[2.x] API Error

[GreXXL]

Current Behavior

Recorded on discuss (don't know the context on how it was logged, multiple instances on June 19th) RC4

[2026-06-19T16:14:23.976749+00:00] flarum.ERROR: TypeError: Cannot assign null to property Tobyz\JsonApiServer\Pagination\OffsetPagination::$limit of type int in PATH/vendor/flarum/core/src/Api/Endpoint/Index.php:133
Stack trace:
#0 PATH/vendor/flarum/core/src/Api/Endpoint/Endpoint.php(104): Flarum\Api\Endpoint\Index->Flarum\Api\Endpoint\{closure}()
#1 PATH/vendor/flarum/core/src/Api/Endpoint/Endpoint.php(137): Flarum\Api\Endpoint\Endpoint->process()
#2 PATH/vendor/flarum/core/src/Api/JsonApi.php(129): Flarum\Api\Endpoint\Endpoint->handle()
#3 PATH/vendor/flarum/core/src/Http/RouteHandlerFactory.php(64): Flarum\Api\JsonApi->handle()
#4 PATH/vendor/flarum/core/src/Http/Middleware/ExecuteRoute.php(27): Flarum\Http\RouteHandlerFactory->Flarum\Http\{closure}()
#5 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\ExecuteRoute->process()
#6 PATH/vendor/flectar/flarum-turnstile/src/Middleware/CheckTurnstile.php(58): Laminas\Stratigility\Next->handle()
#7 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flectar\Turnstile\Middleware\CheckTurnstile->process()
#8 PATH/vendor/flarum/messages/src/Http/Middleware/PopulateDialogWithActor.php(27): Laminas\Stratigility\Next->handle()
#9 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Messages\Http\Middleware\PopulateDialogWithActor->process()
#10 PATH/vendor/fof/sentry/src/Middleware/HandleErrorsWithSentry.php(42): Laminas\Stratigility\Next->handle()
#11 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): FoF\Sentry\Middleware\HandleErrorsWithSentry->process()
#12 PATH/vendor/fof/sitemap/src/Middleware/ApiRobotsHeader.php(29): Laminas\Stratigility\Next->handle()
#13 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): FoF\Sitemap\Middleware\ApiRobotsHeader->process()
#14 PATH/vendor/fof/oauth/src/Middleware/BindRequest.php(31): Laminas\Stratigility\Next->handle()
#15 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): FoF\OAuth\Middleware\BindRequest->process()
#16 PATH/vendor/flarum/audit/src/Middleware/LogPasswordResetAttempt.php(43): Laminas\Stratigility\Next->handle()
#17 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Audit\Middleware\LogPasswordResetAttempt->process()
#18 PATH/vendor/flarum/audit/src/Middleware/ExtendSetPermissionController.php(26): Laminas\Stratigility\Next->handle()
#19 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Audit\Middleware\ExtendSetPermissionController->process()
#20 PATH/vendor/flarum/audit/src/Middleware/SetLoggerActor.php(33): Laminas\Stratigility\Next->handle()
#21 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Audit\Middleware\SetLoggerActor->process()
#22 PATH/vendor/flarum/core/src/Http/Middleware/PopulateWithActor.php(27): Laminas\Stratigility\Next->handle()
#23 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\PopulateWithActor->process()
#24 PATH/vendor/flarum/core/src/Api/Middleware/ThrottleApi.php(31): Laminas\Stratigility\Next->handle()
#25 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Api\Middleware\ThrottleApi->process()
#26 PATH/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(32): Laminas\Stratigility\Next->handle()
#27 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\CheckCsrfToken->process()
#28 PATH/vendor/flarum/core/src/Http/Middleware/CheckForMaintenanceMode.php(37): Laminas\Stratigility\Next->handle()
#29 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\CheckForMaintenanceMode->process()
#30 PATH/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php(59): Laminas\Stratigility\Next->handle()
#31 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\ResolveRoute->process()
#32 PATH/vendor/flarum/core/src/Http/Middleware/SetLocale.php(43): Laminas\Stratigility\Next->handle()
#33 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\SetLocale->process()
#34 PATH/vendor/flarum/core/src/Http/Middleware/AuthenticateWithHeader.php(63): Laminas\Stratigility\Next->handle()
#35 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\AuthenticateWithHeader->process()
#36 PATH/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(32): Laminas\Stratigility\Next->handle()
#37 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\AuthenticateWithSession->process()
#38 PATH/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(55): Laminas\Stratigility\Next->handle()
#39 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\RememberFromCookie->process()
#40 PATH/vendor/flarum/core/src/Http/Middleware/StartSession.php(44): Laminas\Stratigility\Next->handle()
#41 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\StartSession->process()
#42 PATH/vendor/flarum/core/src/Api/Middleware/FakeHttpMethods.php(29): Laminas\Stratigility\Next->handle()
#43 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Api\Middleware\FakeHttpMethods->process()
#44 PATH/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Laminas\Stratigility\Next->handle()
#45 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\ParseJsonBody->process()
#46 PATH/vendor/flarum/core/src/Api/Middleware/AddAssetsRevisionHeader.php(34): Laminas\Stratigility\Next->handle()
#47 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Api\Middleware\AddAssetsRevisionHeader->process()
#48 PATH/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(43): Laminas\Stratigility\Next->handle()
#49 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\HandleErrors->process()
#50 PATH/vendor/flarum/core/src/Http/Middleware/InjectActorReference.php(25): Laminas\Stratigility\Next->handle()
#51 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\InjectActorReference->process()
#52 PATH/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(77): Laminas\Stratigility\Next->handle()
#53 PATH/vendor/middlewares/request-handler/src/RequestHandler.php(84): Laminas\Stratigility\MiddlewarePipe->process()
#54 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Middlewares\RequestHandler->process()
#55 PATH/vendor/middlewares/base-path-router/src/BasePathRouter.php(97): Laminas\Stratigility\Next->handle()
#56 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Middlewares\BasePathRouter->process()
#57 PATH/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php(36): Laminas\Stratigility\Next->handle()
#58 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Laminas\Stratigility\Middleware\OriginalMessages->process()
#59 PATH/vendor/middlewares/base-path/src/BasePath.php(73): Laminas\Stratigility\Next->handle()
#60 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Middlewares\BasePath->process()
#61 PATH/vendor/flarum/core/src/Http/Middleware/ProcessIp.php(24): Laminas\Stratigility\Next->handle()
#62 PATH/vendor/laminas/laminas-stratigility/src/Next.php(52): Flarum\Http\Middleware\ProcessIp->process()
#63 PATH/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(77): Laminas\Stratigility\Next->handle()
#64 PATH/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(66): Laminas\Stratigility\MiddlewarePipe->process()
#65 PATH/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(73): Laminas\Stratigility\MiddlewarePipe->handle()
#66 PATH/vendor/flarum/core/src/Http/Server.php(44): Laminas\HttpHandlerRunner\RequestHandlerRunner->run()
#67 PATH/public/index.php(22): Flarum\Http\Server->listen()
#68 {main}  

