PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar Shauryan0207
Shauryan0207
20 Dec 2025

Summary of Changes

Added a check for the $user object in ActionLogPlugin to prevent PHP warnings when getIdentity() returns null.

Testing Instructions

Since reproducing a scenario where getIdentity() returns null via the UI is difficult please use the following script to verify the fix:
Create a test file test_actionlog_null.php

<?php
// Simulate scenario where getIdentity() returns null (guest user or logout scenario)
$user = null;

echo "TEST 1: Before fix (shows PHP warning)\n";
echo "Attempting to access \$user->id when \$user is null:\n";
try {
    $id = $user->id; // Old code behavior
    echo "User ID: " . $id . "\n";
} catch (\Error $e) {
    echo "❌ PHP Warning: " . $e->getMessage() . "\n\n";
}

echo "TEST 2: After fix (no warning)\n";
echo "Using null-safe operator:\n";
$id = $user?->id; // Fixed code behavior
$username = $user?->username ?? '';
echo "User ID: " . ($id ?? 'null') . "\n";
echo "Username: " . ($username ?: 'empty') . "\n";
echo "✅ No warnings - fix works correctly\n";

php test_actionlog_null.php

Expected output:
TEST 1 shows a PHP error when accessing properties on null
TEST 2 shows no warnings and handles null safely

Actual result BEFORE applying this Pull Request

PHP warnings when ActionLog runs without authenticated user.

Expected result AFTER applying this Pull Request

No PHP warnings; gracefully handles null user.

Link to documentations

  • No documentation changes for docs.joomla.org needed
  • No documentation changes for manual.joomla.org needed
avatar Shauryan0207 Shauryan0207 - open - 20 Dec 2025
avatar Shauryan0207 Shauryan0207 - change - 20 Dec 2025
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 20 Dec 2025
Category Administration
avatar richard67
richard67 - comment - 21 Dec 2025

Testing Instructions

Code review - verify null-safe operators (?-> and ??) are used for user property access.

@Shauryan0207 I'd prefer to have instructions for a real test, not just code review.

Providing reproducible test instructions would also show that you have tested the changes from your PR yourself before submitting it, which is a mandatory requirement for contributing here.

Could you provide instructions? Thanks in advance.

avatar exlemor
exlemor - comment - 21 Dec 2025

@Shauryan0207 - I am trying to test your PR and I read the Testing Instructions of "PHP warnings when ActionLog runs without authenticated user" but I must admit not understanding what you meant as I can't think of anything that triggers an ActionLog without a user being authenticated (but that could just be ME not thinking through all of the cases)...

I could imagine maybe this happening if a Session timeout happened during an action, but that's not so easy to trigger.

Looking forward to specific use case that I can test for you.

avatar Shauryan0207
Shauryan0207 - comment - 23 Dec 2025

Hey @richard67
Create a test file test_actionlog_null.php

<?php
// Simulate scenario where getIdentity() returns null (guest user or logout scenario)
$user = null;

echo "TEST 1: Before fix (shows PHP warning)\n";
echo "Attempting to access \$user->id when \$user is null:\n";
try {
    $id = $user->id; // Old code behavior
    echo "User ID: " . $id . "\n";
} catch (\Error $e) {
    echo "❌ PHP Warning: " . $e->getMessage() . "\n\n";
}

echo "TEST 2: After fix (no warning)\n";
echo "Using null-safe operator:\n";
$id = $user?->id; // Fixed code behavior
$username = $user?->username ?? '';
echo "User ID: " . ($id ?? 'null') . "\n";
echo "Username: " . ($username ?: 'empty') . "\n";
echo "✅ No warnings - fix works correctly\n";

php test_actionlog_null.php

Expected output:
TEST 1 shows a PHP error when accessing properties on null
TEST 2 shows no warnings and handles null safely

avatar Shauryan0207
Shauryan0207 - comment - 23 Dec 2025

Hey @exlemor ,Thanks for reviewing this while it’s rare, this can happen during things like command-line scripts, scheduled tasks, system maintenance, or guest API requests, where actions are logged even though no user is logged in.

avatar Shauryan0207 Shauryan0207 - change - 23 Dec 2025
Labels Added: PR-5.4-dev
avatar joomla-cms-bot joomla-cms-bot - change - 23 Dec 2025
Category Administration Administration Modules Front End
avatar joomla-cms-bot joomla-cms-bot - change - 23 Dec 2025
Category Administration Modules Front End Administration
avatar Fedik Fedik - test_item - 23 Dec 2025 - Tested successfully
avatar Fedik
Fedik - comment - 23 Dec 2025

I have tested this item ✅ successfully on 998963d

Review


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46599.

avatar richard67
richard67 - comment - 23 Dec 2025

@Shauryan0207 Could you adjust the testing instructions in the description (initial post) of this PR to the latest code changes? Thanks in advance.

avatar Shauryan0207 Shauryan0207 - change - 23 Dec 2025
The description was changed
avatar Shauryan0207 Shauryan0207 - edited - 23 Dec 2025
avatar Shauryan0207
Shauryan0207 - comment - 23 Dec 2025

@Shauryan0207 Could you adjust the testing instructions in the description (initial post) of this PR to the latest code changes? Thanks in advance.

@richard67 Done ! Thanks

avatar exlemor
exlemor - comment - 24 Dec 2025

@Shauryan0207 I'm probably doing something incorrectly but I'm not matching the BEFORE condition of a PHP error.

I created the php file: test_actionlog_null.php in the root of the sub-folder where Joomla 5.4 is installed, /_j540/
I connected to an SSH terminal and ran from the /_j540/ root, php test_actionlog_null.php and received this result:

TEST 1: Before fix (shows PHP warning)
Attempting to access $user->id when $user is null:
User ID: 
TEST 2: After fix (no warning)
Using null-safe operator:
User ID: null
Username: empty
✅ No warnings - fix works correctly

What did I screw up? ;(

avatar ceford
ceford - comment - 5 Jan 2026

I looked at this PR and I am not happy with it. The quoted test would just show the desired behaviour. It does not test Joomla. Various CLI commands such as php cli/joomla.php site:up don't trigger the plugin. It seems to me it may be better to see the PHP warning so that the site owner can see that something unusual is going on. Can you provide any sort of screenshot showing the warning?


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46599.

Add a Comment

Login with GitHub to post a comment