| @@ -169,12 +169,9 @@ | ||
| 169 | 169 | $value = $new_array; |
| 170 | 170 | } |
| 171 | 171 | } elseif ( in_array( $field['type'], [ 'image_upload', 'file_upload' ] ) ) { |
| 172 | 172 | $file_field = ''; |
| 173 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 174 | - $value = is_serialized( $value ) | |
| 175 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 176 | - : $value; | |
| 173 | + $value = maybe_unserialize( $value ); | |
| 177 | 174 | |
| 178 | 175 | if ( is_array( $value ) && $value ) { |
| 179 | 176 | foreach ( $value as $attachment_id ) { |
| 180 | 177 | if ( $field['type'] == 'image_upload' ) { |
| @@ -198,12 +195,9 @@ | ||
| 198 | 195 | 'lat' => trim( $lat ), |
| 199 | 196 | 'long' => trim( $long ), |
| 200 | 197 | ]; |
| 201 | 198 | } elseif ( $field['type'] == 'multiple_product' ) { |
| 202 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 203 | - $field_value = is_serialized( $value ) | |
| 204 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 205 | - : $value; | |
| 199 | + $field_value = unserialize( $value ); | |
| 206 | 200 | |
| 207 | 201 | $serialized_value = []; |
| 208 | 202 | |
| 209 | 203 | if ( is_array( $field_value ) ) { |
| @@ -223,12 +217,9 @@ | ||
| 223 | 217 | |
| 224 | 218 | $value = implode( '<br> <br> ', $serialized_value ); |
| 225 | 219 | } |
| 226 | 220 | } elseif ( $field['type'] == 'checkbox_grid' ) { |
| 227 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 228 | - $entry_value = is_serialized( $value ) | |
| 229 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 230 | - : $value; | |
| 221 | + $entry_value = unserialize( $value ); | |
| 231 | 222 | |
| 232 | 223 | if ( $entry_value ) { |
| 233 | 224 | $return = ''; |
| 234 | 225 | $check = ''; |
| @@ -289,12 +280,9 @@ | ||
| 289 | 280 | |
| 290 | 281 | $value = $return; |
| 291 | 282 | } |
| 292 | 283 | } elseif ( $field['type'] == 'multiple_choice_grid' ) { |
| 293 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 294 | - $entry_value = is_serialized( $value ) | |
| 295 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 296 | - : $value; | |
| 284 | + $entry_value = unserialize( $value ); | |
| 297 | 285 | |
| 298 | 286 | if ( $entry_value ) { |
| 299 | 287 | $return = ''; |
| 300 | 288 | $check = ''; |
| @@ -355,12 +343,9 @@ | ||
| 355 | 343 | |
| 356 | 344 | $value = $return; |
| 357 | 345 | } |
| 358 | 346 | } elseif ( $field['type'] == 'address_field' || is_serialized( $value ) ) { |
| 359 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 360 | - $field_value = is_serialized( $value ) | |
| 361 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 362 | - : $value; | |
| 347 | + $field_value = unserialize( $value ); | |
| 363 | 348 | |
| 364 | 349 | $serialized_value = []; |
| 365 | 350 | |
| 366 | 351 | if ( is_array( $field_value ) ) { |
