From c9ef07880a05fd95513eaca8872df974fe7aaa53 Mon Sep 17 00:00:00 2001
From: Wolvan <wolvan1@gmail.com>
Date: Sun, 13 Feb 2022 02:51:21 +0100
Subject: [PATCH] Fix IP Deduplication check behind proxy

Turns out using `X-Forwarded-For` appends each proxy's IP. This leads
to being able to easily circumvent IP duplication checking especially
behind hosts like cloudflare that use different routes each time to
reach the destination server.
Now the IP is being split at all commas, as hosts are comma separated in
the header and uses the first IP it can get.
---
 src/backend.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/backend.ts b/src/backend.ts
index 1c71360..b7e5018 100644
--- a/src/backend.ts
+++ b/src/backend.ts
@@ -94,8 +94,9 @@ export default async function init(router: Router, polls: Storage): Promise<void
         };
 
         if (poll.dupeCheckMode === "ip") {
-            if (Array.isArray(poll.dupeData) && poll.dupeData.includes(ip as string)) return null;
-            if (Array.isArray(poll.dupeData)) poll.dupeData.push(ip as string);
+            const dupeIP = ip.split(/, ?/).shift() || "";
+            if (Array.isArray(poll.dupeData) && poll.dupeData.includes(dupeIP)) return null;
+            if (Array.isArray(poll.dupeData)) poll.dupeData.push(dupeIP);
         } else if (poll.dupeCheckMode === "cookie") {
             const cookie = cookies[poll.dupeData as string];
             if (cookie) return null;