The ip address is checked for validity before checking if it's allowed. This does not make much sense to me. If it's not allowed, it doesn't matter whether it's a valid ip address or not

current code:

    // Check input against IP address schema
    if ($this->_ipValidator->setTranslator($this->getTranslator())->isValid($valueString)) {
        if (!($this->_allow & self::ALLOW_IP)) {
            $this->_error(self::IP_ADDRESS_NOT_ALLOWED);
            return false;
        } else{
            return true;
        }
    }

proposed code:

    // Check input against IP address schema
   if (!($this->_allow & self::ALLOW_IP)) {
            $this->_error(self::IP_ADDRESS_NOT_ALLOWED);
            return false;
    }

    if ($this->_ipValidator->setTranslator($this->getTranslator())->isValid($valueString)) {
            return true;
    }