Bug #74758 [Opn->Nab]: \Closure::call allows full access to private properties

Edit report at https://bugs.php.net/bug.php?id=74758&edit=1 ID: 74758 Updated by: kelunik@php.net Reported by: martijn at openbsd dot org Summary: \Closure::call allows full access to private properties -Status: Open +Status: Not a bug Type: Bug Package: Class/Object related Operating System: Irrelevant PHP Version: 7.0.20 Block user comment: N Private report: N New Comment: This is expected behavior, see http://php.net/manual/en/closure.bindto.php. > The “bound object” determines the value $this will have in the function body and the > “class scope” represents a class which determines which private and protected members the > anonymous function will be able to access. Previous Comments: ------------------------------------------------------------------------ [2017-06-14 19:16:24] stas@php.net Not a security issue, PPP is not a security measure. ------------------------------------------------------------------------ [2017-06-14 08:53:48] martijn at openbsd dot org Description: ------------ \Closure::call allows full access to private properties when the closure contains $this->... Test script: --------------- <?php class A { private $C = 1; private function B() { return "B"; } } $a = new A; $b = function() { return $this->B(); }; $c = function() { $this->C = 2; }; var_dump($b->call($a)); $c->call($a); var_dump($a); ?> Expected result: ---------------- PHP Fatal error: Uncaught Error: Call to private method A::B() from context '' in /tmp/test.php:22 Actual result: -------------- string(1) "B" object(A)#1 (1) { ["C":"A":private]=> int(2) } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74758&edit=1