Break-out conditional in allow_subdomain_install()

[stevegrunwell]

Attached patch expands the conditional within allow_subdomain_install()with better inline documentation, replaces the IP address regex with filter_var( $var, FILTER_VALIDATE_IP ) ([​supported in PHP 5.2.0+), and adds unit tests.

This came about while working on a refresh for #22330, trying to add missing unit tests along the way, and includes one of the regex changes from @nacin's patch.

[nacin]

We have never used filter_var() in core. Filter is enabled by default, but it can be disabled. I would estimate that this would be a minuscule number of sites, but even 0.1% is still tens of thousands of sites that would see a fatal error unexpectedly. Granted, very few would be trying to create a network, but I'd expect at least one bug report citing it upon release.

While someone is unlikely to deliberately disable ext/filter, it's actually not terribly uncommon to use the flag --disable-all and then add back what you need -- and sometimes an important one is missed.

[stevegrunwell]

Updated diff that restores the original regex for IP addresses rather than using filter_var()

[stevegrunwell]

Fair point, patch has been updated to use the current regex pattern.

As far as core never using filter_var() that's technically true, but I did find one instance in wp-includes/class-phpmailer.php (which is why I was like "okay, cool, let's use filter_var()"). I've yet to come across a system with the filters disabled, but that doesn't mean they're not out there :)

[realloc]

The patch no longer applies. allow_subdomain_install() has been rewritten since these diffs were attached, so none of the context lines match trunk anymore.

Breaks out the compound conditional in allow_subdomain_install() into three named boolean variables ($has_path, $is_localhost, $is_ip_address) so the return condition reads as a description of what's being checked rather than a single long expression, and adds unit test coverage, which the function previously had none of.

What changed

• src/wp-admin/includes/network.php: extracted the path/localhost/IP-address checks into named variables ahead of the if, with no change in behavior.
• Added tests/phpunit/tests/admin/includes/network/AllowSubdomainInstall_Test.php, covering a plain domain, a subdomain, localhost, a domain with a path, and IPv4 addresses (with and without a port).

Why
This revives a long-stale 2015 patch on the ticket (the original diff no longer applies since the function has been rewritten since). The core ask — better inline readability — still stands, and the function had zero test coverage to lock in its behavior first.

Testing

• npm run test:php -- --filter Tests_Admin_Includes_Network_AllowSubdomainInstall_Test — 6 tests, 6 assertions, OK.
• npm run test:php -- --group multisite — 38 tests, 49 assertions, OK (no regressions).
• composer lint:errors and npm run typecheck:php clean on the touched files (the one PHPStan baseline mismatch reported is pre-existing on clean trunk, unrelated to this change).

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5
Used for: Implementation, tests, and PR description. Reviewed by Igor Rozum.