Fixes BR#9269. Now it actually validates if output of get_real_ip() is actual IP address. Added another validation to login.php. Thanks to blokaas for reporting this.
Changelog...