fix: handle null ini values in phpini check

system/Security/CheckPhpIni.php

@@ -182,8 +182,8 @@ private static function checkIni(?string $argument = null): array
         foreach ($items as $key => $values) {
             $hasKeyInIni  = array_key_exists($key, $ini);
             $output[$key] = [
-                'global'      => $hasKeyInIni ? $ini[$key]['global_value'] : 'disabled',
-                'current'     => $hasKeyInIni ? $ini[$key]['local_value'] : 'disabled',
+                'global'      => $hasKeyInIni ? (string) ($ini[$key]['global_value'] ?? '') : 'disabled',
+                'current'     => $hasKeyInIni ? (string) ($ini[$key]['local_value'] ?? '') : 'disabled',
                 'recommended' => $values['recommended'] ?? '',
                 'remark'      => $values['remark'] ?? '',
             ];

tests/system/Security/CheckPhpIniTest.php

@@ -17,6 +17,14 @@
 use CodeIgniter\Test\StreamFilterTrait;
 use PHPUnit\Framework\Attributes\Group;
 
+/**
+ * @return array<string, array<string, mixed>>|false
+ */
+function ini_get_all(?string $extension = null, bool $details = true): array|false
+{
+    return CheckPhpIniTest::$iniGetAllReturn ?? \ini_get_all($extension, $details);
+}
+
 /**
  * @internal
  */
@@ -25,6 +33,18 @@ final class CheckPhpIniTest extends CIUnitTestCase
 {
     use StreamFilterTrait;
 
+    /**
+     * @var array<string, array<string, mixed>>|null
+     */
+    public static ?array $iniGetAllReturn = null;
+
+    protected function tearDown(): void
+    {
+        parent::tearDown();
+
+        self::$iniGetAllReturn = null;
+    }
+
     public function testCheckIni(): void
     {
         $output = self::getPrivateMethodInvoker(CheckPhpIni::class, 'checkIni')();
@@ -51,6 +71,26 @@ public function testCheckIniOpcache(): void
         $this->assertSame($expected, $output['opcache.save_comments']);
     }
 
+    public function testCheckIniCastsNullIniValuesToString(): void
+    {
+        self::$iniGetAllReturn = [
+            'default_charset' => [
+                'global_value' => null,
+                'local_value'  => null,
+            ],
+        ];
+
+        $output = self::getPrivateMethodInvoker(CheckPhpIni::class, 'checkIni')();
+
+        $expected = [
+            'global'      => '',
+            'current'     => '',
+            'recommended' => 'UTF-8',
+            'remark'      => '',
+        ];
+        $this->assertSame($expected, $output['default_charset']);
+    }
+
     public function testRunCli(): void
     {
         CheckPhpIni::run(true);

user_guide_src/source/changelogs/v4.7.4.rst

@@ -41,6 +41,7 @@ Bugs Fixed
 - **Filters:** Fixed a bug in ``InvalidChars`` filter where invalid UTF-8 or control characters in array keys were not checked.
 - **HTTP:** Fixed a bug where the User Agent library reported Safari's WebKit version instead of the browser version from the ``Version`` token.
 - **Model:** Fixed a bug in ``Model::objectToRawArray()`` where the ``$recursive`` parameter was ignored.
+- **Security:** Fixed a bug where ``CheckPhpIni`` could raise a type error when ``ini_get_all()`` returned ``null`` for a configured directive value.
 - **Session:** Fixed a bug in ``RedisHandler`` where the configured ``$lockMaxRetries`` and ``$lockRetryInterval`` values were not respected when acquiring session locks.
 - **Testing:** Fixed a bug where using ``MockInputOutput`` within a test that also uses ``StreamFilterTrait`` tore down the trait's stream filters, so CLI output produced after the ``MockInputOutput`` interaction (such as in ``tearDown()``) was no longer captured and leaked to the console.