← All changes | includes/functions.php +4 -5 1.6.27 → 1.6.24 View file →

		@@ -1247,17 +1247,16 @@
1247	1247	*
1248	1248	* @return string
1249	1249	**/
1250	1250	function weforms_get_pain_text( $value ) {
1251		- // Security fix: Removed unsafe unserialize() call to prevent PHP Object Injection.
1252		- // WordPress's get_metadata() already handles deserialization safely.
1253		- // Any serialized strings at this point should be treated as untrusted user input.
	1251	+ if ( is_serialized( $value ) ) {
	1252	+ $value = unserialize( $value );
	1253	+ }
1254	1254
1255	1255	if ( is_array( $value ) ) {
1256	1256	$string_value = [];
1257	1257	foreach ( $value as $key => $single_value ) {
1258		- // Only recursively process arrays, not serialized strings
1259		- if ( is_array( $single_value ) ) {
	1258	+ if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
1260	1259	$single_value = weforms_get_pain_text( $single_value );
1261	1260	}
1262	1261
1263	1262	$single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );