When using a VPN in conjunction with the Cloudflare service using the X-Forwarded-For header to get the user's IP, there are multiple IP addresses returned.
This is documented here: https://support.cloudflare.com/hc/en-us/articles/200170986-How-does-Clou...
In this scenario, the CheckIpRestriction function returns an invalid result when the user's IP is in the form:
0.0.0.1, 0.0.0.2 etc.
The IP addresses should be extracted from this string and tested separately.
Active
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
This approach would completely open the module up for header spoofing attacks.
If you want to test the IP address *behind* a VPN, ensure you add the VPN IP address(es) to $settings['reverse_proxy_addresses'] in your settings.php.