From 90ccbac47393e9d9d4693d3e5ac7338331cd6468 Mon Sep 17 00:00:00 2001
From: Jonathan Nessier <jonathan.nessier@neoflow.ch>
Date: Fri, 1 Jul 2022 08:42:55 +0200
Subject: [PATCH] Added support for visitor IP exclusion #3

---
 README.md   |  9 ++++++++-
 index.php   | 46 ++++++++++++++++++++++++++--------------------
 options.php | 13 ++++++++++---
 3 files changed, 44 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 85a1a6c..34cc593 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ Written in PHP for Shared-Hosting on Apache.
 // If your proxy runs under https://example.com/stats, then set /stats as relative URI and otherwise just leave the string blank.
 $relativeUri = '/stats';
 
-// Set all allowed URI which should be accessible trough the proxy
+// Set all allowed URI which should be accessible through the proxy
 $whitelist = [
     '/js/script.js',
     '/js/plausible.outbound-links.js',
@@ -43,6 +43,13 @@ $mapping = [
     '/foo/bar.js' => '/js/plausible.outbound-links.js'
 ];
 
+// Set visitor IP addresses as exclusion (e.g. for yourself or developers)
+// If not needed then leave the array empty.
+$excluded = [
+    '127.0.0.1',
+    '::1',
+];
+
 // Set URL of Plausible Analytics
 $backendUrl = "https://plausible.io";
 ```
diff --git a/index.php b/index.php
index aa0609e..59fc1ba 100644
--- a/index.php
+++ b/index.php
@@ -1,6 +1,6 @@
 <?php
 
-include 'options.php';
+require_once 'options.php';
 
 $requestUri = str_replace($relativeUri, '', $_SERVER['REQUEST_URI']);
 $requestUriPath = parse_url($requestUri, PHP_URL_PATH);
@@ -10,14 +10,17 @@
 
 if (in_array($requestUriPath, $whitelist)) {
 
+    $code = 403;
+    $content = 'Forbidden';
+
     $url = $backendUrl . $requestUri;
 
     if (array_key_exists($requestUriPath, $mapping)) {
         $url = $backendUrl . str_replace(
-            $requestUriPath,
-            $mapping[$requestUriPath],
-            $requestUri
-        );
+                $requestUriPath,
+                $mapping[$requestUriPath],
+                $requestUri
+            );
     }
 
     $ch = curl_init($url);
@@ -37,26 +40,29 @@
         $ip = $_SERVER['REMOTE_ADDR'];
     }
 
-    $headers['X-Forwarded-For'] = 'X-Forwarded-For: ' . $ip;
+    if (!in_array($ip, $excluded)) {
 
-    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
-    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
-    curl_setopt($ch, CURLOPT_HEADER, false);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
-    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+        $headers['X-Forwarded-For'] = 'X-Forwarded-For: ' . $ip;
 
-    if (strtolower($_SERVER['REQUEST_METHOD']) === 'post') {
-        curl_setopt($ch, CURLOPT_POST, true);
-        curl_setopt($ch, CURLOPT_POSTFIELDS, file_get_contents('php://input'));
-    }
+        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
+        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
+        curl_setopt($ch, CURLOPT_HEADER, false);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
+        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
 
-    $content = curl_exec($ch);
+        if (strtolower($_SERVER['REQUEST_METHOD']) === 'post') {
+            curl_setopt($ch, CURLOPT_POST, true);
+            curl_setopt($ch, CURLOPT_POSTFIELDS, file_get_contents('php://input'));
+        }
 
-    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-    $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
+        $content = curl_exec($ch);
 
-    curl_close($ch);
+        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
+
+        curl_close($ch);
+    }
 }
 
 http_response_code($code);
diff --git a/options.php b/options.php
index 2ee05c8..fcc2ef4 100644
--- a/options.php
+++ b/options.php
@@ -4,17 +4,24 @@
 // If your proxy runs under https://example.com/stats, then set /stats as relative URI and otherwise just leave the string blank.
 $relativeUri = '/stats';
 
-// Set all allowed URI which should be accessible trough the proxy
+// Set all allowed URI which should be accessible through the proxy
 $whitelist = [
     '/js/script.js',
-    '/js/plausible.outbound-links.js',
+    '/js/script.outbound-links.js',
     '/api/event'
 ];
 
 // Optional, map allowed URI to another for sanitizing any proofs of Plausible Analytics in the URI.
 // If not needed then leave the array empty.
 $mapping = [
-    '/foo/bar.js' => '/js/plausible.outbound-links.js'
+    '/foo/bar.js' => '/js/script.outbound-links.js'
+];
+
+// Set visitor IP addresses as exclusion (e.g. for yourself or developers)
+// If not needed then leave the array empty.
+$excluded = [
+    '127.0.0.1',
+    '::1',
 ];
 
 // Set URL of Plausible Analytics