#4954 Security enhancements

inc/classes/BxDolScore.php

@@ -574,14 +574,14 @@ class BxDolScore extends BxDolObject
         if(empty($aParams) || !is_array($aParams))
             return '';
 
-        return urlencode(base64_encode(serialize($aParams)));
+        return urlencode(base64_encode(json_encode($aParams)));
     }
 
     protected function _decodeElementParams($sParams, $bMergeWithDefaults = true)
     {
         $aParams = array();
         if(!empty($sParams))
-            $aParams = unserialize(base64_decode(urldecode($sParams)));
+            $aParams = json_decode(base64_decode(urldecode($sParams)), true);
 
         if(empty($aParams) || !is_array($aParams))
             $aParams = array();

inc/utils.inc.php

@@ -2720,4 +2720,48 @@ function bx_api_get_browse_params($sParams, $bParamsOnly = false)
 
     return $aParams['params'];
 }
+
+function bx_is_serialized_safe($str) 
+{
+    if (!is_string($str))
+        return false;
+    
+    $str = trim($str);
+    if ($str === 'N;')
+        return true; // null
+    
+    if (!preg_match('/^([adObis]):[0-9]+:/', $str, $matches))
+        return false;
+    
+    $type = $matches[1];
+    
+    // allow only base types, exclude objects (O) are references (r, R)
+    $allowedTypes = ['a', 's', 'i', 'd', 'b'];
+    if (!in_array($type, $allowedTypes))
+        return false;
+    
+    try {
+        $unserialized = unserialize($str);
+        return true;
+    } catch (Exception $e) {
+        return false;
+    }
+}
+
+
+function bx_is_serialized($string) 
+{
+    if (!is_string($string))
+        return false;
+    
+    $string = trim($string);
+
+    // base types    
+    if ($string === 'N;') return true; // null
+    if ($string === 'b:0;' || $string === 'b:1;') return true; // boolean
+    
+    // other types
+    return preg_match('/^([adObis]):[0-9]+:/', $string) === 1;
+}
+
 /** @} */

modules/boonex/convos/classes/BxCnvFormEntry.php

@@ -195,7 +195,7 @@ class BxCnvFormEntry extends BxBaseModTextFormEntry
 
         $sEt = bx_get('et');
         if($sEt !== false) { // if 'attachable email template' was specified, process it
-            $aEt = unserialize(base64_decode(urldecode($sEt)));
+            $aEt = json_decode(base64_decode(urldecode($sEt)), true);
 
             if(!empty($aEt) && is_array($aEt) && !empty($aEt['name'])) {
                 $sName = bx_process_input($aEt['name']);

modules/boonex/payment/classes/BxPaymentConfig.php

@@ -227,12 +227,12 @@ class BxPaymentConfig extends BxBaseModPaymentConfig
 
     public function a2s($a)
     {
-        return base64_encode(serialize($a));
+        return base64_encode(json_encode($a));
     }
 
     public function s2a($s)
     {
-        return unserialize(base64_decode($s));
+        return json_decode(base64_decode($s), true);
     }
 
     public function urlEncode($s)

modules/boonex/payment/classes/BxPaymentModule.php

@@ -517,7 +517,7 @@ class BxPaymentModule extends BxBaseModPaymentModule
 
         $aCustom = array();
         if(!empty($sCustom)) {
-            $aCustom = unserialize(base64_decode($sCustom));
+            $aCustom = json_decode(base64_decode($sCustom), true);
             if(empty($aCustom) || !is_array($aCustom))
                 $aCustom = array();
         }
@@ -557,7 +557,7 @@ class BxPaymentModule extends BxBaseModPaymentModule
 
         $aCustom = array();
         if(!empty($sCustom)) {
-            $aCustom = unserialize(base64_decode($sCustom));
+            $aCustom = json_decode(base64_decode($sCustom), true);
             if(empty($aCustom) || !is_array($aCustom))
                 $aCustom = array();
         }
@@ -608,7 +608,7 @@ class BxPaymentModule extends BxBaseModPaymentModule
 
