Upload only from whitelisted IP
Uploads (and related paths like remote URL, copy, parts, SFTP) are rejected because this account may only upload from a whitelisted IP, and the current request IP is not listed.
Why this happens
The user has one or more rows in userIpWhitelist. Enforcement is opt-in: empty list = no IP restriction. When the list is non-empty, getClientIp must match. Wrong proxy headers can make every IP look “wrong.”
Diagnose and fix
1. Ask the member for their public IP (or check the failed request’s client IP in logs).
2. Admin → Users → Whitelisted IPs (from the user edit screen) — add that IP.
3. Confirm the reverse proxy forwards the real client IP (X-Forwarded-For / trusted proxies) so whitelist checks see the right address.
4. To stop restricting them, clear their whitelist entries.