Incomplete 'options' object unserialized after security release SA-CORE-2019-003

I can confirm this issue after upgrading. I'm using alpha3 too. alpha 4 breaks my site.

I was just about to post the exact same patch when I found yours. I can confirm that it fixes the error.

I had this same issue on drupal 8.6 and after the move to 8.6.10. I fixed it on my local copy and thought it was all good, only to find that it didn't work on my production server when I pushed it up. After closer inspection, this fix will NOT work if you are using PHP 7.2.

The conditions that are being used in the patch to determine when to serialize/unserialize are using is_object() and there was a change to how this works in php 7.2

"is_object() now returns TRUE for unserialized objects without a class definition (class of __PHP_Incomplete_Class). Previously FALSE was returned."

To fix this, I simply changed the condition for the fixIncompleteObject function:

/**
   * Fix Incomplete Object PHP error caused by SA-CORE-2019-003 security release which
   * uses unserialize($values, ['allowed_classes' => FALSE]); and thus turns the unserialized
   * object into a "__PHP_Incomplete_Class" object.
   * @param $object
   * @return mixed
   */
  private function fixIncompleteObject($object) {
    if(get_class($object) === "__PHP_Incomplete_Class") {
      return ($object = unserialize(serialize($object)));
    }
    return $object;
  }

Rerolled the patch against 8.x-1.x-dev and implemented the change in #5. In addition, the patch from #3 introduced a new $option variable that was passed by reference and conflicts with a different $option variable later in the code. I renamed that to $option_obj to restore functionality for multi-variant product forms.

I'm not sure what has changed, but I was having the same issues described earlier, but recently I found that my variant (options) select list was not working on my products. Debugging, I noticed I was no longer getting the incomplete object. So it seemed I didn't need this patch anymore.

Now it seemed like for what ever reason, I couldn't access the options of the product entity. So I added a getOptions() method to the entity, and I'm calling that now in my ShopifyVariantOptionsForm.php. Seems to work.

It's still related to this issue enough that I wanted to put the patch here in case it helps any one else.

Apologies, disregard #7. Patched the wrong version. I'm still using the alpha3 version.

Today I did an upgrade of Drupal core from 8.5.3 to 8.7.3 and noticed that my product pages were also missing their options fields. I am using shopify 8.x-1.0-alpha3+16-dev.

Patch #7 did not work for me, so I tried #8, which eliminated the warnings, but brought back only ONE options field per product. Sometimes we have multiple, i.e. size and color.

I then changed the follwing in the patch, which worked out so far:

$options[0] = $this->values["options"]["x-default"][0];
changed to
$options = $this->values["options"]["x-default"];

I am no coder actually, so please correct me, if this could cause 'damage' ;)

Before, I got the following warnings:

Warning: unserialize() expects parameter 1 to be string, object given in Drupal\Core\Field\Plugin\Field\FieldType\MapItem->setValue() (line 68 of core/lib/Drupal/Core/Field/Plugin/Field/FieldType/MapItem.php).
Drupal\Core\Field\Plugin\Field\FieldType\MapItem->setValue(Object, ) (Line: 200)
Drupal\Core\TypedData\TypedDataManager->getPropertyInstance(Object, 0, Object) (Line: 82)
Drupal\Core\Field\FieldTypePluginManager->createFieldItem(Object, 0, Object) (Line: 41)
Drupal\Core\Field\FieldItemList->createItem(0, Object) (Line: 66)
Drupal\Core\TypedData\Plugin\DataType\ItemList->setValue(Array, ) (Line: 107)
Drupal\Core\Field\FieldItemList->setValue(Array, ) (Line: 200)
Drupal\Core\TypedData\TypedDataManager->getPropertyInstance(Object, 'options', Array) (Line: 74)
Drupal\Core\Field\FieldTypePluginManager->createFieldItemList(Object, 'options', Array) (Line: 604)
Drupal\Core\Entity\ContentEntityBase->getTranslatedField('options', 'x-default') (Line: 1058)
Drupal\Core\Entity\ContentEntityBase->__get('options') (Line: 35)
Drupal\shopify\Form\ShopifyVariantOptionsForm->buildForm(Array, Object, Object)
call_user_func_array(Array, Array) (Line: 519)
Drupal\Core\Form\FormBuilder->retrieveForm('shopify_variant_options_form', Object) (Line: 276)
Drupal\Core\Form\FormBuilder->buildForm('shopify_variant_options_form', Object) (Line: 217)
Drupal\Core\Form\FormBuilder->getForm('Drupal\shopify\Form\ShopifyVariantOptionsForm', Object) (Line: 65)
Drupal\shopify\ShopifyProductViewBuilder->alterBuild(Array, Object, Object, 'full') (Line: 295)
Drupal\Core\Entity\EntityViewBuilder->buildMultiple(Array) (Line: 242)
Drupal\Core\Entity\EntityViewBuilder->build(Array)
call_user_func(Array, Array) (Line: 378)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 195)
Drupal\Core\Render\Renderer->render(Array, ) (Line: 226)
Drupal\Core\Render\MainContent\HtmlRenderer->Drupal\Core\Render\MainContent\{closure}() (Line: 582)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 227)
Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object) (Line: 117)
Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object) (Line: 90)
Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
call_user_func(Array, Object, 'kernel.view', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object) (Line: 156)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 68)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 106)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 85)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 52)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 693)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

