← All changes | src/functions.php +24 -0 3.8.9 → 3.8.11 View file →

		@@ -171,4 +171,28 @@
171	171	}
172	172
173	173	return 'GET' === $request->get_method() && 'edit' === $request->get_param( 'context' );
174	174	}
	175	+
	176	+/**
	177	+ * Unserializes data only if it was serialized.
	178	+ *
	179	+ * Like `maybe_unserialize()` but passes options to `unserialize()`, including
	180	+ * `allowed_classes` to mitigate PHP object injection.
	181	+ *
	182	+ * @since 3.8.11
	183	+ *
	184	+ * @param mixed $data Data that might be unserialized.
	185	+ * @param array $options {
	186	+ * Options for @see unserialize(). Default `array( 'allowed_classes' => false )`.
	187	+ *
	188	+ * @type bool|class-string[] $allowed_classes Whether to allow PHP objects. Default false.
	189	+ * }
	190	+ * @return mixed Unserialized data, or the original value if not serialized.
	191	+ */
	192	+function pll_maybe_unserialize( $data, array $options = array( 'allowed_classes' => false ) ) {
	193	+ if ( ! is_string( $data ) || ! is_serialized( $data ) ) {
	194	+ return $data;
	195	+ }
	196	+
	197	+ return unserialize( trim( $data ), $options ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize, PHPCompatibility.FunctionUse.NewFunctionParameters.unserialize_optionsFound
	198	+}