diff --git a/repository/coursefiles/lib.php b/repository/coursefiles/lib.php
index 74701232ec1..3e0d2e56ec9 100644
--- a/repository/coursefiles/lib.php
+++ b/repository/coursefiles/lib.php
@@ -146,12 +146,11 @@ class repository_coursefiles extends repository {
     }
 
     public function get_link($encoded) {
-        $info = array();
-
         $browser = get_file_browser();
 
         // the final file
-        $params = unserialize(base64_decode($encoded));
+        $params = (array) unserialize_array(base64_decode($encoded));
+
         $contextid  = clean_param($params['contextid'], PARAM_INT);
         $fileitemid = clean_param($params['itemid'], PARAM_INT);
         $filename = clean_param($params['filename'], PARAM_FILE);
diff --git a/repository/lib.php b/repository/lib.php
index 06cd37032ea..1ab54fd94f0 100644
--- a/repository/lib.php
+++ b/repository/lib.php
@@ -2511,7 +2511,7 @@ abstract class repository implements cacheable_object {
         if ($file = $fs->get_file($user_context->id, 'user', 'draft', $itemid, $filepath, $filename)) {
             if ($tempfile = $fs->get_file($user_context->id, 'user', 'draft', $itemid, $newfilepath, $newfilename)) {
                 // Remember original file source field.
-                $source = @unserialize($file->get_source());
+                $source = unserialize_object($file->get_source());
                 // Remember the original sortorder.
                 $sortorder = $file->get_sortorder();
                 if ($tempfile->is_external_file()) {
@@ -2526,9 +2526,7 @@ abstract class repository implements cacheable_object {
                 $newfile = $fs->create_file_from_storedfile(array('filepath'=>$filepath, 'filename'=>$filename), $tempfile);
                 // Preserve original file location (stored in source field) for handling references
                 if (isset($source->original)) {
-                    if (!($newfilesource = @unserialize($newfile->get_source()))) {
-                        $newfilesource = new stdClass();
-                    }
+                    $newfilesource = unserialize_object($newfile->get_source());
                     $newfilesource->original = $source->original;
                     $newfile->set_source(serialize($newfilesource));
                 }
@@ -2577,10 +2575,14 @@ abstract class repository implements cacheable_object {
                 if ($fs->file_exists($usercontext->id, 'user', 'draft', $draftid, $updatedata['filepath'], $updatedata['filename'])) {
                     throw new moodle_exception('fileexists', 'repository');
                 }
-                if (($filesource = @unserialize($file->get_source())) && isset($filesource->original)) {
+
+                // Unset original so the references are not shown any more.
+                $filesource = unserialize_object($file->get_source());
+                if (isset($filesource->original)) {
                     unset($filesource->original);
                     $file->set_source(serialize($filesource));
                 }
+
                 $file->rename($updatedata['filepath'], $updatedata['filename']);
                 // timemodified is updated only when file is renamed and not updated when file is moved.
                 $filemodified = $filemodified || ($updatedata['filename'] !== $filename);
@@ -2623,11 +2625,14 @@ abstract class repository implements cacheable_object {
             foreach ($files as $f) {
                 if (preg_match("|^$xfilepath|", $f->get_filepath())) {
                     $path = preg_replace("|^$xfilepath|", $updatedata['filepath'], $f->get_filepath());
-                    if (($filesource = @unserialize($f->get_source())) && isset($filesource->original)) {
-                        // unset original so the references are not shown any more
+
+                    // Unset original so the references are not shown any more.
+                    $filesource = unserialize_object($f->get_source());
+                    if (isset($filesource->original)) {
                         unset($filesource->original);
                         $f->set_source(serialize($filesource));
                     }
+
                     $f->rename($path, $f->get_filename());
                     if ($filemodified && $f->get_filepath() === $updatedata['filepath'] && $f->get_filename() === $filename) {
                         $f->set_timemodified(time());