8000 OAuth provider handling fix by eldadfux · Pull Request #11378 · appwrite/appwrite · GitHub
[go: up one dir, main page]

Skip to content

OAuth provider handling fix#11378

Merged
eldadfux merged 1 commit into1.8.xfrom
fix-missing-email-warning
Feb 24, 2026
Merged

OAuth provider handling fix#11378
eldadfux merged 1 commit into1.8.xfrom
fix-missing-email-warning

Conversation

@eldadfux
Copy link
Member

Fix for production error:

Warning: Trying to access array offset on null in /usr/src/code/vendor/appwrite/server-ce/app/controllers/api/account.php on line 906

This pull request improves the robustness of OAuth provider handling in the sendSessionAlert function within app/controllers/api/account.php. The main focus is to prevent errors when the configuration for OAuth providers is missing or incomplete, ensuring the code handles these cases gracefully.

Error handling and robustness improvements for OAuth provider configuration:

  • Changed retrieval of oAuthProviders from Config::getParam('oAuthProviders') to use the null coalescing operator (?? []), ensuring it defaults to an empty array if not set. [1] [2] [3] [4]
  • Modified access to the provider class name to use ['class'] ?? null, preventing undefined index errors if the provider or class is missing. [1] [2] [3] [4]
  • Updated logic to check for provider and class existence before attempting to use them, throwing appropriate exceptions if unsupported or disabled. [1] [2] [3] [4]
  • Ensured all retrievals of oAuthProviders for further processing also use the null coalescing operator for consistency and safety.

Updated the handling of OAuth provider configurations to ensure that defaults are set when parameters are missing. This change improves error handling by checking for null values and ensuring class existence before proceeding with OAuth operations.
@coderabbitai
Cop 8000 y link
Contributor
coderabbitai bot commented Feb 22, 2026
📝 Walkthrough

Walkthrough

The change refactors OAuth2 provider lookups in the account controller to be more defensive against missing or misconfigured provider entries. It introduces null-coalescing operators to load providers with default empty arrays and derives class names with null defaults. Provider-dependent code branches now include explicit checks for non-empty providers and non-null class names before instantiating OAuth2 classes. These defensive patterns are applied symmetrically across multiple blocks handling provider-enabled flows, token refresh, and callback paths. The modification prevents PHP notices and undefined index errors by safely handling missing provider configurations and throwing PROJECT_PROVIDER_UNSUPPORTED exceptions appropriately.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title 'OAuth provider handling fix' directly references the main change in the PR, which focuses on improving robustness of OAuth provider handling to prevent configuration-related errors.
Description check ✅ Passed The description is fully related to the changeset, providing specific details about fixing OAuth provider handling, including the production error, the changes made, and the intent behind them.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix-missing-email-warning

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link

Security Scan Results for PR

Docker Image Scan Results

Package Version Vulnerability Severity
libecpg 18.1-r0 CVE-2026-2004 HIGH
libecpg 18.1-r0 CVE-2026-2005 HIGH
libecpg 18.1-r0 CVE-2026-2006 HIGH
libecpg 18.1-r0 CVE-2026-2007 HIGH
libecpg-dev 18.1-r0 CVE-2026-2004 HIGH
libecpg-dev 18.1-r0 CVE-2026-2005 HIGH
libecpg-dev 18.1-r0 CVE-2026-2006 HIGH
libecpg-dev 18.1-r0 CVE-2026-2007 HIGH
libpq 18.1-r0 CVE-2026-2004 HIGH
libpq 18.1-r0 CVE-2026-2005 HIGH
libpq 18.1-r0 CVE-2026-2006 HIGH
libpq 18.1-r0 CVE-2026-2007 HIGH
libpq-dev 18.1-r0 CVE-2026-2004 HIGH
libpq-dev 18.1-r0 CVE-2026-2005 HIGH
libpq-dev 18.1-r0 CVE-2026-2006 HIGH
libpq-dev 18.1-r0 CVE-2026-2007 HIGH
postgresql18-dev 18.1-r0 CVE-2026-2004 HIGH
postgresql18-dev 18.1-r0 CVE-2026-2005 HIGH
postgresql18-dev 18.1-r0 CVE-2026-2006 HIGH
postgresql18-dev 18.1-r0 CVE-2026-2007 HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

Copy link
Contributor
@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
app/controllers/api/account.php (2)

1494-1501: Redundant Config::getParam('oAuthProviders') fetch on Line 1500.

Line 1494 already stores the result in $oAuthProviders. Line 1500 fetches the same config again into $providers just to read the provider name. Reuse the existing variable instead.

♻️ Suggested fix
-        $providers = Config::getParam('oAuthProviders') ?? [];
-        $providerName = $providers[$provider]['name'] ?? '';
+        $providerName = $oAuthProviders[$provider]['name'] ?? '';
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@app/controllers/api/account.php` around lines 1494 - 1501, The code
redundantly calls Config::getParam('oAuthProviders') twice; reuse the existing
$oAuthProviders variable instead of fetching it again into $providers. Replace
the second fetch that populates $providers and then reads $providerName with a
direct lookup into $oAuthProviders (i.e., derive $providerName from
$oAuthProviders[$provider]['name'] ?? '') and remove the unused $providers
variable; keep the existing className check logic intact.

905-911: Defensive null-safe pattern looks good, but the condition on Line 911 is fully redundant after Line 907.

After the guard on Line 907, if execution continues and $provider is non-empty, $className is guaranteed to be non-null and class_exists is guaranteed true (otherwise the exception would have been thrown). The check on Line 911 can be simplified to if (!empty($provider)).

Not a correctness issue—just unnecessary verbosity.

♻️ Optional simplification
-        if (!empty($provider) && $className !== null && \class_exists($className)) {
+        if (!empty($provider)) {
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@app/controllers/api/account.php` around lines 905 - 911, The condition after
the guard is redundant: after the check that throws
Exception::PROJECT_PROVIDER_UNSUPPORTED when $provider is non-empty and
($className === null || !\class_exists($className)), any later branch that runs
with a non-empty $provider can assume $className is non-null and class_exists
returned true; update the second if (the one referencing $provider and
$className) to simply check if (!empty($provider)) to remove the redundant
$className and \class_exists checks and keep intent clear for
$oAuthProviders/$provider handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@app/controllers/api/account.php`:
- Around line 1494-1501: The code redundantly calls
Config::getParam('oAuthProviders') twice; reuse the existing $oAuthProviders
variable instead of fetching it again into $providers. Replace the second fetch
that populates $providers and then reads $providerName with a direct lookup into
$oAuthProviders (i.e., derive $providerName from
$oAuthProviders[$provider]['name'] ?? '') and remove the unused $providers
variable; keep the existing className check logic intact.
- Around line 905-911: The condition after the guard is redundant: after the
check that throws Exception::PROJECT_PROVIDER_UNSUPPORTED when $provider is
non-empty and ($className === null || !\class_exists($className)), any later
branch that runs with a non-empty $provider can assume $className is non-null
and class_exists returned true; update the second if (the one referencing
$provider and $className) to simply check if (!empty($provider)) to remove the
redundant $className and \class_exists checks and keep intent clear for
$oAuthProviders/$provider handling.

@github-actions
Copy link

✨ Benchmark results

  • Requests per second: 1,994
  • Requests with 200 status code: 358,915
  • P99 latency: 0.078211908

⚡ Benchmark Comparison

Metric This PR Latest version
RPS 1,994 1,210
200 358,915 217,905
P99 0.078211908 0.169135763

@eldadfux eldadfux merged commit ac0aa81 into 1.8.x Feb 24, 2026
117 of 118 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0