Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Jordi Boggiano
On Sun, Feb 28, 2010 at 8:03 PM, Herman Radtke wrote: >> Imo unserialize should check, when applying public or protected values, >> if either exists on the object, and apply it to the one that exists. >> Sure it's gonna cost some performance, but at least changing the >> prototype of your class wh

Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Richard Quadling
On 28 February 2010 19:03, Herman Radtke wrote: >> Imo unserialize should check, when applying public or protected values, >> if either exists on the object, and apply it to the one that exists. >> Sure it's gonna cost some performance, but at least changing the >> prototype of your class while st

Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Herman Radtke
> Imo unserialize should check, when applying public or protected values, > if either exists on the object, and apply it to the one that exists. > Sure it's gonna cost some performance, but at least changing the > prototype of your class while stuff is running isn't going to kill your > code anymor

[PHP-DEV] Unserialize is broken

2010-02-28 Thread Jordi Boggiano
Heya, This bug was closed as Bogus http://bugs.php.net/bug.php?id=51173 and Pierre told me to bring the discussion here since I was ranting on irc. Johannes argued that the fact unserialize doesn't check the access level of properties before generating object is good because it allows hackish fea