Changeset 25320

Timestamp:

09/10/2013 06:09:36 PM (11 years ago)

Author:

nacin

Message:

Loose validation for is_serialized() in maybe_serialize().

File:

• trunk/src/wp-includes/functions.php (modified) (4 diffs)

trunk/src/wp-includes/functions.php

@@ -243 +243 @@
  *
  * @param mixed $data Value to check to see if was serialized.
+ * @param bool $strict Optional. Whether to be strict about the end of the string. Defaults true.
  * @return bool False if not serialized and true if it was.
  */
-function is_serialized( $data ) {
+function is_serialized( $data, $strict = true ) {
     // if it isn't a string, it isn't serialized
     if ( ! is_string( $data ) )
@@ -257 +258 @@
     if ( ':' !== $data[1] )
         return false;
-    $lastc = $data[$length-1];
-    if ( ';' !== $lastc && '}' !== $lastc )
-        return false;
+    if ( $strict ) {
+        $lastc = $data[ $length - 1 ];
+        if ( ';' !== $lastc && '}' !== $lastc )
+            return false;
+    } else {
+        // ensures ; or } exists but is not in the first X chars
+        if ( strpos( $data, ';' ) < 3 && strpos( $data, '}' ) < 4 )
+            return false;
+    }
     $token = $data[0];
     switch ( $token ) {
         case 's' :
-            if ( '"' !== $data[$length-2] )
+            if ( $strict ) {
+                if ( '"' !== $data[ $length - 2 ] )
+                    return false;
+            } elseif ( false === strpos( $data, '"' ) ) {
                 return false;
+            }
         case 'a' :
         case 'O' :
@@ -271 +282 @@
         case 'i' :
         case 'd' :
-            return (bool) preg_match( "/^{$token}:[0-9.E-]+;\$/", $data );
+            $end = $strict ? '$' : '';
+            return (bool) preg_match( "/^{$token}:[0-9.E-]+;$end/", $data );
     }
     return false;
@@ -318 +330 @@
     // Double serialization is required for backward compatibility.
     // See http://core.trac.wordpress.org/ticket/12930
-    if ( is_serialized( $data ) )
+    if ( is_serialized( $data, false ) )
         return serialize( $data );