Summary

Exclude rules with an IP address filter (and all other fields set to Any) silently no-op'd when the stored rule value had whitespace around commas or was shaped as an array. Log::record_matches_rules() only split the value with explode( ',', ... ) and used a strict in_array against it, so "127.0.0.1, 8.8.8.8" never matched a real 8.8.8.8 and the record was still written.

Fixes #1824

Changes

classes/class-log.php

Before:

if ( 'ip_address' === $exclude_key ) {
    $ip_addresses = explode( ',', $exclude_value );

    if ( in_array( $record['ip_address'], $ip_addresses, true ) ) {
        ++$matches_found;
    }
}

After:

if ( 'ip_address' === $exclude_key ) {
    // Stored value shape varies: the admin form posts one
    // comma-joined string per row, while a direct API or test
    // caller can hand us an array of IPs. Normalize first, then
    // trim and drop empties so a stored "1.1.1.1, 8.8.8.8" or
    // ["1.1.1.1", " 8.8.8.8"] both match a real client IP.
    $ip_addresses = is_array( $exclude_value )
        ? $exclude_value
        : explode( ',', (string) $exclude_value );

    $ip_addresses = array_filter(
        array_map( 'trim', $ip_addresses ),
        function ( $value ) {
            return '' !== $value;
        }
    );

    if ( ! empty( $record['ip_address'] ) && in_array( $record['ip_address'], $ip_addresses, true ) ) {
        ++$matches_found;
    }
}

Why: the admin Exclude form joins multi-IP values with a comma (src/js/admin-exclude.js), so the stored value is a single string. Without trimming, "127.0.0.1, 8.8.8.8" becomes ['127.0.0.1', ' 8.8.8.8'] after explode and the strict in_array never matches. A direct API or test caller can also hand us an array, and explode( ',', array ) raises a TypeError on PHP 8+.

Repro before the fix

$log->record_matches_rules(
    array( 'ip_address' => '8.8.8.8' ),
    array( 'ip_address' => '127.0.0.1, 8.8.8.8' )
);
// false (expected: true)

Testing

Test 1: IP-only exclude rule excludes a record

1. In wp-admin, open Stream -> Settings -> Exclude.
2. Add a rule: leave Author or Role, Context, and Action as Any. Set IP Address to 127.0.0.1. Save.
3. Visit wp-admin/profile.php and click Update Profile.
4. Open Stream -> Records.
   Result: no new "Profile updated" record is present (with the fix).

Test 2: multi-IP rule with whitespace

1. Same as Test 1, but set IP Address to 127.0.0.1, 8.8.8.8 (with or without space after the comma).
2. Make a request from 8.8.8.8.
   Result: the request is excluded.

Automated tests run:

• composer test-one -- --filter='Test_Log::test_ip_only_exclude_rule_excludes_record' (single + multisite, green)
• composer test-one -- --filter='Test_Log::test_ip_address_rule_matches_with_whitespace' (green)
• composer lint-php and composer lint-tests (green)
• CodeRabbit review: 0 findings.