Re: [RFC] [VOTE] Filtered unserialize()

On 03/11/2014 22:10, Stas Malyshev wrote:

I'd like to put to vote my proposal about the filtered unserialize():

Hi, After discussing this RFC with a few other people, we seem to agree that allowing some level of security-related filtering when unserializing is a nice idea -- so, we would be +1 on the principle. Some of us think raising a notice -- or, better, throwing an exception -- in case of a not-allowed class might be helpful, especially when it comes to detecting problems and unsafe input data. Still, we understand __PHP_Incomplete_Class must have been chosen to remain close to the way unserialize() now behaves. -- Pascal MARTIN, AFUP - French UG http://php-internals.afup.org/