Pull Request resolves #

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

onUserAuthenticate() of the authentication cookie plugin validates the structure of the remember me cookie before touching it: a cookie that does not consist of exactly a token and a series part is destroyed and authentication is refused.

onUserAfterLogin() and onUserAfterLogout() read the same cookie but never perform that check. They call explode() on the raw cookie value and immediately access index 1, so a cookie without a separator (or an absent cookie in the login flow) leads to an undefined array key warning and a series value derived from unrelated data. The login handler then continues to refresh what it believes is an existing series, and the logout handler runs a delete query with a meaningless series.

This PR applies the same structural check to both remaining handlers:

• In onUserAfterLogin() a malformed cookie is destroyed in the browser and no database record is touched, mirroring the behaviour of onUserAuthenticate().
• In onUserAfterLogout() the database removal only runs when a well formed series is present. The browser cookie is destroyed either way, so the cleanup result for the user does not change.

The explode() calls now also cast the cookie value to string, which guards against the deprecated passing of null if the cookie is absent.

Testing Instructions

1. Log into the frontend with the remember me checkbox enabled and confirm the joomla_remember_me_* cookie is set.
2. Edit the cookie in the browser storage so its value has no dot separator, for example malformedvalue.
3. Reload the page. The session is still valid from the PHP session cookie, so you stay logged in.
4. Log out.

Actual result BEFORE applying this Pull Request: step 4 logs an Undefined array key 1 warning (visible with error reporting at maximum) and issues a database delete for an empty or garbage series.

Expected result AFTER applying this Pull Request: step 4 runs without a warning, no delete query runs for the malformed series, and the browser cookie is still removed.

The same observation can be made at step 2 to 3 for the login refresh path by removing the cookie value and completing a fresh login with remember me checked.

Link to documentations

• No documentation changes for manual.joomla.org needed
• No documentation changes for guide.joomla.org needed