Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:78957
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.50 as permitted sender)
Message-ID: <546BAD48.7030009@gmail.com>
Date: Tue, 18 Nov 2014 12:34:16 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: filtered unserialise() - results
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

The vote for https://wiki.php.net/rfc/secure_unserialize has been
completed (actually, should be last week but I was busy, sorry for the
delay) and the RFC is accepted 17 votes for to 6 votes against.

Now, there were proposals to amend this RFC slightly to make the
additional parameter an option array - with sole option currently being
accepted classes list for now - in order to allow future extensibility.
I am somewhat undecided on this option, but rather than make a new vote
for a small implementation change, I want to make an informal poll -
*if* I decide to make it an option array - would anyone strongly oppose
to it, and if so, why?

Note that it is not a vote either way - rather, I'd like to hear if
somebody has an argument against doing this (I've already heard
arguments for it). So if you oppose it, please tell the reasons why. I
have some (which I previously posted on the list) but I'd like to hear
from others too.

Thanks,
Stas