Re: Re: Problems with the fix for the BC break introduced in 5.4.29 and 5.5.13

On Thu, Jun 19, 2014 at 12:22 AM, Stas Malyshev <smalyshev@sugarcrm.com> wrote: > Hi! > >> My proposal, for a quick solution, trying to be pragmatic and >> trying to make the most of php users happy. > > Is the solution of banning only the internal classes with create_object > and their descendants unsatisfactory? For me, it's a safe solution, however, it breaks BC, I think it's a no-go for 5.4 and 5.5. This however could be a 5.6+ solution. For 5.4 and 5.5, there doesn't seem to be easy fix on the go. I suggest following what Remi suggests : - Revert the BC break in 5.5 and 5.4 - Keep the segfault, we've been living with it for ages - Patch the manual to clearly show one should never try to unserialize hand-made strings : we just do not support such behavior (thus, it could lead to segfaults) - What if tomorrow we replace our serializer by igbinary or so ? Users should not be aware of internal details, serialized string is definetly one Julien