Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/geenforce/api/routes.py

@@ -21,7 +21,7 @@ from sqlalchemy.exc import IntegrityError
 from shopdb.api import (
     db, cache, success_response, error_response, ErrorCodes, require_permission,
     require_any_permission,
-    authorized_service_token, Setting, Application,
+    authorized_service_token, Setting, Application, client_ip,
 )
 
 SHAREROOT_SETTING = 'geenforce_share_root'
@@ -207,12 +207,14 @@ PAYLOAD_DOWNLOAD_RATELIMIT_WINDOW_SECONDS = 60
 
 
 def _client_ip():
-    """Caller IP for rate limiting, honoring the first X-Forwarded-For hop
-    (mirrors shopdb.core.api.auth._login_ip)."""
-    forwarded = request.headers.get('X-Forwarded-For')
-    if forwarded:
-        return forwarded.split(',')[0].strip()
-    return request.remote_addr or 'unknown'
+    """Caller IP for rate limiting.
+
+    Uses the shared helper, which resolves from remote_addr. The raw
+    X-Forwarded-For hop is client-supplied, so keying a rate limit on it lets a
+    caller rotate the header and get an unbounded budget - the same reasoning
+    _trusted_client_ip() above already applies to the allowlist.
+    """
+    return client_ip(request) or 'unknown'
 
 
 def _payload_max_bytes():