Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78399
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.218.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <544DFC5F.9020408@sugarcrm.com>
References: <544DFC5F.9020408@sugarcrm.com>
Date: Mon, 27 Oct 2014 22:16:48 +0400
Message-ID: <CA+9eiLv78H+G4kCtLBat_HSaOv_bTKw1p+sbukNCr=pk3CCVhA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2cb9abf0f8505066b8863
Subject: Re: [PHP-DEV] [RFC] Serialize filtering
From: dmitry@zend.com (Dmitry Stogov)

--001a11c2cb9abf0f8505066b8863
Content-Type: text/plain; charset=UTF-8

Hi Stas,

I'm not sure if this new argument to unserialize() is intuitive.
May be better to use separate functions - unserialize_filtered() or
something similar.

Thanks. Dmitry.

On Mon, Oct 27, 2014 at 11:03 AM, Stas Malyshev <smalyshev@sugarcrm.com>
wrote:

> Hi!
>
> I'd like to have a vote on unserialize() improvement proposal outlined
> here:
> https://wiki.php.net/rfc/secure_unserialize
>
> soon-ish, but since discussion on it has been more than a year ago I'd
> like to give it some prior notice and some time to re-consider. I still
> think it is a good improvement, not fixing all problems but allowing to
> fix some at reasonable cost. I've added some outline of arguments
> discussed before, but still open for comments.  The patch is probably
> outdated but I'll fix it if it's accepted, if not I don't want to spend
> time on it. I'd like to have a vote sometime next week, but if there's
> more discussion it can be postponed.
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--001a11c2cb9abf0f8505066b8863--