| @@ -183,13 +183,13 @@ | ||
| 183 | 183 | add_action( 'shutdown', [ $this, 'save_data' ], 20 ); |
| 184 | 184 | add_action( 'wp_logout', [ $this, 'destroy_session' ] ); |
| 185 | 185 | |
| 186 | 186 | if ( ! is_user_logged_in() ) { |
| 187 | - add_filter( 'nonce_user_logged_out', [ $this, '__nonce_user_logged_out' ] ); | |
| 187 | + add_filter( 'nonce_user_logged_out', [$this, 'nonce_user_logged_out'] ); | |
| 188 | 188 | } |
| 189 | 189 | |
| 190 | 190 | // Remove old sessions. |
| 191 | - Give_Cron::add_daily_event( [ $this, '__cleanup_sessions' ] ); | |
| 191 | + Give_Cron::add_daily_event( [$this, 'cleanup_sessions'] ); | |
| 192 | 192 | } |
| 193 | 193 | |
| 194 | 194 | /** |
| 195 | 195 | * Get session data |
| @@ -213,15 +213,15 @@ | ||
| 213 | 213 | * @return array |
| 214 | 214 | */ |
| 215 | 215 | public function get_session_cookie() { |
| 216 | 216 | $session = []; |
| 217 | - $cookie_value = isset( $_COOKIE[ $this->cookie_name ] ) ? give_clean( $_COOKIE[ $this->cookie_name ] ) : $this->__handle_ajax_cookie(); // @codingStandardsIgnoreLine. | |
| 217 | + $cookie_value = isset( $_COOKIE[ $this->cookie_name ] ) ? give_clean( $_COOKIE[ $this->cookie_name ] ) : $this->handle_ajax_cookie(); // @codingStandardsIgnoreLine. | |
| 218 | 218 | |
| 219 | 219 | if ( empty( $cookie_value ) || ! is_string( $cookie_value ) ) { |
| 220 | 220 | return $session; |
| 221 | 221 | } |
| 222 | 222 | |
| 223 | - list( $donor_id, $session_expiration, $session_expiring, $cookie_hash ) = explode( '||', $cookie_value ); | |
| 223 | + [ $donor_id, $session_expiration, $session_expiring, $cookie_hash ] = explode( '||', $cookie_value ); | |
| 224 | 224 | |
| 225 | 225 | if ( empty( $donor_id ) ) { |
| 226 | 226 | return $session; |
| 227 | 227 | } |
| @@ -252,14 +252,16 @@ | ||
| 252 | 252 | |
| 253 | 253 | /** |
| 254 | 254 | * Load session cookie by ajax |
| 255 | 255 | * |
| 256 | + * @since 4.9.0 rename function - PHP 8 compatibility | |
| 256 | 257 | * @since 2.2.6 |
| 257 | 258 | * @access private |
| 258 | 259 | * |
| 259 | 260 | * @return array|bool|string |
| 260 | 261 | */ |
| 261 | - private function __handle_ajax_cookie() { | |
| 262 | + private function handle_ajax_cookie() | |
| 263 | + { | |
| 262 | 264 | $cookie = false; |
| 263 | 265 | |
| 264 | 266 | // @see https://github.com/impress-org/give/issues/3705 |
| 265 | 267 | if ( |
| @@ -333,8 +335,9 @@ | ||
| 333 | 335 | * Get Session |
| 334 | 336 | * |
| 335 | 337 | * Retrieve session variable for a given session key. |
| 336 | 338 | * |
| 339 | + * @since 4.16.7.2 Restrict unserialize to prevent object instantiation. | |
| 337 | 340 | * @since 1.0 |
| 338 | 341 | * @access public |
| 339 | 342 | * |
| 340 | 343 | * @param string $key Session key. |
| @@ -344,9 +347,15 @@ | ||
| 344 | 347 | */ |
| 345 | 348 | public function get( $key, $default = false ) { |
| 346 | 349 | $key = sanitize_key( $key ); |
| 347 | 350 | |
| 348 | - return isset( $this->session[ $key ] ) ? maybe_unserialize( $this->session[ $key ] ) : $default; | |
| 351 | + if ( ! isset( $this->session[ $key ] ) ) { | |
| 352 | + return $default; | |
| 353 | + } | |
| 354 | + | |
| 355 | + $value = $this->session[ $key ]; | |
| 356 | + | |
| 357 | + return is_serialized( $value ) ? unserialize( $value, [ 'allowed_classes' => false ] ) : $value; | |
| 349 | 358 | } |
| 350 | 359 | |
| 351 | 360 | /** |
| 352 | 361 | * Set Session |
| @@ -488,9 +497,9 @@ | ||
| 488 | 497 | // Dirty if something changed - prevents saving nothing new. |
| 489 | 498 | if ( $this->session_data_changed && $this->has_session() ) { |
| 490 | 499 | global $wpdb; |
| 491 | 500 | |
| 492 | - Give()->session_db->__replace( | |
| 501 | + Give()->session_db->replace( | |
| 493 | 502 | Give()->session_db->table_name, |
| 494 | 503 | [ |
| 495 | 504 | 'session_key' => $this->donor_id, |
| 496 | 505 | 'session_value' => maybe_serialize( $this->session ), |
| @@ -574,8 +583,9 @@ | ||
| 574 | 583 | /** |
| 575 | 584 | * When a user is logged out, ensure they have a unique nonce by using the donor/session ID. |
| 576 | 585 | * Note: for internal logic only. |
| 577 | 586 | * |
| 587 | + * @since 4.9.0 rename function - PHP 8 compatibility | |
| 578 | 588 | * @since 2.2.0 |
| 579 | 589 | * @access public |
| 580 | 590 | * |
| 581 | 591 | * @param int $uid User ID. |
| @@ -581,9 +591,9 @@ | ||
| 581 | 591 | * @param int $uid User ID. |
| 582 | 592 | * |
| 583 | 593 | * @return string |
| 584 | 594 | */ |
| 585 | - public function __nonce_user_logged_out( $uid ) { | |
| 595 | + public function nonce_user_logged_out( $uid ) { | |
| 586 | 596 | return $this->has_session() && $this->donor_id ? $this->donor_id : $uid; |
| 587 | 597 | } |
| 588 | 598 | |
| 589 | 599 | |
| @@ -590,12 +600,13 @@ | ||
| 590 | 600 | /** |
| 591 | 601 | * Cleanup session data from the database and clear caches. |
| 592 | 602 | * Note: for internal logic only. |
| 593 | 603 | * |
| 604 | + * @since 4.9.0 rename function - PHP 8 compatibility | |
| 594 | 605 | * @since 2.2.0 |
| 595 | 606 | * @access public |
| 596 | 607 | */ |
| 597 | - public function __cleanup_sessions() { // @codingStandardsIgnoreLine | |
| 608 | + public function cleanup_sessions() { // @codingStandardsIgnoreLine | |
| 598 | 609 | Give()->session_db->delete_expired_sessions(); |
| 599 | 610 | } |
| 600 | 611 | |
| 601 | 612 | |
