controller/login.php
In rare cases, it gave the error "Undefined index: b_enabled"

325-344 old code :


        if($user['b_enabled'] == 1) {
          if(Params::getParam('new_password', false, false)==Params::getParam('new_password2', false, false)) {
            User::newInstance()->update(
              array(
                's_pass_code' => osc_genRandomPassword(50)
                ,'s_pass_date' => date('Y-m-d H:i:s', 0)
                ,'s_pass_ip' => osc_get_ip() //Params::getServerParam('REMOTE_ADDR')
                ,'s_password' => osc_hash_password(Params::getParam('new_password', false, false))
             ),
              array('pk_i_id' => $user['pk_i_id'])
           );
            osc_add_flash_ok_message(_m('The password has been changed'));
            $this->redirectTo(osc_user_login_url());
          } else {
            osc_add_flash_error_message(_m("Error, the password don't match"));
            $this->redirectTo(osc_forgot_user_password_confirm_url(Params::getParam('userId'), Params::getParam('code')));
          }
        } else {
          osc_add_flash_error_message(_m('Sorry, the link is not valid'));
        }



new code :

if (isset($user['b_enabled']) && $user['b_enabled'] == 1) { // b_enabled kontrolü
$newPassword = Params::getParam('new_password', false, false);
$newPassword2 = Params::getParam('new_password2', false, false);

if ($newPassword == $newPassword2) { // Şifre eşleşme kontrolü
User::newInstance()->update(
array(
's_pass_code' => osc_genRandomPassword(50),
's_pass_date' => date('Y-m-d H:i:s', 0),
's_pass_ip' => osc_get_ip(), //Params::getServerParam('REMOTE_ADDR')
's_password' => osc_hash_password($newPassword)
),
array('pk_i_id' => $user['pk_i_id'])
);
osc_add_flash_ok_message(_m('The password has been changed'));
$this->redirectTo(osc_user_login_url());
} else {
osc_add_flash_error_message(_m("Error, the password don't match"));
$this->redirectTo(osc_forgot_user_password_confirm_url(Params::getParam('userId'), Params::getParam('code')));
}
} else {
osc_add_flash_error_message(_m('Sorry, the link is not valid'));
}
 


Adding isset($user['b_enabled']) into if statement should be sufficient

In this case better to use !empty($var)

$var can be 0 and can be 1
isset($var) always return true

$user['b_enabled'] = 0;
isset($user['b_enabled']) // true
$user['b_enabled'] = 1;
isset($user['b_enabled']) // true
$user = [];
isset($user['b_enabled']) // false

$user['b_enabled'] = 0;
empty($user['b_enabled']) // true
$user['b_enabled'] = 1;
empty($user['b_enabled']) // false
$user = [];
empty($user['b_enabled']) // true

empty() always do check isset() first and no ERR or WARN

if $user['b_enabled'] never set as 0 and may be null (not set) or 1, one more construction may be used (php7+):
if ($user['b_enabled'] ?? null) // result is true if $user['b_enabled'] isset and not null