unserialize() is insecure unless allowed classes are limited. Use a safe format like JSON or use the allowed_classes option.

Comments & Activities

Issue created by @arti_parmar
Issue was unassigned.
Status changed to Needs review over 1 year ago1:17pm 28 June 2023
Open in Jenkins → Open on Drupal.org →
Core: 10.1.x + Environment: PHP 8.1 & MySQL 5.7
last update over 1 year ago
132 pass
Comment over 1 year ago →
🇮🇳India arti_parmar
Kindly review patch.
First commit to issue fork.
Merge request !6Issue #3371033 by arti_parmar: Sets allowed_classes to empty on unserialize function → (Merged) created by mradcliffe
Pipeline finished with Skipped
8 months ago
#138770
Comment 8 months ago →
System Message

mradcliffe → committed 4463120b on 4.0.x authored by arti_parmar →
Issue #3371033 by arti_parmar: Sets allowed_classes to empty on...
Status changed to Fixed 8 months ago1:25pm 5 April 2024
Comment 8 months ago →
🇺🇸United States mradcliffe USA
Thanks. Sorry for the delay. I created the issue fork and merge request attributed to you, and merged it in after a review.
Comment 7 months ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

Merge Requests