| @@ -541,17 +541,17 @@ | ||
| 541 | 541 | } |
| 542 | 542 | |
| 543 | 543 | $value = $this->$key ?? $this->fillable[ $key ]; |
| 544 | 544 | |
| 545 | - // Unserialize if necessary | |
| 545 | + // Unserialize if necessary (object instantiation disallowed — see helper). | |
| 546 | 546 | if ( is_string( $value ) && $this->is_serialized( $value ) ) { |
| 547 | - $value = maybe_unserialize( $value ); | |
| 547 | + $value = \booktics_safe_maybe_unserialize( $value ); | |
| 548 | 548 | } |
| 549 | 549 | |
| 550 | 550 | // Normalize value to default type |
| 551 | 551 | if ( gettype( $value ) !== gettype( $default ) ) { |
| 552 | 552 | if ( gettype( $default ) === 'array' && is_string( $value ) && $this->is_serialized( $value ) ) { |
| 553 | - $value = maybe_unserialize( $value ); | |
| 553 | + $value = \booktics_safe_maybe_unserialize( $value ); | |
| 554 | 554 | } elseif ( gettype( $default ) === 'array' ) { |
| 555 | 555 | $value = $default; |
| 556 | 556 | } |
| 557 | 557 | } |
| @@ -589,9 +589,11 @@ | ||
| 589 | 589 | * |
| 590 | 590 | * @return bool True if data is serialized, false otherwise |
| 591 | 591 | */ |
| 592 | 592 | function is_serialized( $data ) { |
| 593 | - return is_string( $data ) && @unserialize( $data ) !== false; | |
| 593 | + // Structural check only (WordPress core) — never calls unserialize(), so it | |
| 594 | + // cannot trigger PHP Object Injection on attacker-controlled user meta. | |
| 595 | + return is_string( $data ) && \is_serialized( $data ); | |
| 594 | 596 | } |
| 595 | 597 | |
| 596 | 598 | /** |
| 597 | 599 | * Specify data which should be serialized to JSON. |
