I noticed that when you serialize the usernames, it includes quotes, and when that's with a hidden variable for a form it breaks the form value.

I replaced all serialize code:
serialize($users)
with:
str_replace("\"", "'", serialize($users))

And then all unserialize code:
unserialize($form['user_list'])
with:
unserialize(str_replace("'", "\"", $form['user_list']))

To resolve this issue.

Comments

salvis’s picture

salvis
he/his
commented

How is this related to ACL?

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

bduell’s picture

bduell commented

It's related to ACL because in the acl_edit_form function you're passing a serialized value for "user_list" - if that value contains a quote you won't get it back in the other functions that unserialize it.

bduell’s picture

bduell commented

Actually, a better method (found here http://us2.php.net/serialize ) would be to use base64_encode()/base64_decode instead.