Current Behavior

If allow_admin contains 127.0.0.0/24, requests from other ips without the admin key are allowed by default.

Expected Behavior

Only requests from 127.0.0.0/24 without adminKey are allowed. Otherwise, they should be banned if the admin key isn't configured in config.yaml.

Error Logs

No response

Steps to Reproduce

1. use the config below:

deployment:
  admin:
    allow_admin:
      - 0.0.0.0/0
      - 127.0.0.0/24
    admin_key:
      # empty

2. Requests from other ips without adminKey are allowed.

Environment

• APISIX version (run apisix version): 3.2.0
• Operating system (run uname -a): Ubuntu 18.04
• OpenResty / Nginx version (run openresty -V or nginx -V):
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):