Merge pull request #61203 from nextcloud/backport/59979/stable34

AndyScherzinger · web-flow · commit 7d4b31c9ffb3 · 2026-06-17T07:12:07.000+02:00
[stable34] fix(repair): restrict unserialize() in RemoveBrokenProperties
diff --git a/lib/private/Repair/RemoveBrokenProperties.php b/lib/private/Repair/RemoveBrokenProperties.php
@@ -37,7 +37,7 @@ public function run(IOutput $output): void {
 		$brokenIds = [];
 		while ($entry = $result->fetch()) {
 			if (!empty($entry['propertyvalue'])) {
-				$object = @unserialize(str_replace('\x00', chr(0), $entry['propertyvalue']));
+				$object = @unserialize(str_replace('\x00', chr(0), $entry['propertyvalue']), ['allowed_classes' => false]);
 				if ($object === false) {
 					$brokenIds[] = $entry['id'];
 				}

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ public function run(IOutput $output): void {`
`37`	`37`	`$brokenIds = [];`
`38`	`38`	`while ($entry = $result->fetch()) {`
`39`	`39`	`if (!empty($entry['propertyvalue'])) {`
`40`		`- $object = @unserialize(str_replace('\x00', chr(0), $entry['propertyvalue']));`
	`40`	`+ $object = @unserialize(str_replace('\x00', chr(0), $entry['propertyvalue']), ['allowed_classes' => false]);`
`41`	`41`	`if ($object === false) {`
`42`	`42`	`$brokenIds[] = $entry['id'];`
`43`	`43`	`}`