Bug #75348 [NEW]: Private/protected property disclosure

From: anrdaemon at freemail dot ru Operating system: All PHP version: 7.2.0RC3 Package: *General Issues Bug Type: Bug Bug description:Private/protected property disclosure Description: ------------ It is possible to access values (and names to an extent) of all object properties regardless their access level using reset/end/each. This behavior also prevents the expected behavior from using reset/next/current with clasess implementing Iterator/ArrayAccess interfaces. Test script: --------------- <?php class MyClass { private $var1 = 'Some value 1'; protected $var2 = 'Some value 2'; protected $var3 = 'Some value 3'; } $obj = new MyClass; foreach($obj as $key => $value) { print "$key => $value\n"; } reset($obj); while($val = each($obj)) print_r($val); Expected result: ---------------- No output. Actual result: -------------- The class content is dumped from second loop. -- Edit bug report at https://bugs.php.net/bug.php?id=75348&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75348&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75348&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75348&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75348&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75348&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75348&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75348&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75348&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75348&r=support Expected behavior: https://bugs.php.net/fix.php?id=75348&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75348&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75348&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75348&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75348&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75348&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75348&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75348&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75348&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75348&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75348&r=mysqlcfg