IPSecurityManagerImpl has been backed by a mere HashMap (fixed IP or * -> rule) forever.

Although not a widely used feature (and trend goes further towards filtering IPs on a higher level, in front of Magnolia itself), it is quite error prone in its current incarnation.

In particular, introducing new rules or cloning from the default wildcard rule through the Admincentral should not lock the user out before filling in meaningful values.

Options:

• better defaults in Rule, in particular non-empty allowed methods, unless explicitly configured empty.
• new flag applyToAdmincentral (false by default) to be able to configure first, then apply