| @@ -209,9 +209,10 @@ | ||
| 209 | 209 | */ |
| 210 | 210 | public static function get_form_payments( $user_id ) { |
| 211 | 211 | global $wpdb; |
| 212 | 212 | |
| 213 | - $query = $wpdb->prepare( 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments WHERE user_id = %d', $user_id ); | |
| 213 | + $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' . | |
| 214 | + ' WHERE user_id = ' . $user_id; | |
| 214 | 215 | |
| 215 | 216 | $results = $wpdb->get_results( $query ); |
| 216 | 217 | |
| 217 | 218 | return $results; |
| @@ -217,12 +218,9 @@ | ||
| 217 | 218 | return $results; |
| 218 | 219 | } |
| 219 | 220 | |
| 220 | 221 | public static function process_payment_data( $payment_data ) { |
| 221 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 222 | - $field_value = is_serialized( $payment_data->payment_data ) | |
| 223 | - ? @unserialize( $payment_data->payment_data, [ 'allowed_classes' => false ] ) | |
| 224 | - : $payment_data->payment_data; | |
| 222 | + $field_value = unserialize( $payment_data->payment_data ); | |
| 225 | 223 | |
| 226 | 224 | $serialized_value = []; |
| 227 | 225 | $transaction_data = []; |
| 228 | 226 | |
