Add IP validation functionality

Author: rubenreyes2000

deploy-config.orig.php

@@ -8,6 +8,18 @@
 /* DISABLED: Set to true to prevent the execution of this script. cript only when needed */
 define('DISABLED', false);
 
+/* IP_ALLOW: 
+ * Array of IP addresses and ranges in CIDR notation that are allowed to execute
+ * the script. Supports IPv4 and IPv6. Leave array empty to allow all IPs.
+ * GitHub IP ranges are 192.30.252.0/22 and 2620:112:3000::/44
+ * (https://help.github.com/articles/github-s-ip-addresses/)
+ * BitBucket IP ranges are 104.192.143.192/28 and 2401:1d80:1010::/64 
+ * (https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html)
+ *
+ */
+define('IP_ALLOW', serialize(array(
+)));
+
 /*
  * REMOTE_REPOSITORY:
  * Address of the remote Git repo. For private repos use the SSH address 

deploy.php

@@ -100,6 +100,41 @@ function endScript() {
 $fh = fopen(__DIR__ . '/deploy.lock', 'w');
 fclose($fh);
 
+// Check if IP is allowed
+if(defined('IP_ALLOW') && count(unserialize(IP_ALLOW))) {
+	$allow = false;
+	foreach(unserialize(IP_ALLOW) as $ip_allow) {
+		if(strpos($ip_allow, '/') === false) {
+			// Single IP
+			if(inet_pton($_SERVER['REMOTE_ADDR']) == inet_pton($ip_allow)) {
+				$allow = true;
+				break;
+			}
+		}
+		else {
+			// IP range
+			list($subnet, $bits) = explode('/', $ip_allow);
+			// Convert subnet to binary string of $bits length
+			$subnet = unpack('H*', inet_pton($subnet));
+			foreach($subnet as $i => $h) $subnet[$i] = base_convert($h, 16, 2);
+			$subnet = substr(implode('', $subnet), 0, $bits);
+			// Convert remote IP to binary string of $bits length
+			$ip = unpack('H*', inet_pton($_SERVER['REMOTE_ADDR']));
+			foreach($ip as $i => $h) $ip[$i] = base_convert($h, 16, 2);
+			$ip = substr(implode('', $ip), 0, $bits);
+			if($subnet == $ip) {
+				$allow = true;
+				break;
+			}
+		}
+	}
+	if(!$allow) {
+		errorPage('<h2>Access Denied</h2>');
+		endScript();
+		die();
+	}
+}
+
 // If there's authorization error
 if (!isset($_GET['t']) || $_GET['t'] !== ACCESS_TOKEN || DISABLED === true) {
 	errorPage('<h2>Access Denied</h2>');