Collecting Customer's IP address during checkout - why is everyone 172.16.10.1 ?

I have two stores basically the same - the exact same version both using USAePay. One collects the IP and sends it over to USAePay for my customer to have on file (he uses it to detect fraud) - the other does not... :lookaroun

What have I **not **clicked in the admin on one that I have on the other to get this to work.... I've gone through seemingly every screen and can't find a reference to save or not to save the customer's IP. Both sites are 1.3.8a.

Ruth

I've looked into this further after the customer contacted me. It is collecting an IP address... the same one for every transaction. This problem is not related to our merchant account as I just did a test transaction using check/money order and it once again collected the same IP.

The IP being displayed is 172.16.10.1 - 172.16.10.1 and that is not my IP for sure -nor is it the IP of 25 other customer's that have purchased. This is really critical as it is used as a tool to help prevent fraudulent transactions. Can anyone please lend some insight into what's going on here?

This started after moving the site and in doing so I did a clean install of files and then loaded the rebuilt db. :blink:

Thanks

I know I seem to be talking to my self but in checking out everything I've now noticed in the footer where the IP is set to display - it is also displaying that incorrect IP address... now I'm really confused... I've double check the code and it's fine - I even removed all the other "stuff" in the footer and put just the IP code back (copying it from the default template) and I get the same result - the same IP address is showing... arghhh...can someone enlighten me here...:frusty::

Click here to check your address against the foother

rwoody:

This started after moving the site

You'll need to ask your new hosting company why all your visitors are showing up as having the same private IP address.
It's most likely a result of their firewall and/or some sort of proxy configuration.

Granted, Zen Cart already checks for most known proxy configurations to attempt to pull the right IP address even in most odd server configurations.

I just installed the User tracking and there it is again.. that same IP!! I was thinking the same exact thing. This is a really weird setup on this server - I'll see what I can find out. Thanks a ton for checking in on this..

Have a super day!!

Ruth

DrByte:

You'll need to ask your new hosting company why all your visitors are showing up as having the same private IP address.
It's most likely a result of their firewall and/or some sort of proxy configuration.

Granted, Zen Cart already checks for most known proxy configurations to attempt to pull the right IP address even in most odd server configurations.

By the way, who are you hosted with?

Dr. Byte - hope you can help - the server company came back and gave my customer the following: The told him to replace server array code with: ```php
HTTP_X_CLUSTER_CLIENT_IP

