[dev] [commits] imp branch master updated. 5f9aef5b2d3980f9633bee49c32e7a25864478d1

[Ralf Lang]

Hello,

Am 07.11.22 um 20:01 schrieb Michael J Rubinsky:
>
> Quoting Jan Schneider <jan at horde.org>:
>
>> I don't think this works, because AFAIR we are indeed storing 
>> serialized objects in the sort pref.
>
> As far as I can tell we are storing an array of hashes:
>
> a:23:{s:5:"INBOX";a:2:{s:1:"b";i:1;s:1:"d";i:1;}s:15:"General 
> Archive";a:2:{s:1:"b";s:3:"100";s:1:"d";i:1;} .....
>
>
> array(23) {
>   ["INBOX"]=>
>   array(2) {
>     ["b"]=>
>     int(1)
>     ["d"]=>
>     int(1)
>   }
>   ["General Archive"]=>
>   array(2) {
>     ["b"]=>
>     string(3) "100"
>     ["d"]=>
>     int(1)
>   }
>
> .
> .
> .
> .
> }
>
> and this is what is inferred from config/prefs.php:
>
>
> // sort prefs for individual mailboxes
> $_prefs['sortpref'] = array(
>     // value = serialize(array())
>     'value' => 'a:0:{}'
> );
>
>
 From looking into a production horde db and relevant code, I found only 
primitives but no objects.
As this is not going into a FW52 release, we could easily whitelist some 
specific classes if needed.