PHP Warning: Undefined array key "_pt"

[lumosideas]

Hi, I'm trying to use persistent_login with Roundcube 1.6 on a Debian 11 but the logs return the follow error:

PHP Warning: Undefined array key "_pt" in /usr/share/roundcube/plugins/persistent_login/persistent_login.php on line 299

[vmario89]

the fix of @navossoc does the trick. no warnings in the log anymore (a0cf0c0)

[vmario89]

since roundcube 1.7.0 the error occures again for me

[fabianbur]

We reproduced this issue with:

• Roundcube 1.7.3
• PHP 8.2
• mfreiholz/persistent_login
• AuthToken mode (ifpl_use_auth_tokens = true)
• Plugin source at commit bde7b6840c7d91de627ea14e81cf4133cbb3c07a

The warning occurs on a normal Roundcube logout when the user did not
select persistent login and therefore the _pt cookie does not exist:

PHP Warning: Undefined array key "_pt"

The cause is in logout_after().

With AuthToken mode enabled, the current code executes:

if ($this->use_auth_tokens) {
    $cookie_data = self::get_persistent_cookie();

get_persistent_cookie() then reads:

$_COOKIE[$this->cookie_name]

even when the persistent cookie does not exist.

We tested the following one-line guard:

- if ($this->use_auth_tokens) {
+ if ($this->use_auth_tokens && self::is_persistent_cookie_available()) {

This is exactly the same change already present in commit:

a0cf0c0017ff7c402167d0027da4bc0fad84178e

which references this issue.

However, the current master still contains the unguarded:

if ($this->use_auth_tokens) {

The historical fix commit a0cf0c0 is not contained in the current
master; its history diverges from the line containing bde7b68.

We performed functional regression testing before and after applying
the guard.

Results after the fix:

1. Normal login with persistent-login checkbox OFF

   • No AuthToken was created.

2. Normal logout without _pt

   • No PHP warning.
   • No persistent-login error.

3. Login with persistent login enabled

   • AuthToken was created successfully.

4. Browser completely closed and reopened

   • Automatic login succeeded.
   • The previous AuthToken was consumed.
   • A new AuthToken was issued.
   • Token rotation was confirmed.

5. Explicit logout after persistent authentication

   • The AuthToken was revoked.
   • auth_tokens returned to zero.
   • No PHP warning occurred.

So the one-line guard fixes the PHP 8 missing-cookie warning without
breaking AuthToken creation, automatic authentication, token rotation,
or logout revocation.

Could commit a0cf0c0017ff7c402167d0027da4bc0fad84178e, or the equivalent
one-line guard, please be incorporated into master and the version
distributed through the Roundcube plugin repository?