From 24c5e384b75aa88cd038b7d5ce91057ec331682b Mon Sep 17 00:00:00 2001
From: Horilla <teamhorilla@gmail.com>
Date: Wed, 3 Jul 2024 13:06:31 +0530
Subject: [PATCH] [FIX] ATTENDANCE: IP restriction nginx fix

---
 .../attendance/ip_restriction/add_more_ip_fields.html |  2 +-
 .../attendance/ip_restriction/restrict_form.html      |  6 +++---
 .../ip_restriction/restrict_update_form.html          |  2 +-
 attendance/views/clock_in_out.py                      | 11 +++++++----
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/attendance/templates/attendance/ip_restriction/add_more_ip_fields.html b/attendance/templates/attendance/ip_restriction/add_more_ip_fields.html
index b3f8fee9c..eebecdc10 100644
--- a/attendance/templates/attendance/ip_restriction/add_more_ip_fields.html
+++ b/attendance/templates/attendance/ip_restriction/add_more_ip_fields.html
@@ -24,4 +24,4 @@
     style="color: green"
     >{% trans "Add more IP address.." %}</a
   >
-</div>
\ No newline at end of file
+</div>
diff --git a/attendance/templates/attendance/ip_restriction/restrict_form.html b/attendance/templates/attendance/ip_restriction/restrict_form.html
index d1888548c..e032a69f2 100644
--- a/attendance/templates/attendance/ip_restriction/restrict_form.html
+++ b/attendance/templates/attendance/ip_restriction/restrict_form.html
@@ -10,7 +10,7 @@
 <div class="oh-modal__dialog-body">
     <form class="oh-profile-section" hx-post="{% url 'create-allowed-ip' %}" hx-target="#objectDetailsModalW25Target">
         {% for field in form.visible_fields %}
-            {{ form.non_field_errors }} 
+            {{ form.non_field_errors }}
             <div
                 class="oh-input__group"
                 id="moreIPContainer_{{ forloop.counter0 }}"
@@ -23,7 +23,7 @@
                     {% trans field.label %}
                 </label>
                 {{ field }}
-            </div> 
+            </div>
         {% endfor %}
         <div id="moreIPContainer_{{form.ip_counts}}" class="pt-2" style="text-align: end">
             <a
@@ -42,4 +42,4 @@
             </button>
         </div>
     </form>
-</div>
\ No newline at end of file
+</div>
diff --git a/attendance/templates/attendance/ip_restriction/restrict_update_form.html b/attendance/templates/attendance/ip_restriction/restrict_update_form.html
index 66dc9b1ef..2e9797146 100644
--- a/attendance/templates/attendance/ip_restriction/restrict_update_form.html
+++ b/attendance/templates/attendance/ip_restriction/restrict_update_form.html
@@ -16,4 +16,4 @@
             </button>
         </div>
     </form>
-</div>
\ No newline at end of file
+</div>
diff --git a/attendance/views/clock_in_out.py b/attendance/views/clock_in_out.py
index abbfbef0e..8c69fadd3 100644
--- a/attendance/views/clock_in_out.py
+++ b/attendance/views/clock_in_out.py
@@ -186,10 +186,13 @@ def clock_in(request):
     """
     allowed_attendance_ips = AttendanceAllowedIP.objects.first()
     if allowed_attendance_ips and allowed_attendance_ips.is_enabled:
-        if not (
-            request.META.get("REMOTE_ADDR")
-            in allowed_attendance_ips.additional_data["allowed_ips"]
-        ):
+
+        x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+        ip = request.META.get("REMOTE_ADDR")
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(",")[0]
+
+        if not (ip in allowed_attendance_ips.additional_data["allowed_ips"]):
             return HttpResponse(_("You cannot mark attendance from this network"))
 
     employee, work_info = employee_exists(request)