phacility/phabricator · error · Exception

Credential has invalid type "%s"!

Error message

Credential has invalid type "%s"!

What it means

Thrown by the private helper PassphraseCredentialEditController::getCredentialType() when PassphraseCredentialType::getTypeByConstant() cannot map a type constant to an implementation. It fires on two paths: editing an existing credential whose stored constant is unresolvable (extension removed), or creating one with a bogus/unknown 'type' request parameter. Unlike the sibling controllers, this message correctly prints the offending constant.

Source

Thrown at src/applications/passphrase/controller/PassphraseCredentialEditController.php:392

      ->setBackground(PHUIObjectBoxView::WHITE_CONFIG)
      ->setForm($form);

    $view = id(new PHUITwoColumnView())
      ->setFooter(array(
        $box,
      ));

    return $this->newPage()
      ->setTitle($title)
      ->setCrumbs($crumbs)
      ->appendChild($view);
  }

  private function getCredentialType($type_const) {
    $type = PassphraseCredentialType::getTypeByConstant($type_const);

    if (!$type) {
      throw new Exception(
        pht('Credential has invalid type "%s"!', $type_const));
    }

    return $type;
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

  1. If creating: check the constant against array_keys(PassphraseCredentialType::getAllTypes()) and use a valid one from the create form's dropdown.
  2. If editing an existing credential: verify its stored constant and reinstall the extension that provides it.
  3. Validate the 'type' parameter server-side before looking it up, returning 404 for unknown constants.

Example fix

// before
$type_const = $request->getStr('type');
$type = $this->getCredentialType($type_const);

// after
$type_const = $request->getStr('type');
$valid = array_keys(PassphraseCredentialType::getAllTypes());
if (!in_array($type_const, $valid, true)) {
  return new Aphront404Response();
}
$type = $this->getCredentialType($type_const);
Defensive patterns

Strategy: validation

Validate before calling

$valid = array_keys(PassphraseCredentialType::getAllTypes());
if (!in_array($request->getStr('type'), $valid, true)) {
  return new Aphront404Response();
}

Type guard

function is_registered_credential_type($type_const) {
  $all = PassphraseCredentialType::getAllTypes();
  return is_string($type_const) && isset($all[$type_const]);
}

Try / catch

try {
  $type = PassphraseCredentialType::getTypeByConstant($type_const);
} catch (Exception $ex) {
  // treat as 404: unknown or stale type constant
}

Prevention

When it happens

Trigger: GET/POST /passphrase/edit/ with type=<not-a-registered-constant> (typo, stale link, HTML form tampering), or /passphrase/edit/<id>/ where the stored credentialType constant no longer resolves after an extension was disabled.

Common situations: Users hand-editing URLs; bookmarks to a type constant that an upgrade renamed; extension drift between environments; fuzzed or replayed form submissions.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b02d238878481df7. Report an issue: GitHub.