Everything

php

Casting of objects to array exports private/protected data

php.internals

Andrey Hristov

22 years ago

Hi internals,
casting an object to array gives the possibility to get the values of protected/private
member variables :
<?php
class some {
public $pub = 1;
protected $prot = 2;
private $priv = 3;

}
var_dump((array)new some());

?>
Produces :
array(3) {
["pub"]=>
int(1)
["*prot"]=>
int(2)
["somepriv"]=>
int(3)
}

IMO, when casting to array with (array) only the public-ly visible members should returned.

Andrey

Pierre-Alain Joye

22 years ago

On Sat, 17 Jan 2004 16:44:29 +0100
Andrey Hristov <php@hristov.com> wrote:

> IMO, when casting to array with (array) only the public-ly visible
> members should returned.

Dunno, E_STRICT (as you can access them without notice/warning without
this flag)?

In the same manner:
<?php
error_reporting(E_STRICT);
class some {
public $pub = 1;
protected $prot = 2;
private $priv = 3;

}
class any extends some {
public $pub1 = 1;
function dump() {
var_dump($this);
}
}
var_dump((array)new any());
$a = new any;
$a->dump();

?>

a var_dump should dump protected props from the parent class as they are
visible. Note the "funny" thing is that var_dump() alone do not display
the public|protected props, whatever is the context call. IMHO, that
sounds not very consistent, but only imho...

pierre

Andrey Hristov

22 years ago

Pierre-Alain Joye wrote:

> On Sat, 17 Jan 2004 16:44:29 +0100
> Andrey Hristov <php@hristov.com> wrote:
>
>
>>IMO, when casting to array with (array) only the public-ly visible
>>members should returned.
>
>
> Dunno, E_STRICT (as you can access them without notice/warning without
> this flag)?
>
> In the same manner:
> <?php
> error_reporting(E_STRICT);
> class some {
>          public $pub = 1;
>          protected $prot = 2;
>          private $priv = 3;
>
> }
> class any extends some {
>         public $pub1 = 1;
>         function dump() {
>                 var_dump($this);
>         }
> }
> var_dump((array)new any());
> $a = new any;
> $a->dump();
>
> ?>
>
> a var_dump should dump protected props from the parent class as they are
> visible. Note the "funny" thing is that var_dump() alone do not display
> the public|protected props, whatever is the context call. IMHO, that
> sounds not very consistent, but only imho...

Yes, it does not. Use print_r() for dumping. print_r() uses internal zend function to dump
the variable content while var_dump() is defined in ext/standard/var.c and knows nothing
about protected and private functions (or at least it was that 2 months ago).
print_r() has the expected behavior of dumping data, but casting to array and getting
protected/private data is nasty.


Andrey

Andi Gutmans

22 years ago

In general, I think casting an object to an array sucks.
I would be all for an E_STRICT message that this is deprecated as we have
"real" objects now and IMO, and that the behavior might change/go away
sometime in the future.

Andi

At 05:07 PM 1/17/2004 +0100, Andrey Hristov wrote:

Jani Taskinen

22 years ago

Why not simply make the cast not work?
Can you think of any BC problem with that? :)

--Jani

On Wed, 21 Jan 2004, Andi Gutmans wrote:

Andi Gutmans

22 years ago

Yeah, because it used to work.

Andi

At 01:19 PM 1/21/2004 +0200, Jani Taskinen wrote:

Adam Maccabee Trachtenberg

22 years ago

On Wed, 21 Jan 2004, Andi Gutmans wrote:

> In general, I think casting an object to an array sucks.
> I would be all for an E_STRICT message that this is deprecated as we have
> "real" objects now and IMO, and that...

> ...the behavior might change/go away sometime in the future.

Are you saying you want to introduce a __toArray() method? :)

Ducks.

-adam

PS: In case this wasn't clear: This is a joke.

--
adam@trachtenberg.com
author of o'reilly's php cookbook
avoid the holiday rush, buy your copy today!

Christian Schneider

22 years ago

Andrey Hristov wrote:

> casting an object to array gives the possibility to get the values of
> protected/private member variables :
>
> IMO, when casting to array with (array) only the public-ly visible
> members should returned.

Public/protected/private is there to protect you from bugs due to name
clashes when you extend classes. It is not a sandbox to protect you from
'malicous' programmers.

And I like it that way: PINJ(Y) - PHP is not Java (yet)
Even though some people push it that way ;-)

- Chris