After updating FOG to version 1.6.0.117, the Management Portal returns HTTP 500 Internal Server

[sgennadi]

Project: FOG Project
Affected version: 1.6.0.117
Branch: dev-branch
Commit: 8b579c5cb
OS: Oracle Linux Server
PHP: 8.3.36
Web server: Apache 2.4.37 / PHP-FPM
Database: MariaDB 10.3
Severity: High

Problem Description

After updating FOG to version 1.6.0.117, the Management Portal returns HTTP 500 Internal Server Error for some browser sessions.

Apache, PHP-FPM and MariaDB are running correctly.

Requests without the affected session return HTTP 200, indicating that the problem is associated with session handling rather than general web server availability.

PHP Fatal Error

PHP Fatal error:
Uncaught Error: [] operator not supported for strings
in FOGBase.php on line 1515

Call sequence:

FOGBase::setMessage()
User::_isLoggedIn()
User::isLoggedIn()
Page::_isContentOnly()
Page::__construct()
management/index.php

The error occurs when FOG attempts to queue a session-expiration notification.

Root Cause

File: packages/web/src/Base/FOGBase.php
Method: FOGBase::setMessage()
Line: 1515

Current implementation:

$_SESSION[‘FOG_MESSAGES’][] = [
‘title’ => (string)$title,
‘body’ => (string)$body,
‘type’ => (string)$type
];

The implementation assumes that $_SESSION[‘FOG_MESSAGES’] is always an array.

However, if the session variable contains a string, PHP throws a fatal error when the array append operator [] is used.

The origin of the invalid string value has not yet been established.

This is an application-level type-handling defect, not evidence that the installed PHP version is too old.

Proposed Fix

Validate and initialize the session message queue before appending new messages.

public static function setMessage($body, $title = ‘’, $type = ‘info’)
{
if (session_status() !== PHP_SESSION_ACTIVE) {
return;
}

if (!isset($_SESSION['FOG_MESSAGES'])
    || !is_array($_SESSION['FOG_MESSAGES'])
) {
    $_SESSION['FOG_MESSAGES'] = [];
}

$_SESSION['FOG_MESSAGES'][] = [
    'title' => (string)$title,
    'body' => (string)$body,
    'type' => (string)$type
];

}

This defensive check prevents fatal errors when the session message queue contains an unexpected type.

Recommended Tests

Missing FOG_MESSAGES session variable.

FOG_MESSAGES contains a string.

FOG_MESSAGES contains an empty array.

FOG_MESSAGES contains previously queued messages.

Multiple calls to setMessage().

Expired sessions and login redirects.

Compatibility with FOGBase::getMessage().

PHP Version Considerations

The issue was reproduced with PHP 8.3.36.

Upgrading PHP is not expected to fix this defect because the application attempts to append an array element to a string.

The proposed fix is compatible with PHP 8.3 and does not require a newer PHP release.

Verification

The installed FOGBase.php was compared with the corresponding file in the dev-branch repository. No differences were found.

The PHP-FPM error log repeatedly recorded the fatal error during session expiration.

Unauthenticated requests without the affected session returned HTTP 200.

The proposed patch still requires regression testing.

Expected Behavior

FOG should handle invalid or expired sessions gracefully, without generating HTTP 500 errors.

The message queue should be initialized safely, and the user should be redirected to the login screen or shown an appropriate session-expiration notification.

Suggested Resolution

Apply defensive session-type validation in FOGBase::setMessage() and review FOGBase::getMessage() for similar assumptions.

Consider investigating where FOG_MESSAGES receives a string value to prevent the underlying state corruption.

Suggested fix version: Next development build after 1.6.0.117, subject to maintainer approval.

[Tom Elliott]

@sgennadi Thanks for the detailed report. Your diagnosis is right.

Cause: FOG 1.5, and 1.6 builds from before July 2026, stored FOG_MESSAGES in the session as a string. Current code stores a list and appends to it. When a browser still carries one of those old sessions, the inactivity notice tries to append to the string, and every request from that browser returns a 500.

Fix: https://github.com/FOGProject/fogproject/pull/2080, merged to dev-branch. setMessage() now resets a non-list queue, and getMessage() drops old string entries. Pull dev-branch and re-run the installer to pick it up.

If you cannot update right away, clear the FOG cookie in the affected browser, or delete that browser’s session file. The error stops for that browser.