dont ratelimit tor users

lib/bot_protection.php

@@ -9,12 +9,23 @@ class bot_protection{
 			// ratelimit requests per IP
 			if(config::RATELIMIT_IP_SOURCE === false){
 				
-				$source = "r" . $_SERVER["REMOTE_ADDR"];
+				$source = $_SERVER["REMOTE_ADDR"];
 			}else{
 				
-				$source = "r" . $_SERVER[explode(";", strtoupper(str_replace("-", "_", config::IP_SOURCE)))[0]];
+				$source = $_SERVER[explode(";", strtoupper(str_replace("-", "_", config::IP_SOURCE)))[0]];
 			}
 			
+			// check if its not a local IP. Probably local tor bridge, dont ratelimit
+			if(
+				filter_var(
+					$source, 
+					FILTER_VALIDATE_IP, 
+					FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
+				) !== false
+			){
+				
+				$source = "r." . $source;
+				
 				// counter
 				// resets on every req	
 				$counter = apcu_fetch($source);
@@ -78,6 +89,7 @@ class bot_protection{
 					die();
 				}
 			}
+		}
 				
 		// check if we want captcha
 		if(config::BOT_PROTECTION !== 1){