php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #45281 each on objects shows private and protected properties
Submitted: 2008-06-16 14:50 UTC Modified: 2009-02-13 23:01 UTC
Votes:3
Avg. Score:4.7 ± 0.5
Reproduced:3 of 3 (100.0%)
Same Version:3 (100.0%)
Same OS:3 (100.0%)
From: kopelke at gmail dot com Assigned: helly (profile)
Status: Not a bug Package: Class/Object related
PHP Version: 5.2.6 OS: *
Private report: No CVE-ID: None
 [2008-06-16 14:50 UTC] kopelke at gmail dot com
Description:
------------
If each is used on an object it will reveal the protected and private member data. It is not possible to change this data, but it should not be visible at all.
Besides the each function should not be allowed on objects, or, if implementing ArrayAccess, it should not reveal the private and protected properties.

Reproduce code:
---------------
class A {
	private $x = 'private';
	protected $y = 'protected';
	public $z = 'public';
}

$o = new A();
$o -> a = 'outer:public';

while(list($k, $v) = each($o)) {
	$pos = 0;
	if($k{0} == "\0") 
		$k = substr($k, $pos = strpos($k, "\0", 1) + 1);
	switch($pos) {
		case 6:
			$k = 'Private::' . $k; break;
		case 3:
			$k = 'Protected::' . $k; break;
		default:
			$k = 'Public::' . $k; break;
	}
	echo '<pre>'; print_r(array($k, $v)); echo '</pre>';
}

Expected result:
----------------
Array
(
    [0] => Public::z
    [1] => public
)

Array
(
    [0] => Public::a
    [1] => outer:public
)

Actual result:
--------------
Array
(
    [0] => Protected::x
    [1] => private
)

Array
(
    [0] => Protected::y
    [1] => protected
)

Array
(
    [0] => Public::z
    [1] => public
)

Array
(
    [0] => Public::a
    [1] => public von aussen
)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-07-06 01:26 UTC] jani@php.net
Assigned to Marcus who (IIRC) implemented this PPP stuff.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 23 22:01:31 2024 UTC