From b013fe99922d55457d9286766b43b7e54e8a9cf5 Mon Sep 17 00:00:00 2001 From: albertlast Date: Wed, 29 Jul 2026 16:35:21 +0200 Subject: [PATCH 1/2] Loads permissions before applying bans in User::enforceBans() User::$me->enforceBans() is called immediately after a successful login, at which point User::setMe() has replaced User::$me with a freshly loaded User instance whose permissions have not been loaded yet. Iterating over $this->permission_sets then fataled with "Typed property SMF\User::$permission_sets must not be accessed before initialization". Admins never hit this because enforceBans() returns early for them. Mirrors the guard that the deprecated banPermissions() compat function already has. Co-Authored-By: Claude Opus 5 --- Sources/User.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Sources/User.php b/Sources/User.php index e95ad182e8..60f7686474 100644 --- a/Sources/User.php +++ b/Sources/User.php @@ -2224,6 +2224,13 @@ public function enforceBans(bool $force_check = false, bool $post_kick = false, } // Fix up the banning permissions. + // The permissions aren't necessarily loaded yet. For example, this + // method is called immediately after logging in, at which point + // User::$me has been replaced by a freshly loaded instance. + if (!isset($this->permission_sets)) { + $this->loadPermissions(); + } + foreach ($this->permission_sets as $set) { $set->applyBansAndWarnings(); } From 569310bb1e375d88e63a7a72b9540249451ea682 Mon Sep 17 00:00:00 2001 From: Jon Stovell Date: Wed, 29 Jul 2026 15:38:30 -0600 Subject: [PATCH 2/2] Removes unnecessary comments --- Sources/User.php | 3 --- 1 file changed, 3 deletions(-) diff --git a/Sources/User.php b/Sources/User.php index 60f7686474..4d43b04211 100644 --- a/Sources/User.php +++ b/Sources/User.php @@ -2224,9 +2224,6 @@ public function enforceBans(bool $force_check = false, bool $post_kick = false, } // Fix up the banning permissions. - // The permissions aren't necessarily loaded yet. For example, this - // method is called immediately after logging in, at which point - // User::$me has been replaced by a freshly loaded instance. if (!isset($this->permission_sets)) { $this->loadPermissions(); }