UserSpice Bugs

ID	Project	Category	Submitted / Last Updated
02324	UserSpice	ACP Code	2026-04-12 09:20:09 / 2026-04-12 09:23:29
Reported	Dan Hoover	Resolved By	Dan Hoover
Priority	none	Reported	6.0.7
Status	resolved fixed	Resolution Version and Commit	6.0.8
Summary	Remove dead code, add hints for semgrep/zap/phpstan/trivy
Description

6 hours ago

PasskeyHandler.php Collapsed identical if/else branches in base64urlEncode(), simplified isset() + !== null + !== '' to just !== ''. TOTPHandler.php Removed redundant $this->db->error() check after !$result. If update() fails it already returns falsy. UserSpicePasskeyCredentialRepository.php Removed implements PublicKeyCredentialSourceRepository. The interface does not exist in the installed webauthn-lib v5.2.4; the class functions via duck-typing. Cookie.php Removed unreachable return false; after an if/else where both branches return true;. DB.php Cast lastInsertId() to (int) and utilized ?? null coalescing. Input.php Removed unreachable break; after return. Menu.php:138-148 Constructor no longer attempts to return a value. Menu.php:157 Changed strtolower(substr(...) != "http:") to strtolower(substr(...)) != "http:" to fix operator precedence. helpers.php Type casts for log() and usleep(), and cleaner $no_language_purge initialization. permissions.php:370-374 Removed if (empty($pageDetails)) return true; as $pageDetails is guaranteed to be populated by preceding logic. permissions.php:510 Removed always-true if ($access == 0) wrapper. us_helpers.php:683 Simplified requestCheck(); $_GET and $_POST are always defined as arrays by PHP. us_helpers.php:1181 Changed strstr($h, '/', 'before_needle') to the canonical strstr($h, '/', true). menus.php:200 Removed $newPerms == "" check as $newPerms is always at least "[]". users.php Removed unreachable return false; and return $users; at the end of if-blocks. loader.php:53 Simplified else branch; the outer condition guarantees isUserLoggedIn() is true. verify.php:154 Fixed Config::get('homepage') fallback using ?: instead of ||. _verify_success.php:24 Fixed bare string expression $abs_us_root . $us_url_root . '...' by implementing require_once with a file_exists() check. mS5VtQCZjyJs.php:50 Changed $errors[]=$errorString to $errors[]=$error to reference the correct defined variable. _admin_security_dashboard.php Extracted EXTRA_CURL_SECURITY and USERSPICE_ACTIVE_LOGGING into variables; totp_init_encryption now uses try/catch. CURL Security Changes Converted 0/1 to true/false for boolean curl options and extracted constant() calls across multiple files. totp_enforcement.php Removed redundant $login_method_requires_totp check. class.treeManager.php:256 Changed || to && in bounds check: $i >= 0 && $i < count($brothers). _admin_user.php:385 Added $userProtectedStatus to capture the value before update for the logger.

View Issue Detail