From ce8c1393a956598859e79624b006d4d1c5119397 Mon Sep 17 00:00:00 2001 From: Johan Cwiklinski Date: Mon, 31 Aug 2026 10:57:28 +0200 Subject: [PATCH] Read the webhook caller address the way the instance is configured The webhook checks that a notification comes from HelloAsso by comparing the caller address to a known one. It asked History for that address without handing over the preferences, so the X-Forwarded-For lookup was skipped: an instance behind a reverse proxy compared its own proxy address to HelloAsso's and answered 403, dropping the payment. Galette 1.3 moved that setting out of behavior.inc.php into pref_x_forwarded_for_index, which findUserIPAddress() now expects to be given. The controller has the preferences injected, so it passes them. --- lib/GaletteHelloasso/Controllers/HelloassoController.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/GaletteHelloasso/Controllers/HelloassoController.php b/lib/GaletteHelloasso/Controllers/HelloassoController.php index c261ca6..8703b85 100644 --- a/lib/GaletteHelloasso/Controllers/HelloassoController.php +++ b/lib/GaletteHelloasso/Controllers/HelloassoController.php @@ -366,7 +366,9 @@ public function webhook(Request $request, Response $response): Response // Verify notification authenticity // https://dev.helloasso.com/docs/secure-webhook $legit_ip_address = $helloasso->getTestMode() ? '4.233.135.234' : '51.138.206.200'; - $notification_ip_address = History::findUserIPAddress(); + //the preferences say how many proxies sit in front, if any; without + //them an instance behind one would see its proxy address here + $notification_ip_address = History::findUserIPAddress($this->preferences); if ($notification_ip_address != $legit_ip_address) { Analog::log( 'Unauthorized Helloasso notification detected!',