Fix: avoid crash when Safe unserialize is unavailable

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Fix crash on mapping/injection screens (`Safe\unserialize` not shipped by GLPI core yet)
+
 ## [2.15.9] - 2026-08-04
 
 ### Fixed

ajax/injection.php

@@ -28,14 +28,12 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "injection.php")) {
     header("Content-Type: text/html; charset=UTF-8");
     Html::header_nocache();
 }
 
 Session::checkCentralAccess();
-$model = unserialize($_SESSION['datainjection']['currentmodel']);
+$model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showInjectionForm($model, $_SESSION['glpiactive_entity']);

ajax/results.php

@@ -28,14 +28,12 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "results.php")) {
     header("Content-Type: text/html; charset=UTF-8");
     Html::header_nocache();
 }
 
 Session::checkCentralAccess();
-$model = unserialize($_SESSION['datainjection']['currentmodel']);
+$model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
 PluginDatainjectionClientInjection::showResultsForm($model);

front/clientinjection.form.php

@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use function Safe\unserialize;
-
 Session::checkRight("plugin_datainjection_use", READ);
 
 Html::header(
@@ -41,7 +39,7 @@
 );
 
 if (isset($_SESSION['datainjection']['go'])) {
-    $model = unserialize($_SESSION['datainjection']['currentmodel']);
+    $model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
     PluginDatainjectionClientInjection::showInjectionForm($model, $_SESSION['glpiactive_entity']);
 } elseif (isset($_POST['upload'])) {
     $model = new PluginDatainjectionModel();

inc/clientinjection.class.php

@@ -41,7 +41,6 @@
 use function Safe\json_encode;
 use function Safe\readfile;
 use function Safe\unlink;
-use function Safe\unserialize;
 
 class PluginDatainjectionClientInjection
 {
@@ -195,7 +194,7 @@ public static function processBatch(int $offset, int $batch_size): array
 
         Profile::getCurrent()->disable();
 
-        $model = unserialize($_SESSION['datainjection']['currentmodel']);
+        $model = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['currentmodel']);
         $model->loadSpecificModel();
         $entities_id = $_SESSION['glpiactive_entity'];
         $lines_json  = PluginDatainjectionSession::getParam('injection_lines');
@@ -328,7 +327,7 @@ public static function exportErrorsInCSV()
         self::stripslashes_array($error_lines);
 
         if (!empty($error_lines)) {
-            $model = unserialize(PluginDatainjectionSession::getParam('currentmodel'));
+            $model = PluginDatainjectionSession::unserialize(PluginDatainjectionSession::getParam('currentmodel'));
             $file  = PLUGIN_DATAINJECTION_UPLOAD_DIR . PluginDatainjectionSession::getParam('file_name');
 
             $mappings = $model->getMappings();

inc/mapping.class.php

@@ -32,7 +32,6 @@
 
 use function Safe\ob_get_clean;
 use function Safe\ob_start;
-use function Safe\unserialize;
 
 class PluginDatainjectionMapping extends CommonDBTM
 {
@@ -100,7 +99,7 @@ public function getItemtype()
     public static function showFormMappings(PluginDatainjectionModel $model)
     {
         $canedit = $model->can($model->fields['id'], UPDATE);
-        $lines = isset($_SESSION['datainjection']['lines']) ? unserialize($_SESSION['datainjection']['lines']) : [];
+        $lines = isset($_SESSION['datainjection']['lines']) ? PluginDatainjectionSession::unserialize($_SESSION['datainjection']['lines']) : [];
 
         $show_preview = isset($_SESSION['datainjection']['lines']) && !empty($lines);
         $preview_url = '';

inc/model.class.php

@@ -33,7 +33,6 @@
 use function Safe\json_decode;
 use function Safe\realpath;
 use function Safe\tempnam;
-use function Safe\unserialize;
 
 /**
  * -------------------------------------------------------------------------
@@ -1321,7 +1320,7 @@ public static function showPreviewMappings($models_id)
 
         echo "<table class='tab_cadre_fixe'>";
         if (isset($_SESSION['datainjection']['lines'])) {
-            $injectionData = unserialize($_SESSION['datainjection']['lines']);
+            $injectionData = PluginDatainjectionSession::unserialize($_SESSION['datainjection']['lines']);
             $lines         = $injectionData->getData();
             $nblines       = $_SESSION['datainjection']['nblines'];
             $model         = self::getInstanceByModelID($models_id);

inc/session.class.php

@@ -34,6 +34,24 @@
 
 class PluginDatainjectionSession
 {
+    /**
+    * Unserialize a value, using Safe\unserialize() when available
+    * (not shipped by GLPI core yet, see thecodingmachine/safe >= 3.4.0)
+    *
+    * @param string $data  the serialized value
+    *
+    * @return mixed the unserialized value
+   **/
+    public static function unserialize(string $data)
+    {
+        if (function_exists('Safe\unserialize')) {
+            return \Safe\unserialize($data);
+        }
+        // @phpstan-ignore theCodingMachineSafe.function
+        return unserialize($data);
+    }
+
+
     /**
     * Get a parameter from the HTTP session
     *