Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78604
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5457EF60.1020103@sugarcrm.com>
References: <5457EF60.1020103@sugarcrm.com>
Date: Mon, 3 Nov 2014 23:04:56 +0000
Message-ID: <CAPwsocEr_AD80drtNHCiJGGLMEnMOGnSuTzhGQgMhe9ob0WzCQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [VOTE] Filtered unserialize()
From: leight@gmail.com (Leigh)

On 3 November 2014 21:10, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
> I'd like to put to vote my proposal about the filtered unserialize():
>
> https://wiki.php.net/rfc/secure_unserialize
>
> It was discussed a number of times before and I think it is time to have
> a decision on it. If you need any clarifications on the proposal, please
> do not hesitate to ask.
> --

I wonder how often the final parameter will simply be get_declared_classes()

Instead of true/false/array, maybe we could go for int/array and have
constants for "allow anything", "disallow everything", "allow declared
only".