Skip to content

Commit f936d45

Browse files
AngelFQCAngelFQC
committed
Use brumann/polyfill-unserialize to unserialize content
1 parent 7756aae commit f936d45

26 files changed

+361
-39
lines changed

‎main/admin/career_diagram.php

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@
1414
ALTER TABLE extra_field_values modify column value longtext null;
1515
*/
1616

17+
use Brumann\Polyfill\Unserialize;
18+
use Fhaculty\Graph\Graph;
19+
use Fhaculty\Graph\Set\Edges;
20+
use Fhaculty\Graph\Set\Vertices;
21+
use Fhaculty\Graph\Set\VerticesMap;
22+
1723
$cidReset = true;
1824
require_once __DIR__.'/../inc/global.inc.php';
1925

@@ -106,7 +112,18 @@
106112
$tpl = new Template(get_lang('Diagram'));
107113
$html = Display::page_subheader2($careerInfo['name'].$urlToString);
108114
if (!empty($item) && isset($item['value']) && !empty($item['value'])) {
109-
$graph = unserialize($item['value']);
115+
/** @var Graph $graph */
116+
$graph = Unserialize::unserialize(
117+
$item['value'],
118+
[
119+
'allowed_classes' => [
120+
Graph::class,
121+
VerticesMap::class,
122+
Vertices::class,
123+
Edges::class
124+
],
125+
]
126+
);
110127
$html .= Career::renderDiagramByColumn($graph, $tpl);
111128
} else {
112129
Display::addFlash(

‎main/admin/gradebook_list.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use Chamilo\CoreBundle\Entity\GradebookCategory;
56
use Doctrine\Common\Collections\Criteria;
67
use Knp\Component\Pager\Paginator;
@@ -188,7 +189,10 @@
188189

189190
$options = [];
190191
if (!empty($categoryData['depends'])) {
191-
$list = unserialize($categoryData['depends']);
192+
$list = Unserialize::unserialize(
193+
$categoryData['depends'],
194+
['allowed_classes' => false]
195+
);
192196
foreach ($list as $itemId) {
193197
$courseInfo = api_get_course_info_by_id($itemId);
194198
$options[$itemId] = $courseInfo['name'];

‎main/auth/sso/sso.Drupal.class.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use ChamiloSession as Session;
56

67
/**
@@ -293,6 +294,9 @@ public function generateProfileEditingURL($userId = 0, $asAdmin = false)
293294
*/
294295
private function decode_cookie($cookie)
295296
{
296-
return unserialize(base64_decode($cookie));
297+
return Unserialize::unserialize(
298+
base64_decode($cookie),
299+
['allowed_classes' => false]
300+
);
297301
}
298302
}

‎main/auth/sso/sso.class.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use ChamiloSession as Session;
56

67
/**
@@ -296,6 +297,9 @@ public function generateProfileEditingURL($userId = 0, $asAdmin = false)
296297
*/
297298
private function decode_cookie($cookie)
298299
{
299-
return unserialize(base64_decode($cookie));
300+
return Unserialize::unserialize(
301+
base64_decode($cookie),
302+
['allowed_classes' => false]
303+
);
300304
}
301305
}

‎main/course_home/course_home.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use ChamiloSession as Session;
6+
use Fhaculty\Graph\Graph;
7+
use Fhaculty\Graph\Set\Edges;
8+
use Fhaculty\Graph\Set\Vertices;
9+
use Fhaculty\Graph\Set\VerticesMap;
510

611
/**
712
* HOME PAGE FOR EACH COURSE.
@@ -392,7 +397,12 @@
392397
);
393398

394399
if (!empty($item) && isset($item['value']) && !empty($item['value'])) {
395-
$graph = unserialize($item['value']);
400+
$graph = Unserialize::unserialize(
401+
$item['value'],
402+
[
403+
'allowed_classes' => [Graph::class, VerticesMap::class, Vertices::class, Edges::class],
404+
]
405+
);
396406
$diagram = Career::renderDiagram($careerInfo, $graph);
397407
}
398408
}

‎main/exercise/hotspot_admin.inc.php

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use ChamiloSession as Session;
56

67
/**
@@ -56,13 +57,14 @@
5657
$objAnswer = new Answer($questionId);
5758
}
5859

