php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #23671 Function calls expose private (and undefined) functions in print_r output
Submitted: 2003-05-17 08:59 UTC Modified: 2003-06-09 08:51 UTC
From: agoossens at olc dot sa dot edu dot au Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5CVS-2003-05-17 (dev) OS: Windows XP, SP1
Private report: No CVE-ID: None
 [2003-05-17 08:59 UTC] agoossens at olc dot sa dot edu dot au
Greetings all,

When a private function is called from within a class, it is exposed in the print_r() (or var_dump()) output on it's object.

In order to explain this, consider this code:

class foo
{
    private function sayFoo()
    {
        /* uncomment this line */
        //$this->doSomeFoo();
    }
    private function doSomeFoo()
    {
        echo "Doing some foo\n";
    }

}

$foo = new foo;
// print the structure of $foo
print_r($foo);
// var_dump($foo);
Initially, this will return

foo Object
(
)

Which is correct.

However, if you then uncomment the line in "sayFoo", the print_r will return the name of the private function as one of the array indexes.

Changing the scope of "sayFoo" does the same thing no matter what scope you use.

I'm pretty sure this isn't expected behaviour, as that would expose the private function's existance (even though they still can't be accessed).

Tested on:
PHP 5.0.0-dev, 200305061830 build, Win32 package.

Cheers
-Adam Goossens

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-05-17 09:27 UTC] agoossens at olc dot sa dot edu dot au
Update: I discovered that the reason the private functions are being exposed is because functions do not need to be defined to be added to the output. They simply need to be called at least once anywhere in a class. 

class foo
{
    public function sayFoo()
    {
        $this->doSomeFoo();
    }
}

$foo = new foo;

The print_r() output on this will still give 
foo Object {
   [doSomeFoo]=>
}

Strangely, it seems that here sayFoo() will not appear in the output, even though it's scope is public!
 [2003-06-09 08:51 UTC] zeev@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 23 17:01:31 2024 UTC