| @@ -197,8 +197,10 @@ | ||
| 197 | 197 | return false; |
| 198 | 198 | } |
| 199 | 199 | |
| 200 | 200 | /** |
| 201 | + * @since 4.16.7.2 Returns false instead of the raw serialized string when an object is detected | |
| 202 | + * @since 4.16.6 Returns $data when $unserializedData constins __PHP_Incomplete_Class | |
| 201 | 203 | * @since 3.17.2 |
| 202 | 204 | */ |
| 203 | 205 | public static function safeUnserialize($data) |
| 204 | 206 | { |
| @@ -215,19 +217,10 @@ | ||
| 215 | 217 | * this option is the same as defining it as true: PHP will attempt to instantiate objects of any class. |
| 216 | 218 | */ |
| 217 | 219 | $unserializedData = @unserialize(trim($data), ['allowed_classes' => false]); |
| 218 | 220 | |
| 219 | - /** | |
| 220 | - * Never return objects, not even as __PHP_Incomplete_Class instances. When a | |
| 221 | - * __PHP_Incomplete_Class is serialized again, PHP writes the original class bytes | |
| 222 | - * back, so returning it would re-arm the payload for the next unrestricted | |
| 223 | - * unserialize() call (e.g. the donation session storage). In that case, we return | |
| 224 | - * the data as a plain string instead, keeping it inert. | |
| 225 | - * | |
| 226 | - * @since 4.16.6 | |
| 227 | - */ | |
| 228 | 221 | if (self::containsPhpIncompleteClass($unserializedData)) { |
| 229 | - return $data; | |
| 222 | + return false; | |
| 230 | 223 | } |
| 231 | 224 | |
| 232 | 225 | /* |
| 233 | 226 | * In case the passed string is not unserializeable, false is returned. |
