| @@ -28,36 +28,8 @@ | ||
| 28 | 28 | */ |
| 29 | 29 | public $data = null; |
| 30 | 30 | |
| 31 | 31 | /** |
| 32 | - * Derived/formatted stats & metadata used by admin/AJAX/API responses. | |
| 33 | - * Declared explicitly to avoid PHP 8.2 "dynamic property" deprecations. | |
| 34 | - * | |
| 35 | - * @var int | |
| 36 | - */ | |
| 37 | - public $entries = 0; | |
| 38 | - | |
| 39 | - /** | |
| 40 | - * @var array | |
| 41 | - */ | |
| 42 | - public $settings = []; | |
| 43 | - | |
| 44 | - /** | |
| 45 | - * @var int | |
| 46 | - */ | |
| 47 | - public $views = 0; | |
| 48 | - | |
| 49 | - /** | |
| 50 | - * @var int | |
| 51 | - */ | |
| 52 | - public $payments = 0; | |
| 53 | - | |
| 54 | - /** | |
| 55 | - * @var array | |
| 56 | - */ | |
| 57 | - public $author = []; | |
| 58 | - | |
| 59 | - /** | |
| 60 | 32 | * Form fields |
| 61 | 33 | * |
| 62 | 34 | * @var array |
| 63 | 35 | */ |
| @@ -125,12 +97,9 @@ | ||
| 125 | 97 | |
| 126 | 98 | $form_fields = []; |
| 127 | 99 | |
| 128 | 100 | foreach ( $fields as $key => $content ) { |
| 129 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 130 | - $field = is_serialized( $content->post_content ) | |
| 131 | - ? @unserialize( $content->post_content, [ 'allowed_classes' => false ] ) | |
| 132 | - : $content->post_content; | |
| 101 | + $field = maybe_unserialize( $content->post_content ); | |
| 133 | 102 | |
| 134 | 103 | if ( empty( $field['template'] ) ) { |
| 135 | 104 | continue; |
| 136 | 105 | } |