**I looked up the "Get IP function and found the following -**
(I'm pulling this from the functions_general.php file around line 756)


```php
////
  function zen_get_ip_address() {
    if (isset($_SERVER)) {
      if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
      } elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
      } else {
        $ip = $_SERVER['REMOTE_ADDR'];
      }
    } else {
      if (getenv('HTTP_X_FORWARDED_FOR')) {
        $ip = getenv('HTTP_X_FORWARDED_FOR');
      } elseif (getenv('HTTP_CLIENT_IP')) {
        $ip = getenv('HTTP_CLIENT_IP');
      } else {
        $ip = getenv('REMOTE_ADDR');
      }
    }

    return $ip;
  }

**
Is the following what they are asking me to do and does it makes sense to you? As I tried it and nothing changed - **

function zen_get_ip_address() {
    if (isset($_SERVER)) {
      if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
      } elseif (isset($_SERVER['HTTP_X_CLUSTER_CLIENT_IP '])) {
        $ip = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP '];
      } else {
        $ip = $_SERVER['REMOTE_ADDR'];
      }
    } else {
      if (getenv('HTTP_X_FORWARDED_FOR')) {
        $ip = getenv('HTTP_X_FORWARDED_FOR');
      } elseif (getenv('HTTP_X_CLUSTER_CLIENT_IP ')) {
        $ip = getenv('HTTP_X_CLUSTER_CLIENT_IP ');
      } else {
        $ip = getenv('REMOTE_ADDR');
      }
    }

    return $ip;
  }

I'm really unfamiliar with what they are trying to do here, but the company fully admitted it was their setup that was blocking the IP detection. (Why they are doing this as standard practice is beyond me - one more reason I have my own servers - arghhh)-.

Is there somewhere else I need to change this code. I saw a similar line of code in the "Who online" file - I think I'm a bit outside of my expertise here.

Ruth

It would appear the Hoster is running Clustered Servers and using a form of custom code or incorrect code, for IP referencing.

Odds are that other IP related problems are going to occur but the big issue is the Originating IP. As many Merchant Gateways use IPs to determine not only Fraud but if they will even process the Order, I suggest finding a new Hoster. You mention you have your own Servers and that might be the best solution of all in this case. At least that way, if there is a problem you can login to the Server and fix anything. :wink:

Ok, I'm going to try this again. I spoke with the tech and was given this info:

Your script is calling for the "REMOTE_ADDR" and receives the IP of a server in front of one of our back-end servers. The web facing server is then passing the scripts output without giving the expected REMOTE_ADDR of the visitor. In order for your scripts to recognize that they are on a cluster and log the correct IP of your visitors, you will need to replace and add the code below.

For PHP:
Locate any lines of code that are similar to this snippet of code,
$_SERVER['REMOTE_ADDR'];
And replace it with this snippet of code,
$_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];

They "claim" they have tons of Zen-Cart's running... I want him on my server, but I have one shop (same products different look) on my server and he wants one on a different server in the event of a disaster - he doesn't lose both shops...arghhhh - My server(s) are specifically optimized to handle Zen-Cart and Joomla - that's all I have on them and they run perfectly!!! Oh well... I guess I'm off a "grepping"...LOL

What a pain!!! :frusty:

As to changing Zen Cart code, the change you've suggested in functions_general is what I'd recommend too.

If you're planning to change REMOTE_ADDR elsewhere, change it to zen_get_ip_address() instead of $_SERVER['HTTP-blahblahblah-that-they-suggested']
and just keep the changes you made to functions_general.

The orders class, which feeds the payment modules (if they're smart enough to use the supplied data), should already be using the zen_get_ip_address() function.

Perhaps your addon payment module is not written as smartly, and is using REMOTE_ADDR instead of zen_get_ip_address() ? In which case, you'd only need to change that file.

I made the changes in functions and nothing changed (still bad incoming IPs) but I also changed it in customer tracking mod and broke the site..arggg :frusty:. I'm going to create a test site with a clean set of files in a subdirectory and play with this there. I can't keep breaking the live site.. really bad protocol.

Thanks for your help.

Ruth

DrByte:

The orders class, which feeds the payment modules (if they're smart enough to use the supplied data), should already be using the zen_get_ip_address() function.

Perhaps your addon payment module is not written as smartly, and is using REMOTE_ADDR instead of zen_get_ip_address() ? In which case, you'd only need to change that file.

If I understand this post correctly - if I check the USAePay module and make the change there we should get the corrected IP? That said, in the admin - orders - even on a check/money order the IP is incorrect. Its an IP that is being thrown by my customer's server not the originating purchasers IP....

I'll start doing a search to find all occasions of this code and see where we are..

Thanks again.

Ruth

Three basic places should cover most of your issues, in addition to the functions_general change you made and any required changes to your epay module:

In /includes/application_top.php, near the end of the file, change this line:$customers_ip_address = $_SERVER['REMOTE_ADDR']; to this:```
$customers_ip_address = zen_get_ip_address();

For whos_online, change includes/functions/whos_online.php:```
  $wo_ip_address = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'Unknown');
```to:```
  $wo_ip_address = zen_get_ip_address();

For the footer, change your template file tpl_footer.php:```

And strongly evaluate why you moved to this particular host :D

Fortunately, the upcoming 1.4.0 version of Zen Cart has more central control over this.

Got a similar issue! The IP address on the customer invoice is incorrect and showing the wrong internal private IP.

I already edited the zen_get_ip_address() function and now it is giving the proper IP address (I tested this by calling the get_ip_address() function and showing that in the footer and it does indeed show the correct IP address for that user).

So then that should have fixed the problem, but it didn't! Still wrong IP address showing up on the invoice. What does that mean... I think it isn't calling that function in whatever file writes the IP on the invoice and it is hardcoded to $_SERVER['remote_addr'].

Dr Byte, you mentioned "the orders class, which feeds the payment modules should already be using the zen_get_ip_address() function"... do you know this for a fact? What file can I look at to see this?

Basically my question is: What file writes the IP address on the customer's order? If I knew that I could have it reference the get_ip_address() function and since that provides the correct IP all will work properly.

Apprecaite your help guys!

If you've updated application_top as I posted previously, it should be fine.

This line in /includes/classes/order.php is what stores the IP address information. It is two addresses: the first one is the customer ip address as set in application_top, and the second is the IP address detected at the time of order completion. You could change the second one if you desire by using the zen_get_ip_address function there too ... but that does defeat the purpose of the two separate addresses (the second one is technically intended to find out whether the payment was completed via a 3rd-party site such as PayPal etc)```
'ip_address' => $_SESSION['customers_ip_address'] . ' - ' . $_SERVER['REMOTE_ADDR']

DrByte, you're the man! I missed that file to edit, and just to reitterate it was the /includes/application_top.php file that needed editing and once you do that it will all work gravy!!!

Thanks :-)

Hi everyone

I am a newbie to Zen cart.. and so far it is working great (moved from another "caffeine fueled" shop :wink:)

The major issue I have is the same as these posts, namely that every single visitors ip addy is displayed as 10.216.1.63 in every area that displays the ip address !

I have tried the suggestions that everyone has been good enough to post here but to no avail.

I am using the latest build 1.39h

Thanks in advance !