Warning: Invalid argument supplied for foreach() in Drupal\shopify\Form\ShopifyVariantOptionsForm->buildForm() (line 57 of modules/shopify/src/Form/ShopifyVariantOptionsForm.php).
Drupal\shopify\Form\ShopifyVariantOptionsForm->buildForm(Array, Object, Object)
call_user_func_array(Array, Array) (Line: 519)
Drupal\Core\Form\FormBuilder->retrieveForm('shopify_variant_options_form', Object) (Line: 276)
Drupal\Core\Form\FormBuilder->buildForm('shopify_variant_options_form', Object) (Line: 217)
Drupal\Core\Form\FormBuilder->getForm('Drupal\shopify\Form\ShopifyVariantOptionsForm', Object) (Line: 65)
Drupal\shopify\ShopifyProductViewBuilder->alterBuild(Array, Object, Object, 'full') (Line: 295)
Drupal\Core\Entity\EntityViewBuilder->buildMultiple(Array) (Line: 242)
Drupal\Core\Entity\EntityViewBuilder->build(Array)
call_user_func(Array, Array) (Line: 378)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 195)
Drupal\Core\Render\Renderer->render(Array, ) (Line: 226)
Drupal\Core\Render\MainContent\HtmlRenderer->Drupal\Core\Render\MainContent\{closure}() (Line: 582)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 227)
Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object) (Line: 117)
Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object) (Line: 90)
Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
call_user_func(Array, Object, 'kernel.view', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object) (Line: 156)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 68)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 106)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 85)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 52)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 693)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

We've had an issue where a product with no options was giving a fatal error when accessing the page.
This was due to shopify/src/Form/ShopifyVariantOptionsForm.php L35 $options = $product->getOptions(); getting product options not as an multidimensional array. When '#title' => t($option->name), was called, core/lib/Drupal/Core/StringTranslation/TranslatableMarkup.php L130 if (!is_string($string)) was getting TRUE cause $string was null and was throwing an exception.

Managed to temporarily fix this by applying https://www.drupal.org/files/issues/2019-04-01/2719553-26-null_for_strin... but that would show the Product Option Selector even when the product didn't had any.

I got this fixed more correctly by checking for an array before returning on function getOptions().

Thanks for patch #10! Works as expected.

Patch #10 worked for me as well.

With the patch in #10 $product->getOptions() returns a serialized array which causes the options rendering to fail because it passes a non-string for translation which causes the error (which seems like it should be the expected behavior).

Here, it looks like the options should be unserialized at some point before processing them.

This patch for dev version of the module

I am also seeing this error when syncing products, I seem to have patched this by adding the following to the shopify_sync_products() function in shopify.module file after the line

if ($entity instanceof ShopifyProduct) {

foreach ($product->options as $key => $option) {
    if ($option instanceof stdClass) {
      $product->options[$key] = (array) $product->options[$key];
   }
}

I'm still seeing the issue with serialized options mentioned in #13. The attached patch attempts to unserialize the options if they're not already an array.

The attached patch stores all options as a serialized array rather than a PHP object. This will need a post_update operation to resync all products since the product option storage will need to be altered.

Setting to "needs work" to deal with update path.

Saving credit.

Adds the post_update hook to resync all of a site's products.