XananasX7 26d7ba4417 security: add allowed_classes => false to Core::safeUnserialize() as defence-in-depth ... Core::safeUnserialize() validates the serialized string with a custom parser before calling unserialize(). The parser only permits scalar types (s, b, i, d, N) and plain arrays (a), blocking object tokens ('O:' / 'C:'). However, the final unserialize() call does not pass allowed_classes, which means a parser bypass or edge-case in the manual tokeniser could still allow object instantiation. Adding allowed_classes => false ensures that even if the manual validator is somehow bypassed (e.g., by a future PHP serialization format change or a subtle parser bug), unserialize() itself will refuse to instantiate PHP objects — providing a second layer of protection. Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>		2026-06-03 10:41:11 -03:00
..
Advisory
Bookmarks	Fix bookmarks not being properly saved	2026-05-22 19:32:03 -03:00
Charsets
Clock
Command
Config	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
ConfigStorage	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Console	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Container
Controllers	Fix bookmarks not being properly saved	2026-05-22 19:32:03 -03:00
Crypto
Database
Dbal	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Display	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Engines	Merge branch 'QA_5_2'	2026-04-09 15:21:25 +02:00
Error
Exceptions
Export	fix: resolve CI failures for phpcs header spacing and phpstan baseline count	2026-04-03 02:19:25 -07:00
Favorites
Gis
Html	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Http	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
I18n
Identifiers
Image
Import	Merge branch 'QA_5_2'	2026-05-09 15:34:12 -03:00
Indexes
Navigation	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Partitioning
Plugins	Merge branch 'QA_5_2'	2026-04-25 19:10:32 -03:00
Properties
Providers/ServerVariables
Query	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Replication
Routing
Server	Merge branch 'QA_5_2'	2026-04-22 20:41:40 -03:00
Setup
Table	Upgrading phpstan/phpstan (2.1.41 => 2.1.47)	2026-04-13 17:15:06 +01:00
Theme
Tracking
Triggers
Twig
Utils
WebAuthn
Application.php
BrowseForeigners.php
Cache.php
Charsets.php
Column.php
Config.php
Core.php	security: add allowed_classes => false to Core::safeUnserialize() as defence-in-depth	2026-06-03 10:41:11 -03:00
CreateAddField.php
Current.php
DbTableExists.php
EditField.php
Encoding.php
FieldMetadata.php
File.php
FileListing.php
FlashMessenger.php
Font.php
Footer.php
Git.php
Header.php	Refactor Header::getMessage()	2026-05-25 18:18:50 -03:00
InsertEdit.php
InsertEditColumn.php
InternalRelations.php
IpAllowDeny.php
Linter.php
ListDatabase.php	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Logging.php
Menu.php
Message.php
MessageType.php
Mime.php
Normalization.php
OpenDocument.php
Operations.php	Merge branch 'QA_5_2'	2026-04-09 15:21:25 +02:00
ParseAnalyze.php
Pdf.php
Plugins.php
Profiling.php
Release.php
ResponseRenderer.php	Clean up config again (#20264)	2026-04-10 16:33:08 -03:00
Sanitize.php	fix: resolve CI failures for phpcs header spacing and phpstan baseline count	2026-04-03 02:19:25 -07:00
Scripts.php
Session.php
ShowGrants.php
Sql.php	Merge branch 'QA_5_2'	2026-04-22 20:41:40 -03:00
SqlQueryForm.php
StorageEngine.php
SystemColumn.php
SystemDatabase.php
Template.php
Transformations.php
TwoFactor.php
TypeClass.php
Types.php	fix: resolve CI failures for phpcs header spacing and phpstan baseline count	2026-04-03 02:19:25 -07:00
UniqueCondition.php
Url.php
UrlParams.php
UrlRedirector.php
UserPassword.php
UserPrivileges.php
UserPrivilegesFactory.php
Util.php
Version.php
VersionInformation.php
ZipExtension.php