Admin lockout bypass via spoofed forwarding headers

IP spoofing in LikeShop 2.5.7.20210811 and earlier allows remote attackers to bypass admin account lockouts via crafted HTTP headers. The request IP-resolution logic trusts attacker-supplied X-Forwarded or Client-IP values as the client address without validating a trusted proxy. No authentication is required to alter the recorded source address, enabling repeated admin login attempts and impersonation of previously recorded client IPs.