Activity Log - Add IP Address #2246

New Issue

OVERLORD · 2026-02-05T03:27:23+03:00

OVERLORD commented

2026-02-05 03:27:23 +03:00

Originally created by @Cave-Johnson on GitHub (May 15, 2021).

Describe the feature you'd like
Would we be able to get the IP address used associated with user activity in the activity dashboard, potentially as an extra column next to date?

Describe the benefits this feature would bring to BookStack users
This would make it easier to track down malicious activity on a bookstack instance and make post breach incident response an easier process.

Additional context
It would also allow admins an easier way to recognise any unknown logins. Useful as 2FA is not an option and password reuse, and attackers using password spraying is quite a common theme these days!

Originally created by @Cave-Johnson on GitHub (May 15, 2021). **Describe the feature you'd like** Would we be able to get the IP address used associated with user activity in the activity dashboard, potentially as an extra column next to date? **Describe the benefits this feature would bring to BookStack users** This would make it easier to track down malicious activity on a bookstack instance and make post breach incident response an easier process. **Additional context** It would also allow admins an easier way to recognise any unknown logins. Useful as 2FA is not an option and password reuse, and attackers using password spraying is quite a common theme these days!

OVERLORD added the 🔨 Feature Request 🔒 Security labels 2026-02-05 03:27:23 +03:00

OVERLORD closed this issue

2026-02-05 03:27:25 +03:00

OVERLORD commented

2026-02-05 03:27:31 +03:00

@johnroyer commented on GitHub (Jun 7, 2021):

@ssddanbrown : I notice the data type of detail in activities is text.
Do you think saving user IP in detail is reliable ?

@johnroyer commented on GitHub (Jun 7, 2021): @ssddanbrown : I notice the data type of `detail` in `activities` is `text`. Do you think saving user IP in `detail` is reliable ?

OVERLORD commented

2026-02-05 03:27:38 +03:00

@ssddanbrown commented on GitHub (Jun 7, 2021):

@johnroyer I'd prefer a new column to keep the data organised.

If you're thinking about taking this one on, A couple of notes:

We'll need to ensure that this keeps working behind a proxy where where standard proxy headers are used. (Laravel might already do this when fetching the request IP).
We'll need to not store IP addresses when in demo mode.

@ssddanbrown commented on GitHub (Jun 7, 2021): @johnroyer I'd prefer a new column to keep the data organised. If you're thinking about taking this one on, A couple of notes: - We'll need to ensure that this keeps working behind a proxy where where standard proxy headers are used. (Laravel might already do this when fetching the request IP). - We'll need to not store IP addresses when in demo mode.

OVERLORD commented

2026-02-05 03:27:42 +03:00

@johnroyer commented on GitHub (Jun 8, 2021):

There is a discussion about getting real IP : How to access client ip address in Laravel 5. We may need to check headers in $_SERVER to fingure out the real IP.

I create a test page with the code. This demo is using Nginx as reverse proxy, php-fpm as runtime environment. Hope it works.

No idea about adding IP into a new column for now. I think I need some more time to read the source code.

@johnroyer commented on GitHub (Jun 8, 2021): There is a discussion about getting real IP : [How to access client ip address in Laravel 5](https://www.edureka.co/community/92985). We may need to check headers in `$_SERVER` to fingure out the real IP. I create a [test page](https://zeroplex.tw) with [the code](https://gist.github.com/johnroyer/a6a93e82ab42e3e55d0e4bc2f4728f5a). This demo is using Nginx as reverse proxy, php-fpm as runtime environment. Hope it works. No idea about adding IP into a new column for now. I think I need some more time to read the source code.

OVERLORD commented

2026-02-05 03:27:45 +03:00

@Cave-Johnson commented on GitHub (Jun 8, 2021):

As a thought, for the use of reverse proxies it would be worth checking for the presence of the X-Forwarded-For header as this should include the real external IP address rather than IP address of the proxy. This may be present in Larvel but its not something I am familiar with

@Cave-Johnson commented on GitHub (Jun 8, 2021): As a thought, for the use of reverse proxies it would be worth checking for the presence of the X-Forwarded-For header as this should include the real external IP address rather than IP address of the proxy. This may be present in Larvel but its not something I am familiar with

OVERLORD commented

2026-02-05 03:27:48 +03:00

@ssddanbrown commented on GitHub (Jun 8, 2021):

Using $request->getClientIp() in Laravel should fetch the IP address with common proxy headers considered. Might need to little guidance in the BookStack docs to setting up trusted proxies to support.

@ssddanbrown commented on GitHub (Jun 8, 2021): Using `$request->getClientIp()` in Laravel should fetch the IP address with common proxy headers considered. Might need to little guidance in the BookStack docs to setting up trusted proxies to support.

OVERLORD commented

2026-02-05 03:27:51 +03:00

@johnroyer commented on GitHub (Aug 20, 2021):

@ssddanbrown May I take this issue, even I do not familiar with Laravel ?

@johnroyer commented on GitHub (Aug 20, 2021): @ssddanbrown May I take this issue, even I do not familiar with Laravel ?

OVERLORD commented

2026-02-05 03:27:54 +03:00

@ssddanbrown commented on GitHub (Sep 26, 2021):

Thanks to @johnroyer this will be part of the next patch release. PR details in #2936.

Thanks @Cave-Johnson for the original suggestion. Will therefore close this off.

@ssddanbrown commented on GitHub (Sep 26, 2021): Thanks to @johnroyer this will be part of the next patch release. PR details in #2936. Thanks @Cave-Johnson for the original suggestion. Will therefore close this off.

OVERLORD referenced this issue

2026-02-05 10:22:08 +03:00

[PR #2436] [MERGED] Entity Ownership System #5996

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2246