← All changes | classes/class-dfrapi-import.php +26 -4 1.4.2 → 1.4.3 View file →

		@@ -87,10 +87,11 @@
87	87	preg_match ("/(\[NETWORKS\]).*(\[\/NETWORKS\])/i", $value, $networks);
88	88	if ( isset( $networks[0] ) ) {
89	89	$networks = str_replace( array("[NETWORKS]", "[/NETWORKS]"), "", $networks[0]);
90	90	$networks = trim( $networks );
91		- if ( strlen( $networks ) > 1 ) {
92		- update_option( 'dfrapi_networks', unserialize( $networks ) );
	91	+ $networks = $this->unserialize_data( $networks );
	92	+ if ( is_array( $networks ) ) {
	93	+ update_option( 'dfrapi_networks', dfrapi_sanitize_networks_option( $networks ) );
93	94	}
94	95	}
95	96
96	97	// Import merchants
		@@ -97,13 +98,34 @@
97	98	preg_match ("/(\[MERCHANTS\]).*(\[\/MERCHANTS\])/i", $value, $merchants);
98	99	if ( isset( $merchants[0] ) ) {
99	100	$merchants = str_replace( array("[MERCHANTS]", "[/MERCHANTS]"), "", $merchants[0] );
100	101	$merchants = trim( $merchants );
101		- if ( strlen( $merchants ) > 1 ) {
102		- update_option( 'dfrapi_merchants', unserialize( $merchants ) );
	102	+ $merchants = $this->unserialize_data( $merchants );
	103	+ if ( is_array( $merchants ) ) {
	104	+ update_option( 'dfrapi_merchants', dfrapi_sanitize_merchants_option( $merchants ) );
103	105	}
104	106	}
105	107
	108	+ }
	109	+
	110	+ /**
	111	+ * Safely unserializes exported data. Objects are never instantiated.
	112	+ *
	113	+ * @since 1.4.3
	114	+ *
	115	+ * @param string $data
	116	+ *
	117	+ * @return array|null Array on success, null if $data is not a serialized array.
	118	+ */
	119	+ private function unserialize_data( $data ) {
	120	+
	121	+ if ( strlen( $data ) <= 1 || ! is_serialized( $data ) ) {
	122	+ return null;
	123	+ }
	124	+
	125	+ $value = @unserialize( $data, [ 'allowed_classes' => false ] );
	126	+
	127	+ return is_array( $value ) ? $value : null;
106	128	}
107	129
108	130	} // class Dfrapi_Import
109	131