give / src / Donations / Migrations / SanitizeSerializedObjectPayloads.php

SanitizeSerializedObjectPayloads.php in GiveWP – Donation Plugin and Fundraising Platform 4.16.9, at src/Donations/Migrations/SanitizeSerializedObjectPayloads.php

172 lines 3.9 KB

Raw Download Zip

1	<?php
2
3	namespace Give\Donations\Migrations;
4
5	use Give\Framework\Database\DB;
6	use Give\Framework\Migrations\Contracts\Migration;
7	use Give\Helpers\Utils;
8
9	/**
10	* @since 4.16.7.2
11	*/
12	class SanitizeSerializedObjectPayloads extends Migration
13	{
14	/**
15	* @since 4.16.7.2
16	*/
17	public function run()
18	{
19	$this->sanitizeUserMeta();
20	$this->sanitizeDonorMeta();
21	$this->sanitizeDonationMeta();
22	$this->sanitizeSessions();
23	}
24
25	/**
26	* @since 4.16.7.2
27	*/
28	private function sanitizeUserMeta()
29	{
30	$this->sanitizeTable(
31	'usermeta',
32	'umeta_id',
33	'meta_key',
34	'meta_value',
35	['first_name', 'last_name', 'user_title', 'billing_address']
36	);
37	}
38
39	/**
40	* @since 4.16.7.2
41	*/
42	private function sanitizeDonorMeta()
43	{
44	$this->sanitizeTable(
45	'give_donormeta',
46	'meta_id',
47	'meta_key',
48	'meta_value',
49	['_give_donor_first_name', '_give_donor_last_name', '_give_donor_title_prefix']
50	);
51	}
52
53	/**
54	* @since 4.16.7.2
55	*/
56	private function sanitizeDonationMeta()
57	{
58	$this->sanitizeTable(
59	'give_donationmeta',
60	'meta_id',
61	'meta_key',
62	'meta_value',
63	['_give_payment_meta', '_give_donor_billing_first_name', '_give_donor_billing_last_name']
64	);
65	}
66
67	/**
68	* @since 4.16.7.2
69	*/
70	private function sanitizeSessions()
71	{
72	$this->sanitizeTable(
73	'give_sessions',
74	'session_id',
75	'session_key',
76	'session_value',
77	[]
78	);
79	}
80
81	/**
82	* @since 4.16.7.2
83	*
84	* @param string $table
85	* @param string $idColumn
86	* @param string $keyColumn
87	* @param string $valueColumn
88	* @param array $keys
89	*/
90	private function sanitizeTable($table, $idColumn, $keyColumn, $valueColumn, array $keys)
91	{
92	$query = DB::table($table);
93
94	if ( ! empty($keys)) {
95	$query->whereIn($keyColumn, $keys);
96	}
97
98	$rows = $query->getAll();
99
100	foreach ($rows as $row) {
101	if ( ! Utils::isSerialized($row->{$valueColumn})) {
102	continue;
103	}
104
105	$safe = $this->sanitizeRecursively($row->{$valueColumn});
106
107	DB::table($table)
108	->where($idColumn, $row->{$idColumn})
109	->update([
110	$valueColumn => maybe_serialize($safe),
111	]);
112	}
113	}
114
115	/**
116	* Recursively unserialize values and replace any object (including
117	* __PHP_Incomplete_Class instances) with an empty string so the final
118	* serialization cannot restore the original class.
119	*
120	* @since 4.16.7.2
121	*
122	* @param mixed $value
123	* @return mixed
124	*/
125	private function sanitizeRecursively($value)
126	{
127	if (is_string($value) && Utils::isSerialized($value)) {
128	$unserialized = unserialize($value, ['allowed_classes' => false]);
129
130	if (false !== $unserialized && $unserialized !== $value) {
131	$value = $this->sanitizeRecursively($unserialized);
132	}
133	}
134
135	if (is_object($value)) {
136	return '';
137	}
138
139	if (is_array($value)) {
140	foreach ($value as $key => $item) {
141	$value[$key] = $this->sanitizeRecursively($item);
142	}
143	}
144
145	return $value;
146	}
147
148	/**
149	* @since 4.16.7.2
150	*/
151	public static function id()
152	{
153	return 'sanitize-serialized-object-payloads';
154	}
155
156	/**
157	* @since 4.16.7.2
158	*/
159	public static function title()
160	{
161	return 'Sanitize serialized object payloads from meta tables and sessions';
162	}
163
164	/**
165	* @since 4.16.7.2
166	*/
167	public static function timestamp()
168	{
169	return strtotime('2026-08-26');
170	}
171	}
172