Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:55568
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4E790B82.6090805@akbkhome.com>
References: <4E790B82.6090805@akbkhome.com>
Date: Wed, 21 Sep 2011 01:38:49 +0200
Message-ID: <CAH-PCH40dSQUoghWBYL10PY1E_xWXgQ34jnxXA2h+wkJPxu6tQ@mail.gmail.com>
To: Alan Knowles <alan@akbkhome.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] is_a() - again - a better fix
From: tyra3l@gmail.com (Ferenc Kovacs)

On Tue, Sep 20, 2011 at 11:54 PM, Alan Knowles <alan@akbkhome.com> wrote:
> Let's try and close this one.
>
> https://bugs.php.net/bug.php?id=3D55475
>
> I've just added a patch that adds is_class_of(), which is identical to
> is_subclass_of, and has the new feature of supporting strings and using t=
he
> autoloader.
>
> It then reverts is_a() back to the previous behavior, and clarifies the
> documentation.
>
> This solves the BC issues, and also solves potential security issues with
> existing code accidentally passing $url's to the autoloader, and gives
> anyone who needs this new behavior a solution.
>
> Let's at least try and respect the new release RFC, and our users who
> appreciate PHP's efforts over the years to try and maintain BC. (it's one=
 of
> it's few advantages these days...)
>

Hi Alan,

As it was mentioned before, the main reason to not revert back to the
old behavior is to not break BC once again (it shouldn't have happened
in the first place, but we can't change that. :()-
The security implications was never brought up though, but I think
that it is plausible, that there are people out there without suhosin,
having allow_url_include enabled, and using a vulnerable autoloader
(the PSR-0 reference implementation is vulnerable for example), so
maybe it is worth discussing.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu