EZP-31643 Object injection in discountruleedit (#139)

ezsystems · Oct 5, 2020 · b7c2a06 · b7c2a06
1 parent 925cc50
commit b7c2a06
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/kernel/shop/discountruleedit.php b/kernel/shop/discountruleedit.php
@@ -46,9 +46,9 @@
                                                         'discountrule_id' => $discountRuleID ),
                                     'persistent_data' => array( 'discountrule_name' => $http->postVariable( 'discountrule_name' ),
                                                                 'discountrule_percent' => $http->postVariable( 'discountrule_percent' ),
-                                                                'Contentclasses' => ( $http->hasPostVariable( 'Contentclasses' ) )? serialize( $http->postVariable( 'Contentclasses' ) ): '',
-                                                                'Sections' => ( $http->hasPostVariable( 'Sections' ) )? serialize( $http->postVariable( 'Sections' ) ): '',
-                                                                'Products' => ( $http->hasPostVariable( 'Products' ) )? serialize( $http->postVariable( 'Products' ) ): '' ),
+                                                                'Contentclasses' => ( $http->hasPostVariable( 'Contentclasses' ) )? json_encode( $http->postVariable( 'Contentclasses' ) ): '',
+                                                                'Sections' => ( $http->hasPostVariable( 'Sections' ) )? json_encode( $http->postVariable( 'Sections' ) ): '',
+                                                                'Products' => ( $http->hasPostVariable( 'Products' ) )? json_encode( $http->postVariable( 'Products' ) ): '' ),
                                     'from_page' => "/shop/discountruleedit/$discountGroupID/$discountRuleID" ),
                              $module );
     return;
@@ -68,7 +68,7 @@
         $discountRuleSelectedClasses = $http->postVariable( 'Contentclasses' );
         if ( !is_array( $discountRuleSelectedClasses ) )
         {
-            $discountRuleSelectedClasses = unserialize( $discountRuleSelectedClasses );
+            $discountRuleSelectedClasses = json_decode( $discountRuleSelectedClasses );
         }
     }
 
@@ -78,7 +78,7 @@
         $discountRuleSelectedSections = $http->postVariable( 'Sections' );
         if ( !is_array( $discountRuleSelectedSections ) )
         {
-            $discountRuleSelectedSections = unserialize( $discountRuleSelectedSections );
+            $discountRuleSelectedSections = json_decode( $discountRuleSelectedSections );
         }
     }
 
@@ -88,7 +88,7 @@
         $discountRuleSelectedProducts = $http->postVariable( 'Products' );
         if ( !is_array( $discountRuleSelectedProducts ) )
         {
-            $discountRuleSelectedProducts = unserialize( $discountRuleSelectedProducts );
+            $discountRuleSelectedProducts = json_decode( $discountRuleSelectedProducts );
         }
     }