1.7.1: security fixes for the checkout and the client IP

- The discount follows the billing email, the address the order is
  placed under. The tracked session email used to win, so a guest could
  post a discounted address to the tracking endpoint and check out under
  their own, keeping the discount.
- Shipping packages carry the matched assignment, so WooCommerce's
  per-package rate cache no longer reuses rates filtered for a matched
  address (free shipping, reserved methods) after the email changes.
- The anonymous tracking endpoint no longer answers matched: true|false,
  which let anyone enumerate discounted addresses and domains.
- CF-Connecting-IP is believed only from a Cloudflare edge range or a
  private/loopback proxy. From anyone else it let a direct client pick a
  new address per request: no REST rate limit, forged audit-log IPs.

Smoke tests: 89 assertions (was 73), each fix with its own.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

includes/class-audit-log.php

@@ -78,27 +78,64 @@ class WC_EDM_Audit_Log {
 		return max( 1, (int) apply_filters( 'wc_edm_audit_log_retention_days', 30 ) );
 	}
 
+	/**
+	 * Cloudflare's published edge ranges (https://www.cloudflare.com/ips/).
+	 *
+	 * @var string[]
+	 */
+	const CLOUDFLARE_RANGES = array(
+		'173.245.48.0/20',
+		'103.21.244.0/22',
+		'103.22.200.0/22',
+		'103.31.4.0/22',
+		'141.101.64.0/18',
+		'108.162.192.0/18',
+		'190.93.240.0/20',
+		'188.114.96.0/20',
+		'197.234.240.0/22',
+		'198.41.128.0/17',
+		'162.158.0.0/15',
+		'104.16.0.0/13',
+		'104.24.0.0/14',
+		'172.64.0.0/13',
+		'131.0.72.0/22',
+		'2400:cb00::/32',
+		'2606:4700::/32',
+		'2803:f800::/32',
+		'2405:b500::/32',
+		'2405:8100::/32',
+		'2a06:98c0::/29',
+		'2c0f:f248::/32',
+	);
+
 	/**
 	 * Resolve the client IP address.
 	 *
-	 * The shop may sit behind a reverse proxy (e.g. Cloudflare), where
-	 * REMOTE_ADDR is the proxy rather than the visitor. Proxy headers are
-	 * only trustworthy when the proxy is guaranteed to set them, so this is
-	 * filterable for setups that need different handling.
+	 * REMOTE_ADDR is the only value a visitor cannot choose. The shop may sit
+	 * behind Cloudflare, where REMOTE_ADDR is the proxy, so CF-Connecting-IP
+	 * is used — but only when the request really came from a proxy: one of
+	 * Cloudflare's edge ranges, or a private/loopback address (a Cloudflare
+	 * tunnel or a reverse proxy on the same host or network).
+	 *
+	 * 🔴 Up to 1.7.0 the header was believed from anyone. A client talking to
+	 * the shop directly could send a new CF-Connecting-IP with every request,
+	 * so each one landed in a fresh rate-limit bucket (no limit at all on the
+	 * REST API) and the audit log recorded whatever address it was told.
 	 *
 	 * @return string
 	 */
 	public static function get_client_ip() {
-		$ip = '';
+		$remote = ! empty( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+		$remote = filter_var( $remote, FILTER_VALIDATE_IP ) ? $remote : '';
+		$ip     = $remote;
 
-		if ( ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) {
-			$ip = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
-		} elseif ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
-			$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
+		if ( $remote && ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] ) && self::is_trusted_proxy( $remote ) ) {
+			$forwarded = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
+			if ( filter_var( $forwarded, FILTER_VALIDATE_IP ) ) {
+				$ip = $forwarded;
+			}
 		}
 
-		$ip = filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : '';
-
 		/**
 		 * Filter the resolved client IP used for logging and rate limiting.
 		 *
@@ -107,6 +144,63 @@ class WC_EDM_Audit_Log {
 		return (string) apply_filters( 'wc_edm_client_ip', $ip );
 	}
 
+	/**
+	 * Whether a connecting address is a proxy whose CF-Connecting-IP is believed.
+	 *
+	 * @param string $remote REMOTE_ADDR, already validated.
+	 * @return bool
+	 */
+	public static function is_trusted_proxy( $remote ) {
+		// Private and loopback: a tunnel or reverse proxy on our own network.
+		// FILTER_FLAG_NO_PRIV_RANGE rejects them, so failing it means private.
+		if ( ! filter_var( $remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE ) || self::in_cidr( $remote, '127.0.0.0/8' ) || '::1' === $remote ) {
+			return true;
+		}
+
+		foreach ( self::CLOUDFLARE_RANGES as $range ) {
+			if ( self::in_cidr( $remote, $range ) ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Whether an address lies inside a CIDR range (IPv4 or IPv6).
+	 *
+	 * @param string $ip    Address.
+	 * @param string $range CIDR range.
+	 * @return bool
+	 */
+	public static function in_cidr( $ip, $range ) {
+		list( $subnet, $bits ) = explode( '/', $range );
+
+		$ip_bin     = inet_pton( $ip );
+		$subnet_bin = inet_pton( $subnet );
+
+		if ( false === $ip_bin || false === $subnet_bin || strlen( $ip_bin ) !== strlen( $subnet_bin ) ) {
+			return false;
+		}
+
+		$bits  = (int) $bits;
+		$bytes = intdiv( $bits, 8 );
+
+		if ( substr( $ip_bin, 0, $bytes ) !== substr( $subnet_bin, 0, $bytes ) ) {
+			return false;
+		}
+
+		$rest = $bits % 8;
+
+		if ( 0 === $rest ) {
+			return true;
+		}
+
+		$mask = chr( ( 0xff << ( 8 - $rest ) ) & 0xff );
+
+		return ( $ip_bin[ $bytes ] & $mask ) === ( $subnet_bin[ $bytes ] & $mask );
+	}
+
 	/**
 	 * Record an entry.
 	 *