fix: accept no classes for unserialize()

codeigniter4 · Sep 30, 2023 · 8d41220 · 8d41220
1 parent d77ec8f
commit 8d41220
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/system/Entity/Cast/ArrayCast.php b/system/Entity/Cast/ArrayCast.php
@@ -26,7 +26,7 @@ public static function fromDatabase($value, array $params = []): array
         }
 
         if ((strpos($value, 'a:') === 0 || strpos($value, 's:') === 0)) {
-            $value = unserialize($value);
+            $value = unserialize($value, ['allowed_classes' => false]);
         }
 
         return (array) $value;