| @@ -3190,9 +3190,13 @@ | ||
| 3190 | 3190 | $is_base64 = $shipping_table ? ( $shipping_table['_is_base64'] ?? false) : false; |
| 3191 | 3191 | |
| 3192 | 3192 | if (is_array($shipping_table) && isset($shipping_table[$key])) { |
| 3193 | 3193 | $decoded = $is_base64 ? @base64_decode($shipping_table[$key]) : $shipping_table[$key]; |
| 3194 | - $shipping_rate = $decoded ? @unserialize($decoded) : null; | |
| 3194 | + | |
| 3195 | + // Ensure no shop manager has injected an evil object (that they would have had to add as a plugin) here. IOK 2026-09-18 | |
| 3196 | + $shipping_rate = $decoded ? @unserialize($decoded, ['allowed_classes' => [WC_Shipping_Rate::class]]) : null; | |
| 3197 | + $shipping_rate = is_a($shipping_rate,'WC_Shipping_Rate') ? $shipping_rate : null; | |
| 3198 | + | |
| 3195 | 3199 | if (!$shipping_rate) { |
| 3196 | 3200 | $this->log(sprintf(__("%1\$s: Could not deserialize the chosen shipping method %2\$s for order %3\$d", 'woo-vipps'), Vipps::ExpressCheckoutName(), $method, $order->get_id()), 'error'); |
| 3197 | 3201 | $this->log(sprintf(__("Serialized data was %1\$s", 'woo-vipps'), $decoded), 'error'); |
| 3198 | 3202 | } else { |
| @@ -3867,9 +3871,9 @@ | ||
| 3867 | 3871 | |
| 3868 | 3872 | $contents = WC()->cart->get_cart_contents(); |
| 3869 | 3873 | $contents = apply_filters('woo_vipps_create_express_checkout_cart_contents',$contents); |
| 3870 | 3874 | try { |
| 3871 | - $cart_hash = md5(json_encode(wc_clean($contents)) . WC()->cart->total); | |
| 3875 | + $cart_hash = WC()->cart->get_cart_hash(); | |
| 3872 | 3876 | $order = new WC_Order(); |
| 3873 | 3877 | $order->set_status('pending'); |
| 3874 | 3878 | $order->set_payment_method($this); |
| 3875 | 3879 | if ($ischeckout) { |
| @@ -3880,8 +3884,9 @@ | ||
| 3880 | 3884 | } |
| 3881 | 3885 | // We use 'checkout' as the created_via key as per requests, but allow merchants to use their own. IOK 2022-09-15 |
| 3882 | 3886 | $created_via = apply_filters('woo_vipps_express_checkout_created_via', 'checkout', $order, $ischeckout); |
| 3883 | 3887 | $order->set_created_via($created_via); |
| 3888 | + $order->set_cart_hash($cart_hash); | |
| 3884 | 3889 | |
| 3885 | 3890 | $dummy = sprintf(__('Vipps Express Checkout', 'woo-vipps')); // this is so gettext will find this string. |
| 3886 | 3891 | $dummy = sprintf(__('Vipps Checkout', 'woo-vipps')); // this is so gettext will find this string. |
| 3887 | 3892 | |
