HTTP_X_FORWARDED_FOR ignored if REMOTE_ADDR is "trusted"

if i understand correctly, the problem occurs in the remote_ip method of the Request class (actionpack/lib/action_dispatch/http/request.rb).
The fact that the proxies' address is not a local network address (as determined by TRUSTED_PROXIES), but a public one, adds it to the HTTP_X_FORWARDED_FOR, and so this becomes the returned remote ip address - which makes the latter pretty useless.
I'm going to have a look at a possible solution.

Here, it's the patch with the test.

Finally, I addeed the ActionController::Base.local_trusted_proxies config option that can be set with a regex to match the TRUSTED_PROXIES with a public ip.

verified

+1 This patch applies cleanly to 2-3-stable. All tests pass.

Oks, here the version prepared for master.

verified

+1 The second patch applies cleanly to master and tests also pass. Good work!