unserialize() is a problematic PHP function with quite a few exploits.
I believe the "ideal" solution is using JSON instead, but as long as we sanitize what is being passed to unserialize() and use the additional parameters we can call in the function we should be good.
https://paragonie.com/blog/2016/04/securely-implementing-de-serialization-in-php
openemr / openemr
The most popular open source electronic health records and medical practice management solution.
3.2k
How does funding with Polar work?
1
Pay now to fund the work behind this issue.
2
Get updates on progress being made.
3
Maintainer is rewarded once the issue is completed.
FAQ
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too