php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #52044 Access protected method violation
Submitted: 2010-06-11 10:20 UTC Modified: 2010-06-11 12:12 UTC
From: public at proside dot fr Assigned:
Status: Not a bug Package: Class/Object related
PHP Version: 5.3.2 OS: WIN XP SP3+
Private report: No CVE-ID: None
 [2010-06-11 10:20 UTC] public at proside dot fr
Description:
------------
In one case, the PHP engine allows access to the protected methods of an instanciated class

As the documentation says : protected methods are only available inside the class that declares it and inside the tree of derivated classes. If you look at the code, we are in none of these case : $a is a standalone instance of MyParent so the protected methods of class MyParent should be hidden.

Am i wrong ?

Test script:
---------------
<?php
class MyParent {	
   protected function getProtectedParent() { return 'Parent_Protected'; }
}

class MyChild extends MyParent {
   function getPublicChild() {
      # --> new standalone instance of MyParent
      $a = new MyParent();
      # --> here it's possible to access to the protected method of $a !
      return $a->getProtectedParent();
   }
}

$cls = new MyChild();
$test = $cls->getPublicChild();

Expected result:
----------------
Fatal error : access level violation

Actual result:
--------------
$test = 'Parent_Protected'

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-06-11 10:28 UTC] degeberg@php.net
-Status: Open +Status: Bogus
 [2010-06-11 10:28 UTC] degeberg@php.net
Yes, you are wrong. One MyParent object knows the private/protected interface of all other MyParent objects, so it is allowed to access it. Other classes don't, so they're not allowed.

Thanks for your interest though.
 [2010-06-11 11:12 UTC] public at proside dot fr
I almost do agree about your comment, but in my example, $a is a standalone instance of the parent class. Where $a can be used doesn't really matter, it's still a standalone instance of class like any general instance of class. And in the general case the PHP engine logically prevent the access to the protected methods. Here, it seems that the context of execution of a standalone object impacts the contract defined by the OOP rules !
 [2010-06-11 11:52 UTC] degeberg@php.net
Hi,

Please see my answer here: http://news.php.net/php.doc.cvs/6808

$a is "standalone", but it is MyParent instance used within another MyParent instance. It's not leaking any information to other classes, so it isn't violating any contracts.
 [2010-06-11 12:12 UTC] public at proside dot fr
Ok, many thanks mister :-)
Fast, brilliant and useful
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 01:01:28 2024 UTC