Edit report at https://bugs.php.net/bug.php?id=60431&edit=1
ID: 60431
Comment by: kapsonfire at gmx dot de
Reported by: kapsonfire at gmx dot de
Summary: private Array
Status: Bogus
Type: Bug
Package: Class/Object related
Operating System: Debian Squeeze
PHP Version: 5.3.8
Block user comment: N
Private report: N
New Comment:
The problem is that private vars shouldn't be readable for security reasons.
Even in debugging purposes....
if you create an instance of a class on $owner, which is private
it isn`t readable with print_r
of course, using $class->attribut doesn't work
but private variables should never readable outside of the class
if they are still readable with debugging methods it's still a security leak
for me
and i don't believe its expected to be readable, because then there should be
all private variables be readable via print_r
Previous Comments:
------------------------------------------------------------------------
[2011-12-02 12:22:26] paj...@php.net
No, it is not readable. Using:
class Item {
private $DATA=array();
private $OWNER=null;
public function __construct($itemID) {
}
}
$a = new Item(1);
$a->DATA;
PHP Fatal error: Cannot access private property Item::$DATA in
/home/pierre/60431.php on line 14
------------------------------------------------------------------------
[2011-12-02 12:15:11] kapsonfire at gmx dot de
Well, but this only happens with arrays used as datalayer in this way.
The $OWNER isn't readable outside with print_r after creating an instance on it.
------------------------------------------------------------------------
[2011-12-02 12:11:33] paj...@php.net
Release\php.exe -n -r "class f {private $f=1;} $a = new f; $a->f;"
Fatal error: Cannot access private property f::$f in Command line code on line 1
print_r/var_dump are only a debugging/informative functions.
------------------------------------------------------------------------
[2011-12-02 12:03:45] kapsonfire at gmx dot de
Description:
------------
Using an private array in a Class as Data Layer become readale outside of class
with print_r
Test script:
---------------
<?php
//test.php
require "classes/Item.class.php";
require "classes/User.class.php";
session_start();
//DB SHIT
$item = new Item(1);
echo "<pre>ITEMOBJECT:<br>".(print_r($item,true))."</pre>";
?>
<?php
// classes/Item.class.php
class Item {
private $DATA=array();
private $OWNER=null;
public function __construct($itemID) {
$item = mysql_fetch_assoc(mysql_query("SELECT * FROM w1_items WHERE
itemid = $itemID"));
$keys = array_keys($item);
foreach($keys as $key)
{
$this->DATA[$key] = $item[$key];
}
}
}
Expected result:
----------------
ITEMOBJECT:
Item Object
(
[DATA:Item:private] => Array
(
[itemid] => 1
[uid] => 2
)
[OWNER:Item:private] =>
)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=60431&edit=1
