Issue #3525174 by benjifisher, smustgrave, greggles, catch, larowlan, mcdruid:...

Issue #3525174 by benjifisher, smustgrave, greggles, catch, larowlan, mcdruid: Clean up unserialize() in the config system

(cherry picked from commit 4cfe1582)

core/lib/Drupal/Core/Config/DatabaseStorage.php

@@ -272,7 +272,7 @@ public function encode($data) {
    *   be unserialized.
    */
   public function decode($raw) {
-    $data = @unserialize($raw);
+    $data = @unserialize($raw, ['allowed_classes' => FALSE]);
     return is_array($data) ? $data : FALSE;
   }