fix: accept no classes for unserialize()

codeigniter4 · Oct 3, 2023 · a349acd · a349acd
1 parent 639e442
commit a349acd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/system/Entity/Cast/ArrayCast.php b/system/Entity/Cast/ArrayCast.php
@@ -26,7 +26,7 @@ public static function fromDatabase($value, array $params = []): array
  }
 
  if ((strpos($value, 'a:') === 0 || strpos($value, 's:') === 0)) {
- $value = unserialize($value);
+ $value = unserialize($value, ['allowed_classes' => false]);
  }
 
  return (array) $value;