Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/tools/api/routes.py

@@ -37,7 +37,7 @@ from flask import current_app
 from flask_jwt_extended import jwt_required, get_jwt_identity, current_user
 
 from shopdb.api import (
-    db, cache, Setting,
+    db, cache, Setting, client_ip,
     success_response, error_response, ErrorCodes,
 )
 
@@ -117,8 +117,9 @@ def _guest_ratelimited():
     person has more addresses - but it stops an open endpoint being an easy
     place to park data or fill a disk.
     """
-    address = (request.headers.get('X-Forwarded-For', '').split(',')[0].strip()
-               or request.remote_addr or 'unknown')
+    # Not the raw X-Forwarded-For hop: the caller sends that, so rotating it
+    # gives an unbounded budget and the limit stops being a limit.
+    address = client_ip(request) or 'unknown'
     bucket = int(_utcnow().timestamp()) // GUEST_CREATE_WINDOW_SECONDS
     key = f'securesendguest:{address}:{bucket}'
     used = cache.get(key) or 0