test => saas/test}/lib/true_client_ip_test.rb (100%)

diff --git a/saas/lib/fizzy/saas/engine.rb b/saas/lib/fizzy/saas/engine.rb
index b90113544..1ba45df42 100644
--- a/saas/lib/fizzy/saas/engine.rb
+++ b/saas/lib/fizzy/saas/engine.rb
@@ -1,4 +1,5 @@
 require_relative "transaction_pinning"
+require_relative "true_client_ip"
 require_relative "signup"
 require_relative "authorization"
 require_relative "gvl_instrumentation"
@@ -61,6 +62,10 @@ module Fizzy
         app.config.middleware.insert_after(ActiveRecord::Middleware::DatabaseSelector, TransactionPinning::Middleware)
       end
 
+      initializer "fizzy_saas.true_client_ip" do |app|
+        app.config.middleware.insert_before ActionDispatch::RemoteIp, TrackTrueClientIp
+      end
+
       initializer "fizzy_saas.gvl_instrumentation" do |app|
         app.config.middleware.insert_before(Rack::Runtime, GvlInstrumentation)
       end
diff --git a/config/initializers/true_client_ip.rb b/saas/lib/fizzy/saas/true_client_ip.rb
similarity index 87%
rename from config/initializers/true_client_ip.rb
rename to saas/lib/fizzy/saas/true_client_ip.rb
index cac696107..27c5f0729 100644
--- a/config/initializers/true_client_ip.rb
+++ b/saas/lib/fizzy/saas/true_client_ip.rb
@@ -20,5 +20,3 @@ class TrackTrueClientIp
     @app.call(env)
   end
 end
-
-Rails.application.config.middleware.insert_before ActionDispatch::RemoteIp, TrackTrueClientIp
diff --git a/test/lib/true_client_ip_test.rb b/saas/test/lib/true_client_ip_test.rb
similarity index 100%
rename from test/lib/true_client_ip_test.rb
rename to saas/test/lib/true_client_ip_test.rb