From a349acde1c452c8474f8c357f67c647160da5263 Mon Sep 17 00:00:00 2001
From: kenjis <kenji.uui@gmail.com>
Date: Sat, 30 Sep 2023 16:25:12 +0900
Subject: [PATCH] fix: accept no classes for unserialize()

---
 system/Entity/Cast/ArrayCast.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/system/Entity/Cast/ArrayCast.php b/system/Entity/Cast/ArrayCast.php
index 57426c332217..e2e00a28bff6 100644
--- a/system/Entity/Cast/ArrayCast.php
+++ b/system/Entity/Cast/ArrayCast.php
@@ -26,7 +26,7 @@ public static function fromDatabase($value, array $params = []): array
         }
 
         if ((strpos($value, 'a:') === 0 || strpos($value, 's:') === 0)) {
-            $value = unserialize($value);
+            $value = unserialize($value, ['allowed_classes' => false]);
         }
 
         return (array) $value;