Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public static function getMenuContent() {
      global $CFG_GLPI;

      $menu  = parent::getMenuContent();
      $menu['page']   = PluginOrderMenu::getSearchURL(false);
      $menu['links']['add']    = null;
      $menu['links']['search'] = null;
      $menu['links']['config'] = self::getFormURL(false);

      return $menu;
   }