| @@ -3192,9 +3192,10 @@ | ||
| 3192 | 3192 | if (is_array($shipping_table) && isset($shipping_table[$key])) { |
| 3193 | 3193 | $decoded = $is_base64 ? @base64_decode($shipping_table[$key]) : $shipping_table[$key]; |
| 3194 | 3194 | |
| 3195 | 3195 | // Ensure no shop manager has injected an evil object (that they would have had to add as a plugin) here. IOK 2026-09-18 |
| 3196 | - $shipping_rate = $decoded ? @unserialize($decoded, ['allowed_classes' => [WC_Shipping_Rate::class]]) : null; | |
| 3196 | + $allowed_classes = apply_filters('woo_vipps_express_checkout_allowed_shipping_classes', [WC_Shipping_Rate::class, \stdClass::class]); | |
| 3197 | + $shipping_rate = $decoded ? @unserialize($decoded, ['allowed_classes' => $allowed_classes]) : null; | |
| 3197 | 3198 | $shipping_rate = is_a($shipping_rate,'WC_Shipping_Rate') ? $shipping_rate : null; |
| 3198 | 3199 | |
| 3199 | 3200 | if (!$shipping_rate) { |
| 3200 | 3201 | $this->log(sprintf(__("%1\$s: Could not deserialize the chosen shipping method %2\$s for order %3\$d", 'woo-vipps'), Vipps::ExpressCheckoutName(), $method, $order->get_id()), 'error'); |