59-
$color = unserialize($color);
60-
$reponse = unserialize($reponse);
61-
$comment = unserialize($comment);
62-
$weighting = unserialize($weighting);
63-
$hotspot_coordinates = unserialize($hotspot_coordinates);
64-
$hotspot_type = unserialize($hotspot_type);
65-
$destination = unserialize($destination);
60+
$color = Unserialize::unserialize($color, ['allowed_classes' => false]);
61+
$reponse = Unserialize::unserialize($reponse, ['allowed_classes' => false]);
62+
$comment = Unserialize::unserialize($comment, ['allowed_classes' => false]);
63+
$comment = Unserialize::unserialize($comment, ['allowed_classes' => false]);
64+
$weighting = Unserialize::unserialize($weighting, ['allowed_classes' => false]);
65+
$hotspot_coordinates = Unserialize::unserialize($hotspot_coordinates, ['allowed_classes' => false]);
66+
$hotspot_type = Unserialize::unserialize($hotspot_type, ['allowed_classes' => false]);
67+
$destination = Unserialize::unserialize($destination, ['allowed_classes' => false]);
6668
unset($buttonBack);
6769
}
6870

‎main/exercise/question.class.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use Chamilo\CourseBundle\Entity\CQuizAnswer;
56

67
/**
@@ -1145,7 +1146,10 @@ public function search_engine_edit(
11451146
$se_doc = $di->get_document((int) $se_ref['search_did']);
11461147
if ($se_doc !== false) {
11471148
if (($se_doc_data = $di->get_document_data($se_doc)) !== false) {
1148-
$se_doc_data = unserialize($se_doc_data);
1149+
$se_doc_data = Unserialize::unserialize(
1150+
$se_doc_data,
1151+
['allowed_classes' => false]
1152+
);
11491153
if (isset($se_doc_data[SE_DATA]['type']) &&
11501154
$se_doc_data[SE_DATA]['type'] == SE_DOCTYPE_EXERCISE_QUESTION
11511155
) {

‎main/exercise/upload_exercise.php

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use ChamiloSession as Session;
56

67
/**
@@ -548,7 +549,20 @@ function lp_upload_quiz_action_handling()
548549
$lpObject = Session::read('lpobject');
549550

550551
if (!empty($lpObject)) {
551-
$oLP = unserialize($lpObject);
552+
/** @var learnpath $oLP */
553+
$oLP = Unserialize::unserialize(
554+
$lpObject,
555+
[
556+
'allowed_classes' => [
557+
learnpath::class,
558+
learnpathItem::class,
559+
aiccItem::class,
560+
scormItem::class,
561+
Link::class,
562+
LpItem::class,
563+
],
564+
]
565+
);
552566
if (is_object($oLP)) {
553567
if ((empty($oLP->cc)) || $oLP->cc != api_get_course_id()) {
554568
$oLP = null;

‎main/extra/upgrade_school_calendar.php

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
/* For licensing terms, see /license.txt */
33

44
// not used??
5+
use Brumann\Polyfill\Unserialize;
6+
57
exit;
68

79
require_once '../inc/global.inc.php';
@@ -28,6 +30,11 @@
2830
$d_number = (int) $d_number;
2931
$sql4 = "UPDATE set_module SET cal_day_num = $d_number WHERE id = $d_id ";
3032
Database::query($sql4);
31-
print_r(unserialize(Security::remove_XSS($_POST['aaa'])));
33+
print_r(
34+
Unserialize::unserialize(
35+
Security::remove_XSS($_POST['aaa']),
36+
['allowed_classes' => false]
37+
)
38+
);
3239

3340
Display::display_footer();

‎main/gradebook/lib/be/category.class.php

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?php
22
/* For licensing terms, see /license.txt */
33

4+
use Brumann\Polyfill\Unserialize;
45
use Chamilo\CoreBundle\Entity\GradebookCategory;
56
use ChamiloSession as Session;
67

@@ -264,12 +265,16 @@ public function setIsRequirement($isRequirement)
264265
*/
265266
public function setCourseListDependency($value)
266267
{
267-
$result = [];
268-
if (@unserialize($value) !== false) {
269-
$result = unserialize($value);
270-
}
268+
$this->courseDependency = [];
271269

272-
$this->courseDependency = $result;
270+
$unserialized = @Unserialize::unserialize(
271+
$value,
272+
['allowed_classes' => false]
273+
);
274+
275+
if (false !== $unserialized) {
276+
$this->courseDependency = $unserialized;
277+
}
273278
}
274279

275280
/**

0 commit comments

Comments
 (0)