codeigniter4 / codeigniter4/shield

Bug: Assigning null to ?array $identities property without proper handling

Open
#1,302 4 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
PHP
Stars
426
Forks
143
Avg merge
9h 19m
Merged PRs (30d)
6

Description

### PHP Version

8.2.7

### CodeIgniter4 Version

4.6.3

### Shield Version

1.2.0

### Which operating systems have you tested for this bug?

Windows

### Which server did you use?

cli-server (PHP built-in webserver)

### Database

mysqlite(memory unittest)

### Did you customize Shield?

yes:

```php
class User extends \CodeIgniter\Shield\Entities\User
.
.
.
public function saveUsernameIdentity(): bool
{
if (empty($this->username) && empty($this->password) && empty($this->password_hash)) {
return true;
}

/** @var UserIdentityModel $identityModel */
$identityModel = model(UserIdentityModel::class);

$identity = $this->getIdentity('username_password');
if ($identity === null && !empty($this->username)) {
$this->identities = null;

$this->createUsernameIdentity( [
'username' => $this->username,
'password' => '',
]);

$identity = $this->getUsernameIdentity();
}

if ($identity !== null) {
if (!empty($this->username)) {
$identity->secret = $this->username;
}

if (!empty($this->password)) {
$identity->secret2 = service('passwords')->hash($this->password);
}

if (!empty($this->password_hash) && empty($this->password)) {
$identity->secret2 = $this->password_hash;
}

try {
$identityModel->save($identity);
} catch (\CodeIgniter\Database\Exceptions\DataException $e) {
$messages = [
lang('Database.emptyDataset', ['insert']),
lang('Database.emptyDataset', ['update']),
];
if (in_array($e->getMessage(), $messages, true)) {
return true;
}

throw $e;
}
}

return true;
}
```

### What happened?

the `$identities` property is correctly declared as nullable array:
https://github.com/codeigniter4/shield/blob/d07c0f9442dd0712b3fa39bfba677838ff1b8e26/src/Entities/User.php#L50

However, in several places, we directly assign null like these:

https://github.com/codeigniter4/shield/blob/d07c0f9442dd0712b3fa39bfba677838ff1b8e26/src/Entities/User.php#L130

https://github.com/codeigniter4/shield/blob/d07c0f9442dd0712b3fa39bfba677838ff1b8e26/src/Entities/User.php#L149

TypeError: CodeIgniter\Shield\Entities\User::setIdentities(): Argument 1 ($identities) must be of type array, null given,

### Steps to Reproduce

try to reload all identities

### Expected Output

reload identities without error

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in src/Entities/User.php, especially the nullable $identities declaration near line 50 and the assignments around lines 130 and 149. Reproduce the issue by reloading all identities, then inspect the setter path that raises the TypeError. Done means identities reload without the null-related error.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.