From 151798c4312a9fc9d27a291516fc40231f8479d8 Mon Sep 17 00:00:00 2001 From: albertlast Date: Mon, 10 Aug 2026 06:51:48 +0200 Subject: [PATCH] Answers an activation link that names nobody loadMember() assigns $this->member only when it finds someone, and the line after it reads $this->member->is_activated regardless, so an activation link for a member id that no longer exists is a 500 rather than a page. execute() already handles this: if the member is not set it shows the form that asks for a username and an activation code, which is what 2.1 did. It never gets the chance, because the constructor has already thrown. Co-Authored-By: Claude Opus 5 Signed-off-by: albertlast --- Sources/Actions/Activate.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Sources/Actions/Activate.php b/Sources/Actions/Activate.php index 2cac080847..3d5479f02d 100644 --- a/Sources/Actions/Activate.php +++ b/Sources/Actions/Activate.php @@ -251,6 +251,13 @@ protected function __construct() // Load the member. $this->loadMember(); + // Nobody by that name or id. execute() shows the form that asks for + // one, but only if it gets that far: the check below reads $this->member + // first, and loadMember() leaves it unassigned when it finds nothing. + if (!isset($this->member)) { + return; + } + // Already activated, so redirect to the login screen. if (!\in_array((int) $this->member->is_activated, [User::NOT_ACTIVATED, User::UNVALIDATED])) { Utils::redirectexit('action=login');