From 1c3480f3229371c4ac6e5d3bbb90b1d4d97f3fda Mon Sep 17 00:00:00 2001
From: Znote <stefan_brannfjell@live.no>
Date: Sun, 18 Jul 2021 22:35:47 +0200
Subject: [PATCH] Fix paypal IPs, fix #467

---
 ipn.php | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/ipn.php b/ipn.php
index 9dcb9af..fc6597c 100644
--- a/ipn.php
+++ b/ipn.php
@@ -1,7 +1,44 @@
 <?php
+/* 2021: Paypal hosts arent neccesarily notify.paypal.com any longer.
 if (gethostbyaddr($_SERVER['REMOTE_ADDR']) !== 'notify.paypal.com') {
 	exit();
 }
+*/
+
+function ip_in_range( $ip, $range ) {
+    if ( strpos( $range, '/' ) === false ) {
+        $range .= '/32';
+    }
+    // $range is in IP/CIDR format eg 127.0.0.1/24
+    list( $range, $netmask ) = explode( '/', $range, 2 );
+    $range_decimal = ip2long( $range );
+    $ip_decimal = ip2long( $ip );
+    $wildcard_decimal = pow( 2, ( 32 - $netmask ) ) - 1;
+    $netmask_decimal = ~ $wildcard_decimal;
+    return ( ( $ip_decimal & $netmask_decimal ) == ( $range_decimal & $netmask_decimal ) );
+}
+
+$paypal_ip_ranges = array(
+    "173.0.81.65",
+    "173.0.81.140",
+    "64.4.240.0/21",
+    "64.4.248.0/22",
+    "66.211.168.0/22",
+    "173.0.80.0/20",
+    "91.243.72.0/23"
+);
+
+$verified = false;
+for($i = 0; $i < count($paypal_ip_ranges); $i++) {
+    if(ip_in_range($_SERVER["REMOTE_ADDR"], $paypal_ip_ranges[$i])) {
+        $verified = true;
+        break;
+    }
+}
+
+if(!$verified) {
+    exit();
+}
 
 // Require the functions to connect to database and fetch config values
 require 'config.php';