UserSpice Bugs

ID	Project	Category	Submitted / Last Updated
02334	UserSpice	Plugins	2026-04-20 09:06:28 / 2026-04-20 13:06:28
Reported	Jim Boone	Assigned To	Unassigned
Priority	none	Reported	6.0.5
Status	new	Resolution Version and Commit
Summary	Brevo Plugin -- override.php signature mismatch
Description	Plugin: Brevo Sendinblue Plugin v1.4.0 (released 2026-01-26) UserSpice: 6.0.5 (plugin last tested against 6.0.2) PHP: 8.2+ Upstream source: https://github.com/mudmin/usplugins/tree/master/src/sendinblue/override.RENAME.php confirmed identical to local installed file. PROBLEM ------- override.php (and override.RENAME.php) define the email() function with a different signature than UserSpice&amp;#039;s canonical email() in users/helpers/helpers.php. Any caller that passes a 4th-argument options array silently loses that data. UserSpice canonical signature (users/helpers/helpers.php, line 159): function email($to, $subject, $body, $opts = [], $attachment = null) Plugin override signature (usersc/plugins/sendinblue/override.php, line 3): function email($to, $subject, $body, $to_name = &amp;quot;&amp;quot;, $options = []) The parameter names and types differ: - Position 4: UserSpice expects $opts (array); plugin defines $to_name (string) - Position 5: UserSpice expects $attachment (string path); plugin defines $options (array) REPRODUCTION ------------ Call email() with a 4th-argument options array -- the documented UserSpice pattern: email($to, $subject, $body, [&amp;#039;replyTo&amp;#039; =&amp;gt; &amp;#039;user@example.com&amp;#039;]); Expected: The Brevo API call includes replyTo.email = user@example.com. Actual: The array [&amp;#039;replyTo&amp;#039; =&amp;gt; &amp;#039;user@example.com&amp;#039;] is received as $to_name (a string). PHP silently casts it to the string &amp;quot;Array&amp;quot;. The $options parameter defaults to []. The reply-to address is discarded entirely with no error or warning. ROOT CAUSE ---------- override.php copied the internal sendinblue() function&amp;#039;s own signature instead of the public UserSpice email() contract. The translation layer between UserSpice option keys (replyTo, email, name) and Brevo option keys (reply, from, from_name) is missing entirely. sendinblue() signature (functions.php, line 51): function sendinblue($to, $subject, $body, $to_name = &amp;quot;&amp;quot;, $options = []) The override passes arguments straight through to sendinblue() without translation. This works for 3-argument calls, but any caller using the documented $opts array loses their options silently. Because only a subset of callers use the 4th argument, the bug is not immediately obvious -- sites with no options-passing callers see no symptoms. SECONDARY ISSUE: RETURN VALUE ------------------------------ sendinblue() (functions.php, lines 109-113) returns: - true on success (line 109) - an error string on failure (lines 56, 113) -- never false This means the standard PHP falsy check &amp;quot;if (!$email_sent)&amp;quot; used by callers following UserSpice patterns never detects failures: a non-empty error string is truthy, so !$email_sent evaluates to false even when sending has failed. Delivery failures are silently swallowed. The canonical UserSpice email() returns a boolean ($mail-&amp;gt;send() result), so &amp;quot;if (!$email_sent)&amp;quot; works correctly there. The divergence in return type is a behaviour change callers cannot detect without reading the plugin source. IMPACT ------ - Silent data loss on any call that passes [&amp;#039;replyTo&amp;#039; =&amp;gt; ...], [&amp;#039;email&amp;#039; =&amp;gt; ...], or [&amp;#039;name&amp;#039; =&amp;gt; ...] as the 4th argument -- the documented UserSpice API. - Any caller using &amp;quot;if (!$result)&amp;quot; for failure detection silently suppresses all Brevo delivery errors. - Affects any site using the plugin where callers pass a 4th-argument options array. SUGGESTED FIX ------------- Two files, minimal changes. This keeps the architecture clean: sendinblue() stays a Brevo-specific function with Brevo-specific arguments, and override.RENAME.php does exactly the job it exists to do -- translate UserSpice&amp;#039;s public API into Brevo&amp;#039;s internal one. Fix 1: override.RENAME.php Update to use the correct UserSpice signature with option key translation. This file is the designated adapter between UserSpice&amp;#039;s API and Brevo&amp;#039;s API; it just needs to actually perform that translation: &amp;lt;?php // rename this file to override.php to override the existing email function function email($to, $subject, $body, $opts = [], $attachment = null) { $brevo_opts = []; if (isset($opts[&amp;#039;replyTo&amp;#039;])) { $brevo_opts[&amp;#039;reply&amp;#039;] = $opts[&amp;#039;replyTo&amp;#039;]; } if (isset($opts[&amp;#039;email&amp;#039;])) { $brevo_opts[&amp;#039;from&amp;#039;] = $opts[&amp;#039;email&amp;#039;]; } if (isset($opts[&amp;#039;name&amp;#039;])) { $brevo_opts[&amp;#039;from_name&amp;#039;] = $opts[&amp;#039;name&amp;#039;]; } return sendinblue($to, $subject, $body, &amp;#039;&amp;#039;, $brevo_opts); } Fix 2: functions.php Change the two failure returns from error strings to false, and log the error message before discarding it so callers get a clean boolean contract: // Line 56 -- currently: return &amp;quot;All fields are required&amp;quot;; logger($user-&amp;gt;data()-&amp;gt;id, &amp;quot;sendinblue&amp;quot;, &amp;quot;FAILED: All fields are required&amp;quot;); return false; // Line 113 -- currently: return $e-&amp;gt;getMessage(); logger($user-&amp;gt;data()-&amp;gt;id, &amp;quot;sendinblue&amp;quot;, &amp;quot;ERROR &amp;quot; . $e-&amp;gt;getMessage()); return false; This matters because the canonical UserSpice email() returns a boolean ($mail-&amp;gt;send() result), so any site migrating from PHPMailer to Brevo will have failure detection silently break across their whole site if sendinblue() returns a string instead of false. WORKAROUND (until fix is available) ------------------------------------- Callers needing the 4th-argument options (e.g. reply-to) should call sendinblue() directly using Brevo&amp;#039;s own option keys instead of going through email(): // Instead of: email($to, $subject, $body, [&amp;#039;replyTo&amp;#039; =&amp;gt; $addr]); // Use: if (function_exists(&amp;#039;sendinblue&amp;#039;)) { $result = sendinblue($to, $subject, $body, &amp;#039;&amp;#039;, [&amp;#039;reply&amp;#039; =&amp;gt; $addr]); } else { $result = email($to, $subject, $body, [&amp;#039;replyTo&amp;#039; =&amp;gt; $addr]); } This is environment-specific but avoids the silent data loss until the plugin is patched.

View Issue Detail