Steps to Reproduce

Logfile entry

Expected Behavior

No Error

Screenshots

No response

Environment

• Flarum version: x.y.z
• Website URL: http://example.com
• Webserver: [e.g. apache, nginx]
• Hosting environment: [e.g. shared, vps]
• PHP version: x.y.z
• Browser: [e.g. chrome 67, safari 11]

Output of php flarum info

Output of "php flarum info", run this in terminal in your Flarum directory.

Possible Solution

No response

Additional Context

No response

[linkrobins]

Took a look at this. It reproduces on a clean install with no extensions, so it's purely core. The trigger is any request to an offset-paginated endpoint with page[limit]=0:

GET /api/discussions?page[limit]=0

That alone 500s with the same error. Happens on 2.0.0-rc.4 and current 2.x-dev.

The cause is in RequestUtil::extractLimit(). It returns null whenever the limit is falsy:

if (! $limit) {
    return null;
}

And "0" is falsy, so it gets through. Then in Index.php:133 that null gets assigned to OffsetPagination::$limit, which is typed public int $limit, so PHP throws.

The tell is the boundary. Only the literal 0 breaks. -5, abc, even 00 and 0.0 all come back as a clean 400:

page[limit]=	Result
0	500
00 / 0.0	400
-5 / abc	400
empty / absent	200

That's because "00" and "0.0" are truthy strings, so they reach the < 1 check and get rejected properly. Plain "0" short-circuits to null before it gets there.

In practice this is probably just bots hitting old or bad paginated URLs. Real clients never send limit=0, so it's harmless, just noisy in the logs.

The fix is basically one line. Change the falsy check to a strict null check so an explicit 0 falls through to the < 1 guard that's already there, and 400s like -5 does:

if (! filled($limit)) {
    $limit = $defaultLimit;
}

if ($limit === null) {   // was: if (! $limit) — also caught the string "0"
    return null;
}

if ($max !== null) {
    $limit = min($limit, $max);
}

if ($limit < 1) {        // now reached by page[limit]=0 -> clean 400
    throw new BadRequestException('page[limit] must be at least 1');
}

That keeps the "no limit" path intact (genuinely absent limit with a null default still returns null), it only stops the explicit 0 from sneaking through. I've opened a PR with the fix and tests: #4775.