IP whitelist for failed-login protection does not trim spaces, so valid whitelisted IPs can still get blocked

When Block_Multiple_Failed_Logins_Ip_Whitelist contains comma-separated IPs with spaces after commas, Rocket.Chat does not trim the values before checking membership. As a result, whitelisted IPs can still be blocked by failed-login protection.

Affected file
apps/meteor/app/authentication/server/lib/restrictLoginAttempts.ts

Relevant code

const whitelist = String(settings.get('Block_Multiple_Failed_Logins_Ip_Whitelist')).split(',');

if (
	!settings.get('Block_Multiple_Failed_Logins_Enabled') ||
	!settings.get('Block_Multiple_Failed_Logins_By_Ip') ||
	whitelist.includes(ip)
) {
	return true;
}

Steps to reproduce

1. Enable Block_Multiple_Failed_Logins_Enabled.
2. Enable Block_Multiple_Failed_Logins_By_Ip.
3. Set Block_Multiple_Failed_Logins_Ip_Whitelist to something like:

   127.0.0.1, 192.168.0.10
   

4. Attempt repeated failed logins from 192.168.0.10.

Expected behavior
192.168.0.10 should be treated as whitelisted and should bypass IP-based failed-login blocking.

Actual behavior
The IP may still be blocked because the whitelist entry is stored as ' 192.168.0.10' and compared using exact string equality.

Root cause
The whitelist is split on commas but never normalized with .trim().

Suggested fix
Normalize the whitelist values before comparison, for example:

const whitelist = String(settings.get('Block_Multiple_Failed_Logins_Ip_Whitelist'))
	.split(',')
	.map((entry) => entry.trim())
	.filter(Boolean);

Impact

• Admins can think an IP is whitelisted when it is not.
• Lockout behavior becomes inconsistent and hard to diagnose.
• Common comma-and-space formatting in settings silently breaks the feature.

This one is cleaner and less likely to already be raised than the earlier candidate.

Start in apps/meteor/app/authentication/server/lib/restrictLoginAttempts.ts and review how the comma-separated IP whitelist is parsed before membership is checked. Reproduce the settings scenario with a space after a comma, then verify that the listed IP bypasses IP-based failed-login blocking.