Potential security vulnerability

[SteveTalbot]

Note: A fix now exists in both master and develop, and has been released with 2.2.5

The X-Forwarded-For header is a comma-separated list of IP
addresses, where the leftmost is the original client and the others
are successive proxies or load balancers. The address of the last
proxy is the apparent source IP address, in

`````` $_SERVER['REMOTE_ADDR']```.

In Zend\Http\PhpEnvironment\RemoteAddress, when $useProxy
is set to true, the getIpAddressFromProxy() function does not
check whether $_SERVER['REMOTE_ADDR'] is one of the trusted
proxies. Hence if the client is not behind a trusted proxy and spoofs
the X-Forwarded-For header, this function will return a spoofed
IP address.

This allows a session hijacking attack because of the way
Zend\Http\PhpEnvironment\RemoteAddress is used in the
Zend\Session\Validator\RemoteAddr session validator.

I think it would be safer to replace the start of the function as follows:

```
protected function getIpAddressFromProxy()
{
    if (!$this->useProxy || !in_array($_SERVER['REMOTE_ADDR'],
```

$this->trustedProxies)) {
            return false;
        }

So if the source IP address is not a trusted proxy,
getIpAddressFromProxy() would return false and
getIpAddress() function would return
$_SERVER['REMOTE_ADDR'], which I think is more desirable
behaviour.

[weierophinney]

@SteveTalbot Please, never, never, never report potential security issues on a public tracker. Our README clearly details how to report security issues (tl;dr: email to [email protected]). In the meantime, I've removed the contents of the report until we can review and patch the issue.

[SteveTalbot]

Apologies --- to avoid anyone else doing the same, it'd be helpful to add the zf-security e-mail address to https://github.com/zendframework/zf2/blob/master/CONTRIBUTING.md, which is linked from the "New Issue" page on GitHub.

[EvanDotPro]

@SteveTalbot Definitely, we'll be updating the readme and contributing documents to make this as apparent as possible. Thank you.

[weierophinney]

Patches have been reviewed, and I've applied in my local branch. I'll be pushing shortly, and will release with 2.2.5 later today.