Gets the client IP from a central place

app/classes/user.php

@@ -90,8 +90,10 @@ class User {
      * @return bool True if login is successful, false otherwise.
      */
     public function login($username, $password) {
-        // get client IP address
-        $ipAddress = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+        try {
+            // Get user's IP address
+            require_once __DIR__ . '/../helpers/logs.php';
+            $ipAddress = getUserIP();
 
             // Record attempt
             $this->rateLimiter->attempt($username, $ipAddress);
@@ -117,6 +119,9 @@ class User {
             // Get remaining attempts AFTER this failed attempt
             $remainingAttempts = $this->rateLimiter->getRemainingAttempts($username, $ipAddress);
             throw new Exception("Invalid credentials. {$remainingAttempts} attempts remaining.");
+        } catch (Exception $e) {
+            return $e->getMessage();
+        }
     }
 
 

app/includes/csrf_middleware.php

@@ -1,6 +1,7 @@
 <?php
 
 require_once __DIR__ . '/../helpers/security.php';
+require_once __DIR__ . '/../helpers/logs.php';
 
 function applyCsrfMiddleware() {
     $security = SecurityHelper::getInstance();
@@ -23,9 +24,10 @@ function applyCsrfMiddleware() {
         $token = $_POST['csrf_token'] ?? '';
         if (!$security->verifyCsrfToken($token)) {
             // Log CSRF attempt
+            $ipAddress = getUserIP();
             $logMessage = sprintf(
                 "CSRF attempt detected - IP: %s, Page: %s, User: %s",
-                $_SERVER['REMOTE_ADDR'],
+                $ipAddress,
                 $_GET['page'] ?? 'unknown',
                 $_SESSION['username'] ?? 'anonymous'
             );

app/includes/rate_limit_middleware.php

@@ -1,6 +1,7 @@
 <?php
 
 require_once __DIR__ . '/../classes/ratelimiter.php';
+require_once __DIR__ . '/../helpers/logs.php';
 
 /**
  * Rate limit middleware for page requests
@@ -14,7 +15,7 @@ function checkRateLimit($database, $endpoint, $userId = null) {
     global $app_root;
     $isTest = defined('PHPUNIT_RUNNING');
     $rateLimiter = new RateLimiter($database);
-    $ipAddress = $_SERVER['REMOTE_ADDR'];
+    $ipAddress = getUserIP();
 
     // Check if request is allowed
     if (!$rateLimiter->isPageRequestAllowed($ipAddress, $endpoint, $userId)) {