Convert settings from serialize to json_encode

Attaching a patch with this one-line change.

Accidentally included the ['user_list'] in the previous patch.

Content Access is specifically mentioned in the security advisory for ACL 1.4: https://www.drupal.org/sa-contrib-2023-034 →

I maintain the Backdrop version and what I've done there is along the lines of what ACL has done in switching from using `serialize` to `json_encode` -- so it requires an update hook to convert any Content Access settings saved in the database from serialization to json_encoding, as well.

Here's the relevant commit: https://github.com/backdrop-contrib/content_access/commit/4a45c548414df6...

Would you consider expanding this issue and patch to include that sort of change for security hardening?

Ultimately that decision rests with the module maintainers. But this seems like a sensible change to me.

It would maintain a bit of feature parity as far as how data is encoded for ACL and content_access.

It's also safer from a security standpoint since serialize()/unserialize() is prone to remote code execution vulnerabilities.

@laryn would you like to contribute your patch or do you want me to?

I am the module maintainer, and I intend to upgrade as soon as there is a RTBC patch.

Changing status.

I'm attaching my attempt at porting a patch from commit mentioned in comment #4.

Thanks @gresko8! The patch looks good and applies cleanly.

@hargobind, are you able to do some testing on your sites?

I think that issue priority should be higher because without that patch access page is broken for every single node.
#8 patch seems to fix that issue.

Patch in comment #8 committed.
Proceeding to create a new release 7.x-1.3.

Wonderful. Thank you all!

Please don't set status "Closed (fixed)" manually. An issue with the status "Fixed" will be automatically closed as fixed and removed from the list of open issues after 14 days. It should remain open for 14 days after being "Fixed" to cater for regressions and other unintended consequences of the fix.

For reference, please see item #11 on the list of things not to do in issues on this page: Issue Etiquette → .

Automatically closed - issue fixed for 2 weeks with no activity.