← All changes | inc/duplicate-form.php +11 -1 0.0.1 → 1.1.0 View file →

		@@ -105,9 +105,19 @@
105	105	continue;
106	106	}
107	107
108	108	if ( is_array( $meta_values ) && isset( $meta_values[0] ) ) {
109		- $meta_value = maybe_unserialize( $meta_values[0] );
	109	+ $raw_meta_value = $meta_values[0];
	110	+ // The is_serialized() guard preserves maybe_unserialize()'s pass-through for non-serialized values.
	111	+ // Serialized objects are intentionally NOT rehydrated (allowed_classes=false): object-valued meta would
	112	+ // copy as __PHP_Incomplete_Class, but suredonation_form meta is only arrays/scalars/JSON, so none exists.
	113	+ if ( is_serialized( $raw_meta_value ) ) {
	114	+ // allowed_classes=false blocks PHP object injection (CWE-502) when rehydrating copied meta; @ suppresses notices on malformed input.
	115	+ // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize, WordPress.PHP.NoSilencedErrors.Discouraged -- hardened native unserialize with class instantiation disabled.
	116	+ $meta_value = @unserialize( $raw_meta_value, [ 'allowed_classes' => false ] );
	117	+ } else {
	118	+ $meta_value = $raw_meta_value;
	119	+ }
110	120	add_post_meta( $new_form_id, $meta_key, $meta_value );
111	121	}
112	122	}
113	123	}