[bonelifer]

On the 3.3.x branch, log_failed_login_attempts() reads $event['result']['user_row']['user_id'] without checking that user_row exists. login_box() leaves it out when the login form key check fails:

$result = array(
	'status' => false,
	'error_msg' => 'FORM_INVALID',
);

With "Log failed login attempts" turned on, submitting an expired login form then raises Undefined array key "user_row" and Trying to access array offset on value of type null warnings on PHP 8, at event/listener.php line 188.

The master branch already has the isset() check. This PR backports it to 3.3.x and adds a regression test that dispatches core.login_box_failed with a result that has no user_row.

Claude tested it locally with phpBB 3.3.x and PHP 8.4:

• failed_logins_test passes, including the new case.
• The full suite gives the same 12 errors with and without this change, in delete_log_security_test and login_notification_test. They come from vsprintf() receiving an array in the language mocks, which is unrelated to this change.
• php -l passes on PHP 7.4 and 8.4.

🤖 Generated with Claude Code

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).

[bonelifer]

Claude tested this on a phpBB 3.3 board (SQLite, PHP 8.4) with "Log failed login attempts" turned on and the Administrators group watched. Each test posted a login form for admin with a wrong password.

3.3.x without this PR, invalid form token

• The page shows these warnings:

  PHP Warning: in file [ROOT]/ext/phpbb/teamsecurity/event/listener.php on line 188: Undefined array key "user_row"
  PHP Warning: in file [ROOT]/ext/phpbb/teamsecurity/event/listener.php on line 188: Trying to access array offset on null
  PHP Warning: in file [ROOT]/ext/phpbb/teamsecurity/event/listener.php on line 190: Undefined array key "user_row"
  PHP Warning: in file [ROOT]/ext/phpbb/teamsecurity/event/listener.php on line 190: Trying to access array offset on null
  

• Each attempt also adds a "Failed team member login attempt" entry to the User logs, under the guest user and with no reportee. With a null user id, group_memberships() returns true as long as the watched group has any members, so the check passes and the entry is logged.

With this PR

• Invalid form token: no warnings and no log entry.
• Valid form token: the failed login is still logged against admin, as before.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).