# Minor: PHP Warning "Undefined variable $panel" in inc/policies.php on /login/ and /list/web/ (Ubuntu 26.04)

**URL:** <https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354>\
**Category:** System\
**Created:** [October 24, 2026, 4:31pm UTC](https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354 "2026-10-24T16:31:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\
**Post date:** [October 24, 2026, 4:31pm UTC](https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354/1 "2026-10-24T16:31:53Z")

</div>

**Note the post was created with the help of AI. I did my research and used AI to help my find a solution to the issue**

## Summary

Cosmetic issue, no functional impact. Under Ubuntu 26.04’s PHP, `policies.php` emits warnings that show up in `/var/log/hestia/nginx-error.log` whenever the login page or the web-listing page is loaded.

## Environment

- HestiaCP **1.10.5-1+ubuntu26.04**
- Ubuntu **26.04** (aarch64), upgraded from 24.04

## Symptom

`/var/log/hestia/nginx-error.log` shows, on `GET /login/` and `GET /list/web/`:

```auto
PHP Warning: Undefined variable $panel in /usr/local/hestia/web/inc/policies.php on line 5
PHP Warning: Trying to access array offset on null in /usr/local/hestia/web/inc/policies.php on line 5
PHP Warning: Trying to access array offset on null in /usr/local/hestia/web/inc/policies.php on line 5

```

## Impact

None observed — the pages work normally (logins, listings, File Manager all functional). The warnings only pollute the error log. Likely surfaced by the stricter undefined-variable reporting in the newer PHP version after the distro upgrade.

## Suggested fix

One of the usual options for this class of notice in `policies.php`: initialize `$panel` (or its expected array element) with a default before line 5, or guard the access with `isset()`/null-coalescing. Not critical — logging noise only.

---

<div class="post-metadata">

**Author:** ![sahsanu](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/sahsanu/32/9318_2.png) [@sahsanu](https://forum.hestiacp.com/u/sahsanu)\
**Post date:** [October 24, 2026, 5:49pm UTC](https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354/2 "2026-10-24T17:49:23Z")

</div>

Thanks for the report.

I’ve created a PR to fix it:

> <https://github.com/hestiacp/hestiacp/pull/5835>
>
> \`policies.php\` is included from \`main.php\` at global scope, where \`$panel\` is un…defined, so regular users triggered three PHP warnings per request. Even if defined, \`$user\` is already shell-quoted there, so the lookup would never match and \`POLICY\_USER\_VIEW\_SUSPENDED\` was never enforced.
> 
> Fetch the user data with \`get\_user\_data()\` using the plain session user, only when the policy is enabled.
> 
> Forum post: https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354

---

<div class="post-metadata">

**Author:** ![chrmina](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/chrmina/32/8803_2.png) [@chrmina](https://forum.hestiacp.com/u/chrmina)\
**Post date:** [October 25, 2026, 5:54am UTC](https://forum.hestiacp.com/t/minor-php-warning-undefined-variable-panel-in-inc-policies-php-on-login-and-list-web-ubuntu-26-04/22354/3 "2026-10-25T05:54:32Z")

</div>

Great, thank you! I saw your patch at GitHub!