Serialization and deserialization of array config values mismatch
Found another pretty nasty one in commit 69266cd6. The way arrays are serialized in Config::set
have changed from php serialize()
to json_encode()
(which is a good move btw), but Config::get
don't take that into account, and still uses the dangerous unserialize
function.
Meaning that new configs with array keys are no longer being fetched, and will appear as blank/unset to the code using them. This affects things like site and channel blocks etc.
Old configs stored by serialize
are being returned correctly, but as soon as the config value is updated, it will no longer be read correctly.
I'll suggest a patch, and try to add some tests around this part of the code, so we can catch things like this earlier next time.