| @@ -568,13 +568,12 @@ | ||
| 568 | 568 | } |
| 569 | 569 | } |
| 570 | 570 | |
| 571 | 571 | // Fall back to the legacy serialised _give_payment_meta blob. |
| 572 | - if ( isset( $meta['_give_payment_meta'] ) && is_string( $meta['_give_payment_meta'] ) ) { | |
| 573 | - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize -- GiveWP-controlled payload, options=false to block class instantiation. | |
| 574 | - $unserialised = is_serialized( $meta['_give_payment_meta'] ) | |
| 575 | - ? maybe_unserialize( $meta['_give_payment_meta'] ) | |
| 576 | - : null; | |
| 572 | + if ( isset( $meta['_give_payment_meta'] ) && is_string( $meta['_give_payment_meta'] ) && is_serialized( $meta['_give_payment_meta'] ) ) { | |
| 573 | + // allowed_classes=false blocks PHP object injection (CWE-502) on the GiveWP-controlled payload; @ suppresses notices on malformed-but-is_serialized() input (result is validated below). | |
| 574 | + // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize, WordPress.PHP.NoSilencedErrors.Discouraged -- hardened native unserialize with class instantiation disabled. | |
| 575 | + $unserialised = @unserialize( $meta['_give_payment_meta'], [ 'allowed_classes' => false ] ); | |
| 577 | 576 | if ( is_array( $unserialised ) && isset( $unserialised['price'] ) && is_numeric( $unserialised['price'] ) ) { |
| 578 | 577 | return (float) $unserialised['price']; |
| 579 | 578 | } |
| 580 | 579 | } |
