Skip to content

Commit

Permalink
fix: array_map missing callback
Browse files Browse the repository at this point in the history
  • Loading branch information
glaubersilva committed Sep 9, 2024
1 parent 7b3d09b commit 2ef2d39
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 4 deletions.
6 changes: 3 additions & 3 deletions includes/admin/admin-actions.php
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
<?php

use Give\Framework\Database\DB;
use Give\Helpers\Utils;
use Give\Log\ValueObjects\LogType;

/**
Expand Down Expand Up @@ -680,6 +681,7 @@ function showReactTable () {
/**
* Avoid insecure usage of `unserialize` when the data could be submitted by the user.
*
* @since 3.16.1 Use Utils::giveMaybeSafeUnserialize() method
* @since 3.5.0
*
* @param string $data Data that might be unserialized.
Expand All @@ -688,9 +690,7 @@ function showReactTable () {
*/
function give_maybe_safe_unserialize($data)
{
return is_serialized($data)
? @unserialize(trim($data), ['allowed_classes' => false])
: $data;
return Utils::maybeSafeUnserialize($data);
}

/**
Expand Down
2 changes: 1 addition & 1 deletion includes/process-donation.php
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ function give_process_donation_form() {
);

// Setup donation information.
$user_info = array_map('give_maybe_safe_unserialize', stripslashes_deep( $user_info ));
$user_info = array_map('\Give\Helpers\Utils::maybeSafeUnserialize', stripslashes_deep( $user_info ));
$donation_data = [
'price' => $price,
'purchase_key' => $purchase_key,
Expand Down
16 changes: 16 additions & 0 deletions src/Helpers/Utils.php
Original file line number Diff line number Diff line change
Expand Up @@ -111,4 +111,20 @@ public static function isPluginActive($plugin)

return is_plugin_active($plugin);
}

/**
* Avoid insecure usage of `unserialize` when the data could be submitted by the user.
*
* @since 3.16.1
*
* @param string $data Data that might be unserialized.
*
* @return mixed Unserialized data can be any type.
*/
public static function maybeSafeUnserialize($data)
{
return is_serialized($data)
? @unserialize(trim($data), ['allowed_classes' => false])
: $data;
}
}

0 comments on commit 2ef2d39

Please sign in to comment.