ASIS CTF 2017, Tar Bomb Challenge

readflag.php

<?php
header('Access-Control-Allow-Origin: *');

$remote = $_SERVER['REMOTE_ADDR'];
if ($remote === '127.0.0.1' || $remote === '::1') {
  $flag = fopen("/flag", "r") or die("Unable to open file!");
  echo fread($flag,filesize("/flag"));
  fclose($flag);
} else {
  echo 'what do you expect to see here?';
}
?>