fix(core): block disabling the default language pack - #4813
Merged
Conversation
DefaultLanguagePackGuard is meant to stop an admin from disabling the
language pack that `default_locale` points to, but its guard clause used
`in_array('flarum-locale', $extension->extra)`, which searches the
*values* of the composer `extra` object. Those values are arrays
(`branch-alias`, `flarum-extension`, `flarum-locale`, ...), so the string
is never found: the check is always false and the guard returned early,
leaving the protection as dead code -- the default language pack could be
disabled freely.
The next line already treats `flarum-locale` as a key via
`Arr::get($extra, 'flarum-locale.code')`, confirming a key lookup was
intended. Switch the guard to `Arr::has(..., 'flarum-locale')` so the
`PermissionDeniedException` fires when the default pack is disabled.
Add DB-free unit tests covering the default pack (blocked), a non-default
pack (allowed) and a non-language-pack extension (allowed).
Co-Authored-By: Claude <noreply@anthropic.com>
imorland
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #623 (re-opens the intent — the guard added for it never actually fires).
Changes proposed in this pull request
DefaultLanguagePackGuardis meant to stop an admin from disabling the language pack thatdefault_localepoints to. Its guard usedin_array('flarum-locale', $extension->extra), which searches the values of the composerextraobject — those values are arrays (branch-alias,flarum-extension,flarum-locale, …), so the string is never found, the check is alwaysfalse, and the guard returns early. The protection was dead code: the default language pack could be disabled freely.The very next line already treats
flarum-localeas a key viaArr::get($extra, 'flarum-locale.code'), so this switches the check toArr::has($extension->extra, 'flarum-locale').Reviewers should focus on
DefaultLanguagePackGuard::handle()— the key-vs-value lookup.Confirmed
tests/unit/Extension/DefaultLanguagePackGuardTest.php): default pack blocked, non-default pack allowed, non-language-pack extension allowed.Testing
composer test:unit— the new tests fail before the change (exception not thrown) and pass after; full unit suite green (344 tests).Prepared with AI assistance (Claude) and reviewed/verified by me.