| Server IP : 82.208.35.60 / Your IP : 216.73.216.168 Web Server : Apache/2.4.55 (FreeBSD) OpenSSL/1.1.1q-freebsd PHP/7.3.31 System : FreeBSD server7.d2m.cz 12.4-RELEASE-p9 FreeBSD 12.4-RELEASE-p9 GENERIC amd64 User : studiokobylisy_cz ( 1008) PHP Version : 7.3.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /usr/ports/mail/horde-imp/files/ |
Upload File : |
--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC
+++ lib/Prefs/Sort.php
@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA
{
global $prefs;
- $sortpref = @unserialize($prefs->getValue(self::SORTPREF));
- if (is_array($sortpref)) {
- $this->_sortpref = $sortpref;
+ $serializedPref = $prefs->getValue(self::SORTPREF);
+ // Only unserialize non-empty strings. Disallow yielding any classes.
+ if (!empty($serializedPref && is_string($serializedPref))) {
+ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]);
+ if (is_array($sortpref)) {
+ $this->_sortpref = $sortpref;
+ }
}
}