Ticket #17445: 17445.patch

wp-admin/network/site-settings.php

@@ -111 +111 @@
                         $disabled = false;
                         $class = 'all-options';
                         if ( is_serialized( $option->option_value ) ) {
-                                if ( is_serialized_string( $option->option_value ) ) {
-                                        $option->option_value = esc_html( maybe_unserialize( $option->option_value ), 'single' );
+                                if ( _is_serialized_test( 's', $option->option_value ) ) {
+                                        $option->option_value = esc_html( @unserialize( $option->option_value ), 'single' );
                                 } else {
                                         $option->option_value = 'SERIALIZED DATA';
                                         $disabled = true;

wp-admin/options.php

@@ -180 +180 @@
         if ( $option->option_name == '' )
                 continue;
         if ( is_serialized( $option->option_value ) ) {
-                if ( is_serialized_string( $option->option_value ) ) {
+                if ( _is_serialized_test( 's', $option->option_value ) ) {
                         // this is a serialized string, so we should display it
-                        $value = maybe_unserialize( $option->option_value );
+                        $value = @unserialize( $option->option_value );
                         $options_to_update[] = $option->option_name;
                         $class = 'all-options';
                 } else {

wp-includes/functions.php

@@ -276 +276 @@
 }
 
 /**
+ * Check whether serialized data is of a format defined by char.
+ *
+ * Used internally to prevent running is serialized too much.
+ *
+ * @access private
+ * @param string $char to test for, e.g. 's' for strings.
+ * @param mixed $data to test
+ * @param bool $fullcheck (optional) by default, this functions precodnition is, that $data is of such a format that {@see is_serialized()}} has returned true on. Set this parameter to true to perform this precondition check in case not.
+ * @return bool
+ */
+function _is_serialized_test($char, $data, $fullcheck = false) {
+        if ($fullcheck && !is_serialized($data)) {
+                return false;
+        }
+        return $char === strtolower( $data[ strcspn( $data, 'adObisS:"{};' ) ] );
+}
+
+/**
  * Check whether serialized data is of string type.
  *
  * @since 2.0.5

wp-admin/includes/post.php

@@ -719 +719 @@
         $meta = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
         if ( empty($meta) )
                 return false;
-        if ( is_serialized_string( $meta->meta_value ) )
-                $meta->meta_value = maybe_unserialize( $meta->meta_value );
+        if ( _is_serialized_test( 's', $meta->meta_value, true ) )
+                $meta->meta_value = @unserialize( $meta->meta_value );
         return $meta;
 }
 

wp-admin/includes/template.php

@@ -478 +478 @@
                 $style .= ' hidden';
 
         if ( is_serialized( $entry['meta_value'] ) ) {
-                if ( is_serialized_string( $entry['meta_value'] ) ) {
+                if ( _is_serialized_test( 's', $entry['meta_value'] ) ) {
                         // this is a serialized string, so we should display it
-                        $entry['meta_value'] = maybe_unserialize( $entry['meta_value'] );
+                        $entry['meta_value'] = @unserialize( $entry['meta_value'] );
                 } else {
                         // this is a serialized array/object so we should NOT display it
                         --$count;