Merge pull request from GHSA-jrgf-vfw2-hj26

OpenMage · Oct 20, 2020 · 26433d1 · 26433d1
1 parent 9d38347
commit 26433d1
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php b/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php
@@ -236,6 +236,10 @@ public function remove($attribute)
             $this->_fault('can_not_delete');
         }
 
+        if (!$model->getIsUserDefined()) {
+            $this->_fault('can_not_delete');
+        }
+
         try {
             $model->delete();
             return true;

diff --git a/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php b/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
@@ -542,7 +542,7 @@ protected function _afterLoad()
 
         foreach ($this as $product) {
             if ($product->isRecurring() && $profile = $product->getRecurringProfile()) {
-                $product->setRecurringProfile(unserialize($profile));
+                $product->setRecurringProfile(Mage::helper('core/unserializeArray')->unserialize($profile));
             }
         }