diff --git a/src/includes/api/ListsController.php b/src/includes/api/ListsController.php
index 254540f..ce8057c 100644
--- a/src/includes/api/ListsController.php
+++ b/src/includes/api/ListsController.php
@@ -102,7 +102,7 @@ class ListsController extends ApiController {
     function deleteId($id)
     {
         checkWriteAccess();
-        $this->response->data = $this->deleteList($id);
+        $this->response->data = $this->deleteList((int)$id);
     }
 
 
@@ -348,17 +348,19 @@ class ListsController extends ApiController {
     {
         $t = array();
         $t['total'] = 0;
-        if (!is_array($this->req->jsonBody['order'])) {
+        $order = $this->req->jsonBody['order'] ?? [];
+        if (!array_is_list($order)) {
             return $t;
         }
         $db = DBConnection::instance();
         $order = $this->req->jsonBody['order'];
         $a = array();
         $setCase = '';
-        foreach ($order as $ow => $id) {
-            $id = (int)$id;
+        $max = count($order);
+        for ($i = 0; $i < $max; $i++) {
+            $id = (int)$order[$i];
             $a[] = $id;
-            $setCase .= "WHEN id=$id THEN $ow\n";
+            $setCase .= "WHEN id=$id THEN $i\n";
         }
         $ids = implode(',', $a);
         $db->dq("UPDATE {$db->prefix}lists SET d_edited=?, ow = CASE\n $setCase END WHERE id IN ($ids)",
diff --git a/src/includes/common.php b/src/includes/common.php
index c5fb66b..e6e7216 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -197,3 +197,20 @@ function randomString(int $len = 16, string $chars = '0123456789abcdefghijklmnop
     }
     return implode('', $a);
 }
+
+// taken from symfony/polyfill-php81 (MIT License)
+if (!function_exists('array_is_list')) {
+    function array_is_list(array $array): bool
+    {
+        if ([] === $array || $array === array_values($array)) {
+            return true;
+        }
+        $nextKey = -1;
+        foreach ($array as $k => $v) {
+            if ($k !== ++$nextKey) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
diff --git a/src/init.php b/src/init.php
index 806adf8..74d8a88 100644
--- a/src/init.php
+++ b/src/init.php
@@ -457,8 +457,8 @@ function logAndDie($userText, $errText = null)
 
 function loadExtensions()
 {
-    $a = Config::get('extensions');
-    if (!$a || !is_array($a)) {
+    $a = Config::get('extensions') ?: null;
+    if (!$a || !array_is_list($a)) {
         return;
     }
     foreach ($a as $ext) {