Kunena 7.0.9 & Kunena 6.4.14 – Security Updates Released

The Kunena team has announce the arrival of Kunena 7.0.9 [K 7.0.9] in stable which is now available for download as a native Joomla extension for J! 5.4.x/6.0.x./6.1.x. This version addresses most of the issues that were discovered in K 6.2 / K 6.3 / K 6.4 and issues discovered during the last development stages of K 7.0

Question Deleted Joomla users cause rendering error in profileIcon('email')

More
2 days 22 hours ago #235333 by guidocx84
Hello,I have identified what appears to be a bug in Kunena 6.4.14 when a forum post belongs to a user who has subsequently been deleted from Joomla.Environment
  • Joomla: 5.4.8
  • Kunena: 6.4.14
  • PHP: 8.3
The problemSome old forum posts were causing the HTML rendering of the entire topic to break.The affected posts belong to users who no longer exist in Joomla. Their records are still present in
Code:
#__kunena_users
, while their historical posts are still present in
Code:
#__kunena_messages
.The important detail is that the problem only occurs when the topic is viewed by a Super User (or another user who is allowed to see registered users' email addresses). Normal users can view the same topic without any problem.The actual errorThe rendering error is:

Rendering Error in layout User/Profile:

Code:
Kunena\Forum\Libraries\User\KunenaUser::escape(): Argument #1 ($var) must be of type string, null given

The error points to
Code:
KunenaUser.php
, inside
Code:
profileIcon()
:
Code:
case 'email': return '[email]' . $this->email . '[/email]'; break;
For a deleted Joomla user,
Code:
$this->email
is
Code:
NULL
.Therefore:
Code:
$this->escape($this->email)
causes a PHP
Code:
TypeError
, because
Code:
escape()
requires a string:
Code:
public function escape(string $var): string { return htmlspecialchars($var, ENT_COMPAT, 'UTF-8'); }
The PHP error interrupts the rendering of the profile layout. As a consequence, the surrounding HTML is not completed correctly, and all subsequent posts can appear to be nested inside the affected post's
Code:
div.row.message
.This initially looked like a template/layout problem, but it is actually a consequence of the PHP rendering error.Temporary workaroundI tested the following change in
Code:
KunenaUser.php
:
Code:
case 'email': if (!$this->email) { return false; } return '<a href="mailto:' . $this->email . '" data-bs-toggle="tooltip" data-placement="right" title="' . $this->escape($this->email) . '">' . KunenaIcons::email() . '</a>'; break;

After this change, the affected topics render correctly again.The deleted user's post remains visible, but the email icon is simply omitted, which seems appropriate because the Joomla user and therefore the email address no longer exist.QuestionCould this be addressed in Kunena 6.4.x itself?It seems that
Code:
profileIcon('email')
should handle a
Code:
NULL
email when a Kunena user record remains after the corresponding Joomla user has been deleted.I would also appreciate advice on the recommended way to implement this as an override or extension, rather than modifying
Code:
libraries/kunena/src/User/KunenaUser.php
directly, since a core modification would presumably be overwritten by a future Kunena update.Thank you!

Please Log in or Create an account to join the conversation.

More
2 days 22 hours ago #235334 by Pinkeltje
This has been fixed in Kunena 7. Kunena 6 only receives security updates so you should update to Kunena 7.

Please Log in or Create an account to join the conversation.

More
2 days 22 hours ago #235335 by guidocx84

This has been fixed in Kunena 7. Kunena 6 only receives security updates so you should update to Kunena 7.
I'm not planning to update Kunena soon, so I would also appreciate advice on the recommended way to implement this as an override or extension, rather than modifying the impacted file directly, since a core modification would presumably be overwritten by a future Kunena 6.4.x security update. Thank you!

Please Log in or Create an account to join the conversation.

Time to create page: 0.249 seconds