From acb2ce417fd1b2d0499aecb241d0233ccbb91029 Mon Sep 17 00:00:00 2001
From: Paul Holden <paulh@moodle.com>
Date: Mon, 6 Nov 2023 21:16:22 +0000
Subject: [PATCH] MDL-79797 backup: ensure block config is safely unserialized.

---
 backup/moodle2/backup_stepslib.php  | 8 +++++++-
 backup/moodle2/restore_stepslib.php | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/backup/moodle2/backup_stepslib.php b/backup/moodle2/backup_stepslib.php
index e8ba6f9927b..81da021040a 100644
--- a/backup/moodle2/backup_stepslib.php
+++ b/backup/moodle2/backup_stepslib.php
@@ -1518,7 +1518,13 @@ class backup_block_instance_structure_step extends backup_structure_step {
         // Transform configdata information if needed (process links and friends)
         $blockrec = $DB->get_record('block_instances', array('id' => $this->task->get_blockid()));
         if ($attrstotransform = $this->task->get_configdata_encoded_attributes()) {
-            $configdata = (array)unserialize(base64_decode($blockrec->configdata));
+            $configdata = array_filter(
+                (array) unserialize_object(base64_decode($blockrec->configdata)),
+                static function($value): bool {
+                    return !($value instanceof __PHP_Incomplete_Class);
+                }
+            );
+
             foreach ($configdata as $attribute => $value) {
                 if (in_array($attribute, $attrstotransform)) {
                     $configdata[$attribute] = $this->contenttransformer->process($value);
diff --git a/backup/moodle2/restore_stepslib.php b/backup/moodle2/restore_stepslib.php
index b8afa1d0791..8f0b8abfc38 100644
--- a/backup/moodle2/restore_stepslib.php
+++ b/backup/moodle2/restore_stepslib.php
@@ -4196,7 +4196,13 @@ class restore_block_instance_structure_step extends restore_structure_step {
         // Let's look for anything within configdata neededing processing
         // (nulls and uses of legacy file.php)
         if ($attrstotransform = $this->task->get_configdata_encoded_attributes()) {
-            $configdata = (array) unserialize_object(base64_decode($data->configdata));
+            $configdata = array_filter(
+                (array) unserialize_object(base64_decode($data->configdata)),
+                static function($value): bool {
+                    return !($value instanceof __PHP_Incomplete_Class);
+                }
+            );
+
             foreach ($configdata as $attribute => $value) {
                 if (in_array($attribute, $attrstotransform)) {
                     $configdata[$attribute] = $this->contentprocessor->process_cdata($value);