| @@ -620,9 +620,9 @@ | ||
| 620 | 620 | continue; |
| 621 | 621 | } |
| 622 | 622 | |
| 623 | 623 | $data[ $field['name'] ] = [ |
| 624 | - 'label' => $field['label'] ?? '', | |
| 624 | + 'label' => $field['label'], | |
| 625 | 625 | 'type' => $field['template'], |
| 626 | 626 | ]; |
| 627 | 627 | } |
| 628 | 628 | |
| @@ -714,9 +714,8 @@ | ||
| 714 | 714 | $u_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : ''; |
| 715 | 715 | $bname = 'Unknown'; |
| 716 | 716 | $platform = 'Unknown'; |
| 717 | 717 | $version = ''; |
| 718 | - $ub = ''; | |
| 719 | 718 | |
| 720 | 719 | // first get the platform |
| 721 | 720 | if ( preg_match( '/linux/i', $u_agent ) ) { |
| 722 | 721 | $platform = 'Linux'; |
| @@ -1248,17 +1247,16 @@ | ||
| 1248 | 1247 | * |
| 1249 | 1248 | * @return string |
| 1250 | 1249 | **/ |
| 1251 | 1250 | function weforms_get_pain_text( $value ) { |
| 1252 | - // Security fix: Removed unsafe unserialize() call to prevent PHP Object Injection. | |
| 1253 | - // WordPress's get_metadata() already handles deserialization safely. | |
| 1254 | - // Any serialized strings at this point should be treated as untrusted user input. | |
| 1251 | + if ( is_serialized( $value ) ) { | |
| 1252 | + $value = unserialize( $value ); | |
| 1253 | + } | |
| 1255 | 1254 | |
| 1256 | 1255 | if ( is_array( $value ) ) { |
| 1257 | 1256 | $string_value = []; |
| 1258 | 1257 | foreach ( $value as $key => $single_value ) { |
| 1259 | - // Only recursively process arrays, not serialized strings | |
| 1260 | - if ( is_array( $single_value ) ) { | |
| 1258 | + if ( is_array( $single_value ) || is_serialized( $single_value ) ) { | |
| 1261 | 1259 | $single_value = weforms_get_pain_text( $single_value ); |
| 1262 | 1260 | } |
| 1263 | 1261 | |
| 1264 | 1262 | $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value ); |
