System: replaced unserialize with json_decode in Import from File

GibbonEdu · Jan 22, 2024 · ec95a1b · ec95a1b
1 parent 7367fee
commit ec95a1b
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -43,6 +43,7 @@ v27.0.00
 
     Bug Fixes
         System: fixed PHP 8+ compatibility in CustomFieldIDs migration file
+        System: fixed input serialization of form data in Import from File page
         Students: fixed the view all option in the Students by Form Group report
 
     Deprecations

diff --git a/modules/System Admin/import_run.php b/modules/System Admin/import_run.php
@@ -405,8 +405,8 @@
 
         $csvData = $_POST['csvData'] ?? null;
         if ($step==4) {
-            $columnOrder = isset($_POST['columnOrder'])? unserialize($_POST['columnOrder']) : null;
-            $columnText = isset($_POST['columnText'])? unserialize($_POST['columnText']) : null;
+            $columnOrder = isset($_POST['columnOrder'])? json_decode($_POST['columnOrder'], true) : null;
+            $columnText = isset($_POST['columnText'])? json_decode($_POST['columnText'], true) : null;
         } else {
             $columnOrder = $_POST['columnOrder'] ?? null;
             $columnText = $_POST['columnText'] ?? null;
@@ -516,8 +516,8 @@
                 $form->addHiddenValue('mode', $mode);
                 $form->addHiddenValue('syncField', $syncField);
                 $form->addHiddenValue('syncColumn', $syncColumn);
-                $form->addHiddenValue('columnOrder', serialize($columnOrder));
-                $form->addHiddenValue('columnText', serialize($columnText));
+                $form->addHiddenValue('columnOrder', json_encode($columnOrder));
+                $form->addHiddenValue('columnText', json_encode($columnText));
                 $form->addHiddenValue('fieldDelimiter', urlencode($fieldDelimiter));
                 $form->addHiddenValue('stringEnclosure', urlencode($stringEnclosure));
                 $form->addHiddenValue('filename', $_POST['filename'] ?? '');