The end user’s ip is hidden in the onion network. The server will get the ip address of the “last node” your client routed it’s request through (and that node only has the ip address of the previous node, etc).
However, the clients ip can be leaked if a server creates some Javascript which makes an Ajax call (basically, an additional http request). A malicious Ajax call will not go through the onion network and thus expose the clients real ip. Hence, it’s recommended to disable Javascript and other features while using tor.