← All changes | base/abstracts/post-model.php +7 -18 1.0.21 → 1.0.27 View file →

		@@ -514,17 +514,17 @@
514	514	}
515	515
516	516	$value = $this->$key;
517	517
518		- // Unserialize if necessary
	518	+ // Unserialize if necessary (object instantiation disallowed — see helper).
519	519	if ( is_string( $value ) && $this->is_serialized( $value ) ) {
520		- $value = maybe_unserialize( $value );
	520	+ $value = \booktics_safe_maybe_unserialize( $value );
521	521	}
522	522
523	523	// Normalize value to default type
524	524	if ( gettype( $value ) !== gettype( $default ) ) {
525	525	if ( gettype( $default ) === 'array' && is_string( $value ) && $this->is_serialized( $value ) ) {
526		- $value = maybe_unserialize( $value );
	526	+ $value = \booktics_safe_maybe_unserialize( $value );
527	527	} elseif ( gettype( $default ) === 'array' ) {
528	528	$value = $default; // Set to default empty array if the value doesn't match
529	529	}
530	530	}
		@@ -578,21 +578,10 @@
578	578	*
579	579	* @return bool True if the data is serialized, false otherwise.
580	580	*/
581	581	protected function is_serialized( $data ) {
582		- // If it isn't a string, return false
583		- if ( ! is_string( $data ) ) {
584		- return false;
585		- }
586		-
587		- // Check if it's a serialized string (Array or Object)
588		- $data = trim( $data );
589		-
590		- if ( 'N;' === $data || ! preg_match( '/^([adObis]):/', $data ) ) {
591		- return false;
592		- }
593		-
594		- $result = @unserialize( $data );
595		-
596		- return $result !== false || $data === 'b:0;'; // Return false for failed unserialization and true for successful
	582	+ // Use WordPress core's purely structural check. Unlike the previous
	583	+ // implementation, \is_serialized() never calls unserialize(), so testing
	584	+ // attacker-controlled meta can no longer trigger PHP Object Injection.
	585	+ return is_string( $data ) && \is_serialized( $data );
597	586	}
598	587	}