← All changes | includes/database/class-give-db-sessions.php +2 -1 4.16.7.1 → 4.17.0 View file →

		@@ -110,8 +110,9 @@
110	110	* Returns the session.
111	111	*
112	112	* @todo: add cache logic
113	113	*
	114	+ * @since 4.16.7.2 Restrict unserialize to prevent object instantiation.
114	115	* @param string $donor_id Donor ID.
115	116	* @param mixed $default Default session value.
116	117	*
117	118	* @return mixed
		@@ -144,9 +145,9 @@
144	145
145	146	wp_cache_add( $donor_id, $value, $this->cache_group );
146	147	}
147	148
148		- return maybe_unserialize( $value );
	149	+ return is_serialized( $value ) ? unserialize( $value, [ 'allowed_classes' => false ] ) : $value;
149	150	}
150	151
151	152	/**
152	153	* Update the session expiry timestamp.