Merge pull request #46 from noplanman/45-webhook_ip_ranges

Use the new Telegram API webhook IP ranges.

Author: noplanman

CHANGELOG.md

@@ -6,6 +6,7 @@ Exclamation symbols (:exclamation:) note something of importance e.g. breaking c
 ## [Unreleased]
 ### Added
 ### Changed
+- Use the new Telegram API webhook IP ranges.
 ### Deprecated
 ### Removed
 ### Fixed

src/BotManager.php

@@ -21,9 +21,10 @@
 class BotManager
 {
     /**
-     * @var string Telegram post servers IP range
+     * @var array Telegram webhook servers IP ranges
+     * @link https://core.telegram.org/bots/webhooks#the-short-version
      */
-    const TELEGRAM_IP_RANGE = '149.154.167.197-149.154.167.233';
+    public const TELEGRAM_IP_RANGES = ['149.154.160.0/20', '91.108.4.0/22'];
 
     /**
      * @var string The output for testing, instead of echoing
@@ -578,7 +579,7 @@ public function isValidRequest(): bool
         }
 
         return Ip::match($ip, array_merge(
-            [self::TELEGRAM_IP_RANGE],
+            self::TELEGRAM_IP_RANGES,
             (array) $this->params->getBotParam('valid_ips', [])
         ));
     }

tests/BotManagerTest.php

@@ -431,19 +431,23 @@ public function testIsValidRequestValidate()
         unset($_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['HTTP_CLIENT_IP'], $_SERVER['REMOTE_ADDR']);
 
         // Lower range.
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.196';
+        $_SERVER['REMOTE_ADDR'] = '149.154.159.255';
         self::assertFalse($botManager->isValidRequest());
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.197';
+        $_SERVER['REMOTE_ADDR'] = '149.154.160.0';
         self::assertTrue($botManager->isValidRequest());
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.198';
+        $_SERVER['REMOTE_ADDR'] = '91.108.3.255';
+        self::assertFalse($botManager->isValidRequest());
+        $_SERVER['REMOTE_ADDR'] = '91.108.4.0';
         self::assertTrue($botManager->isValidRequest());
 
         // Upper range.
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.232';
+        $_SERVER['REMOTE_ADDR'] = '149.154.175.255';
         self::assertTrue($botManager->isValidRequest());
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.233';
+        $_SERVER['REMOTE_ADDR'] = '149.154.176.0';
+        self::assertFalse($botManager->isValidRequest());
+        $_SERVER['REMOTE_ADDR'] = '91.108.7.255';
         self::assertTrue($botManager->isValidRequest());
-        $_SERVER['REMOTE_ADDR'] = '149.154.167.234';
+        $_SERVER['REMOTE_ADDR'] = '91.108.8.0';
         self::assertFalse($botManager->isValidRequest());
     }