| @@ -98,15 +98,8 @@ | ||
| 98 | 98 | |
| 99 | 99 | $import_file = sanitize_text_field( $_FILES['import_file']['tmp_name'] ); |
| 100 | 100 | $settings = wp_json_file_decode( $import_file ); |
| 101 | 101 | |
| 102 | - if ( empty( $settings ) || ! is_array( $settings ) ) { | |
| 103 | - wp_die( | |
| 104 | - esc_html__( 'The file could not be read or does not contain valid data', 'float-menu' ), | |
| 105 | - esc_html__( 'Error', 'float-menu' ), | |
| 106 | - [ 'response' => 400 ] ); | |
| 107 | - } | |
| 108 | - | |
| 109 | 102 | $columns = DBManager::get_columns(); |
| 110 | 103 | |
| 111 | 104 | $update = ! empty( $_POST['wpie_import_update'] ) ? '1' : ''; |
| 112 | 105 | // phpcs:enable |
| @@ -111,12 +104,8 @@ | ||
| 111 | 104 | $update = ! empty( $_POST['wpie_import_update'] ) ? '1' : ''; |
| 112 | 105 | // phpcs:enable |
| 113 | 106 | |
| 114 | 107 | foreach ( $settings as $key => $val ) { |
| 115 | - if ( ! is_object( $val ) ) { | |
| 116 | - continue; | |
| 117 | - } | |
| 118 | - | |
| 119 | 108 | $data = []; |
| 120 | 109 | $formats = []; |
| 121 | 110 | |
| 122 | 111 | foreach ( $columns as $column ) { |
| @@ -122,9 +111,9 @@ | ||
| 122 | 111 | foreach ( $columns as $column ) { |
| 123 | 112 | $name = $column->Field; |
| 124 | 113 | |
| 125 | 114 | if ( $name === 'param' ) { |
| 126 | - $param_input = self::safe_unserialize( $val->$name ?? '' ); | |
| 115 | + $param_input = maybe_unserialize( $val->$name ); | |
| 127 | 116 | $new_param = UpdateDB::update_param( $param_input ); |
| 128 | 117 | $param_output = maybe_serialize( $new_param ); |
| 129 | 118 | $data[ $name ] = $param_output; |
| 130 | 119 | } else { |
| @@ -169,26 +158,8 @@ | ||
| 169 | 158 | private static function get_file_extension( $str ) { |
| 170 | 159 | $parts = explode( '.', $str ); |
| 171 | 160 | |
| 172 | 161 | return end( $parts ); |
| 173 | - } | |
| 174 | - | |
| 175 | - /** | |
| 176 | - * Unserialize data coming from an uploaded file. | |
| 177 | - * | |
| 178 | - * Objects are never instantiated, so a crafted file cannot trigger | |
| 179 | - * PHP object injection. | |
| 180 | - * | |
| 181 | - * @param mixed $data The value stored in the import file. | |
| 182 | - * | |
| 183 | - * @return mixed | |
| 184 | - */ | |
| 185 | - private static function safe_unserialize( $data ) { | |
| 186 | - if ( ! is_string( $data ) || ! is_serialized( $data ) ) { | |
| 187 | - return $data; | |
| 188 | - } | |
| 189 | - | |
| 190 | - return unserialize( $data, [ 'allowed_classes' => false ] ); | |
| 191 | 162 | } |
| 192 | 163 | |
| 193 | 164 | /** |
| 194 | 165 | * @throws \JsonException |
