Church Admin - Insecure deserialization

 1371 | function church_admin_restrict_access()
 1372 | {
 1373 |
 1374 | echo'<h1 >'.esc_html( __('Restrict access to address list from certain people','church-admin' ) ).'</h2>';
 1375 |
 1376 | if(!empty( $_POST['save-restricted'] ) )
 1377 | {
> 1378 | if(!empty( $_POST['people'] ) )$people=unserialize(church_admin_get_people_id(sanitize_text_field( $_POST['people'] ) )
 1379 | if(!empty( $people) ) {update_option('church-admin-restricted-access',$people);}else{delete_option('church-admin-restr
 1380 | }
 1381 | $restrictedList=get_option('church-admin-restricted-access');
 1382 | $people='';
 1383 | if(!empty( $restrictedList) )$people=church_admin_get_people( $restrictedList);
 1384 | echo'<p>'.esc_html( __('Restrict access to the directory by certain users','church-admin' ) ).'</p>';
 1385 | echo'<form action="""" method=""POST"">';
 1386 | echo'<p>'.church_admin_autocomplete('people','friends','to',$people,FALSE).'</p>';
 1387 | echo'<input type=""hidden"" name=""save-restricted"" value=""1"" /><input type=""submit"" class=""button-primary"" value=""'.esc_ht
  1388 |
  1389 |
  1390 | }
       ^ Col 0