Re: [RFC] Serialize filtering
| From: | Andrea Faulds | Date: | Mon, 27 Oct 2014 20:38:07 +0000 |
| Subject: | Re: [RFC] Serialize filtering | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-78405@lists.php.net to get a copy of this message | ||
> On 27 Oct 2014, at 08:03, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
>
> I'd like to have a vote on unserialize() improvement proposal outlined here:
> https://wiki.php.net/rfc/secure_unserialize
Suggestion on improving the API: Why bother with three values?
If there’s no parameter, use current behaviour. If there’s an array, it’s allowed classes. If
that array is empty, obviously there are no allowed classes.
--
Andrea Faulds
http://ajf.me/