Changeset 25325 for branches/3.6/wp-includes/functions.php

Timestamp:

09/10/2013 06:43:51 PM (13 years ago)

Author:

nacin

Message:

Loose validation for is_serialized() in maybe_serialize(). Merges [25320] to 3.6.

Location:

branches/3.6

Files:

• . (modified) (1 prop)
• wp-includes/functions.php (modified) (4 diffs)

branches/3.6/wp-includes/functions.php

@@ -243 +243 @@
  *
  * @param mixed $data Value to check to see if was serialized.
+ * @param bool $strict Optional. Whether to be strict about the end of the string. Defaults true.
  * @return bool False if not serialized and true if it was.
  */
-function is_serialized( $data ) {
+function is_serialized( $data, $strict = true ) {
         // if it isn't a string, it isn't serialized
         if ( ! is_string( $data ) )
@@ -257 +258 @@
         if ( ':' !== $data[1] )
                 return false;
-        $lastc = $data[$length-1];
-        if ( ';' !== $lastc && '}' !== $lastc )
-                return false;
+        if ( $strict ) {
+                $lastc = $data[ $length - 1 ];
+                if ( ';' !== $lastc && '}' !== $lastc )
+                        return false;
+        } else {
+                // ensures ; or } exists but is not in the first X chars
+                if ( strpos( $data, ';' ) < 3 && strpos( $data, '}' ) < 4 )
+                        return false;
+        }
         $token = $data[0];
         switch ( $token ) {
                 case 's' :
-                        if ( '"' !== $data[$length-2] )
+                        if ( $strict ) {
+                                if ( '"' !== $data[ $length - 2 ] )
+                                        return false;
+                        } elseif ( false === strpos( $data, '"' ) ) {
                                 return false;
+                        }
                 case 'a' :
                 case 'O' :
@@ -271 +282 @@
                 case 'i' :
                 case 'd' :
-                        return (bool) preg_match( "/^{$token}:[0-9.E-]+;\$/", $data );
+                        $end = $strict ? '$' : '';
+                        return (bool) preg_match( "/^{$token}:[0-9.E-]+;$end/", $data );
         }
         return false;
@@ -318 +330 @@
         // Double serialization is required for backward compatibility.
         // See http://core.trac.wordpress.org/ticket/12930
-        if ( is_serialized( $data ) )
+        if ( is_serialized( $data, false ) )
                 return serialize( $data );