Deserialization of untrusted data

[xgin]

I want to resolve ZDI-20-1051 vulnerability (additional details) using json serialization when possible and the list of allowed classes in other cases.

[yunosh]

The allowed_classes option is added with PHP 7.0, so we can only use this in IMP 7. For IMP 6, we need to find a different solution. Or at least do a version check.