Confirmed <xf:reactions> tag crashes template save when link attribute is missing

Eris Greyrat

Eris Greyrat

Well-known member
Licensed customer
Affected version
2.3.9
File: src/XF/Template/Compiler/Tag/Reactions.php

Summary:​

The <xf:reactions> template tag compiler accesses $tag->attributes['link'] at line 25 without first calling assertAttribute('link'). If a developer uses <xf:reactions> without the required link attribute, template compilation fatally crashes with a raw PHP E_WARNING that XF's error handler promotes to an ErrorException, instead of receiving a clean descriptive compiler error.

This is directly inconsistent with the sibling tag React.php, which correctly validates both required attributes upfront.

Steps to Reproduce:​

  1. Open any template in AdminCP.
  2. Add by <xf:reactions content="{$someEntity}" />, omitting the link attribute.
  3. Attempt to save the template.

Expected Behaviour:​

The template compiler catches the missing link attribute early via assertAttribute('link') and throws a clear, descriptive compiler error pointing the developer to the problem, identical to how other XF tags behave when required attributes are missing.

Actual behaviour:​

Template compilation crashes with:

Code: 
ErrorException: [E_WARNING] Undefined array key "link"
in src/XF/Template/Compiler/Tag/Reactions.php at line 25

Root cause:​

Reactions.php jumps directly to accessing the link attribute without validating that it exists first:

PHP: 
// Reactions.php, current (line 25, unsafe)
$link = $tag->attributes['link']->compile($compiler, $context, true);

Compare with React.php, which handles this correctly:

PHP: 
// React.php, correct
$tag
    ->assertAttribute('link')
    ->assertAttribute('content');

Reactions.php Also, never calls assertAttribute('content'), So both required attributes go unvalidated.

Fix:​

Add two assertAttribute calls before accessing the attributes, mirroring the pattern already used in React.php:

Before:
PHP: 
// No validation and causes crashes with E_WARNING if 'link' or 'content' are missing
$link = $tag->attributes['link']->compile($compiler, $context, true);

After:
PHP: 
// Validate required attributes first, same pattern as React.php
$tag->assertAttribute('link');
$tag->assertAttribute('content');

$link = $tag->attributes['link']->compile($compiler, $context, true);

Additional Notes:​

  • The inconsistency between Reactions.php and React.php suggests this was an oversight when the <xf:reactions> tag was introduced.
  • The fix is a two-line addition, and carries would give no risk of regression.
  • Developers using <xf:reactions> On custom content types will hit this without useful feedback, making it difficult to debug.
 
Back
Top Bottom