tml_maybe_unserialize_no_objects() – Theme My Login Documentation

Function

Unserialize a value if it is serialized, without allowing any objects.

Behaves like maybe_unserialize(), except it restricts unserialization to plain arrays/scalars so a tampered store response can't instantiate an object and trigger a PHP object injection gadget chain.

tml_maybe_unserialize_no_objects( mixed $value )

Parameters

$value mixed: The value to unserialize.

Return

mixed The unserialized value, or the original value if it wasn't serialized.

Source

function tml_maybe_unserialize_no_objects( $value ) {
    if ( is_serialized( $value ) ) {
        return unserialize( $value, array( 'allowed_classes' => false ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize -- allowed_classes is set to disable object injection.
    }

    return $value;
}

View src/includes/extensions.php, line 349 on GitHub

Uses

Used by

Changelog

Version	Description
7.2.1	Introduced.