         $aCustom = array();
         if(!empty($sCustom)) {
-            $aCustom = unserialize(base64_decode($sCustom));
+            $aCustom = json_decode(base64_decode($sCustom), true);
             if(empty($aCustom) || !is_array($aCustom))
                 $aCustom = array();
         }
@@ -1763,7 +1763,7 @@ class BxPaymentModule extends BxBaseModPaymentModule
                 'iItemCount' => $iItemCount,
                 'sItemAddons' => $sItemAddons,
                 'sRedirect' => $sRedirect,
-                'sCustom' => base64_encode(serialize($aCustom))
+                'sCustom' => base64_encode(json_encode($aCustom))
             );
 
             $aCartInfo = $this->getObjectCart()->getInfo(BX_PAYMENT_TYPE_RECURRING, $iClientId, $iSellerId, $this->_oConfig->descriptorA2S($aCartItem));

modules/boonex/payment/classes/BxPaymentTemplate.php

@@ -99,7 +99,7 @@ class BxPaymentTemplate extends BxBaseModPaymentTemplate
             'item_id' => $iItemId,
             'item_count' => $iItemCount,
             'need_redirect' => (int)$bNeedRedirect,
-            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(serialize($aCustom)) : ''
+            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(json_encode($aCustom)) : ''
         ));
 
         return array($sJsCode, $sJsMethod);
@@ -117,7 +117,7 @@ class BxPaymentTemplate extends BxBaseModPaymentTemplate
             'item_id' => $iItemId,
             'item_count' => $iItemCount,
             'need_redirect' => (int)$bNeedRedirect,
-            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(serialize($aCustom)) : ''
+            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(json_encode($aCustom)) : ''
         ));
     }
 
@@ -146,7 +146,7 @@ class BxPaymentTemplate extends BxBaseModPaymentTemplate
                 'item_id' => $iItemId,
                 'item_count' => $iItemCount,
                 'redirect' => !empty($sRedirect) ? $sRedirect : '',
-                'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(serialize($aCustom)) : ''
+                'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(json_encode($aCustom)) : ''
             ))
         );
     }
@@ -164,7 +164,7 @@ class BxPaymentTemplate extends BxBaseModPaymentTemplate
             'item_id' => $iItemId,
             'item_count' => $iItemCount,
             'redirect' => !empty($sRedirect) ? $sRedirect : '',
-            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(serialize($aCustom)) : ''
+            'custom' => !empty($aCustom) && is_array($aCustom) ? base64_encode(json_encode($aCustom)) : ''
         ));
     }
 

modules/boonex/timeline/classes/BxTimelineMenuItemShare.php

@@ -68,7 +68,7 @@ class BxTimelineMenuItemShare extends BxTemplMenu
             $sRepostToOnclick = $this->_oModule->serviceGetRepostToJsClick($iOwnerId, $sType, $sAction, $iObjectId);
 
             //--- Send item
-            $sAetSend = urlencode(base64_encode(serialize([
+            $sAetSend = urlencode(base64_encode(json_encode([
                 'name' => 'bx_timeline_send',
                 'params' => [
                     'ViewLink' => $this->_aEvent['url']

template/scripts/BxBaseMenuSetAclLevel.php

@@ -49,7 +49,7 @@ class BxBaseMenuSetAclLevel extends BxTemplMenu
         if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' && ($mixedProfileId = bx_get('profile_id', 'post')) && ($iAclLevelId = bx_get('level_id', 'post'))) {
             $mixedProfileId = urldecode($mixedProfileId);
             if(!is_numeric($mixedProfileId))
-                $mixedProfileId = unserialize($mixedProfileId);
+                $mixedProfileId = json_decode($mixedProfileId, true);
 
             echoJson($this->setMembership($mixedProfileId, $iAclLevelId, bx_get('duration', 'post') !== false ? (int)bx_get('duration', 'post') : 0, (int)bx_get('card', 'post') > 0));
             exit;
@@ -128,7 +128,7 @@ class BxBaseMenuSetAclLevel extends BxTemplMenu
                 'title' => $sTitle,
                 'icon' => '',
                 'link' => 'javascript:void(0);',
-                'onclick' => "bx_set_acl_level(" . (!$bBulk ? $mixedProfileId : "'" . urlencode(serialize($mixedProfileId)) . "'") . ", {$iId}, " . bx_js_string("$(this).parents('.bx-popup-applied:first')") . ");"
+                'onclick' => "bx_set_acl_level(" . (!$bBulk ? $mixedProfileId : "'" . urlencode(json_encode($mixedProfileId)) . "'") . ", {$iId}, " . bx_js_string("$(this).parents('.bx-popup-applied:first')") . ");"
             );
         }