Anthony Ferrara wrote on 22.08.2015 21:58:
> All,
>
> I am putting a simple RFC up for discussion to make random_* throw
> exceptions on failure in order to ensure we fail-closed.
>
> https://wiki.php.net/rfc/random-function-exceptions
>
> Considering this topic has already been discussed, I intend to open
> voting on this as soon as allowable. Given the voting policy specifies
> 2 weeks for language changes and 1 week for another, this is assumed
> to require 1 week of "discussion".
>
> With that in mind, I intend to put this RFC up to vote on August 29/30th.
>
> Thanks!
>
> Anthony
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
Hi,
I think there are a lot of security problems if people ignore return values,
e.g. password comparison, user lookup in database, lookups for permissions, etc.
Having false + E_WARNING highlighted in the documentation with a yellow box and
the Caution title should be enough.
For those who want exceptions can implement this in userland:
$rand = random_int(10,100);
if ($rand === false) {
throw new Exception('error ...');
}
// or write a wrapper like random_int_exception(...).
If people use this function without reading documentation, they will also use
other things without documentation like database queries without
binding/escaping, inject html without escaping, etc.
Having core functions suddenly throw exceptions causes many problems in the
code structure.
Regards
Thomas
--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
