Changeset 4382 for trunk/wp-includes/functions.php

Timestamp:

10/12/2006 11:54:36 PM (19 years ago)

Author:

markjaquith

Message:

Prevent users from entering strings that will be interpreted as serialized arrays/objects on the way out. fixes #2591

File:

• trunk/wp-includes/functions.php (modified) (4 diffs)

trunk/wp-includes/functions.php

@@ -157 +157 @@
 
 function maybe_unserialize($original) {
-    if ( false !== $gm = @ unserialize($original) )
-        return $gm;
-    else
-        return $original;
+    if ( is_serialized($original) ) // don't attempt to unserialize data that wasn't serialized going in
+        if ( false !== $gm = @ unserialize($original) )
+            return $gm;
+    return $original;
+}
+
+function is_serialized($data) {
+    if ( !is_string($data) ) // if it isn't a string, it isn't serialized
+        return false;
+    $data = trim($data);
+    if ( preg_match("/^[adobis]:[0-9]+:.*[;}]/si",$data) ) // this should fetch all legitimately serialized data
+        return true;
+    return false;
+}
+
+function is_serialized_string($data) {
+    if ( !is_string($data) ) // if it isn't a string, it isn't a serialized string
+        return false;
+    $data = trim($data);
+    if ( preg_match("/^s:[0-9]+:.*[;}]/si",$data) ) // this should fetch all serialized strings
+        return true;
+    return false;
 }
 
@@ -240 +258 @@
 
     $_newvalue = $newvalue;
-    if ( is_array($newvalue) || is_object($newvalue) )
-        $newvalue = serialize($newvalue);
+    $newvalue = prepare_data($newvalue);
 
     wp_cache_set($option_name, $newvalue, 'options');
@@ -263 +280 @@
         return;
 
-    if ( is_array($value) || is_object($value) )
-        $value = serialize($value);
+    $value = prepare_data($value);
 
     wp_cache_set($name, $value, 'options');
@@ -284 +300 @@
     wp_cache_delete($name, 'options');
     return true;
+}
+
+function prepare_data($data) {
+    if ( is_string($data) )
+        $data = trim($data);
+    elseif ( is_array($data) || is_object($data) )
+        return serialize($data);
+    if ( is_serialized($data) )
+        return serialize($data);
+    return $data;
 }