Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79284
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <546BAD48.7030009@gmail.com>
References: <546BAD48.7030009@gmail.com>
Date: Fri, 28 Nov 2014 18:56:55 +0100
Message-ID: <CAH-PCH62SJnJyvhxw+Y-MBF7VYJE7-NQP84WENHEgzRnUb7Adg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113eabb48cb1d20508eefca2
Subject: Re: [PHP-DEV] filtered unserialise() - results
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a113eabb48cb1d20508eefca2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Nov 18, 2014 at 9:34 PM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> The vote for https://wiki.php.net/rfc/secure_unserialize has been
> completed (actually, should be last week but I was busy, sorry for the
> delay) and the RFC is accepted 17 votes for to 6 votes against.
>
> Now, there were proposals to amend this RFC slightly to make the
> additional parameter an option array - with sole option currently being
> accepted classes list for now - in order to allow future extensibility.
> I am somewhat undecided on this option, but rather than make a new vote
> for a small implementation change, I want to make an informal poll -
> *if* I decide to make it an option array - would anyone strongly oppose
> to it, and if so, why?
>
> Note that it is not a vote either way - rather, I'd like to hear if
> somebody has an argument against doing this (I've already heard
> arguments for it). So if you oppose it, please tell the reasons why. I
> have some (which I previously posted on the list) but I'd like to hear
> from others too.
>
> Thanks,
> Stas
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
Sorry, I missed this thread back when you posted.
Personally I'm a bit hesitant about this change.
Do we already have something additional/upcoming features which could be a
good fit to lump together with allowed_classes?
If that's not the case, I think this is premature to introduce another
level of indirection, which will cost everybody using this feature a couple
of additional keystrokes for the vague gain that at some point in the
future there could be a feature which would be better bundled together with
this setting instead of introducing a third optional parameter.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a113eabb48cb1d20508eefca2--