note 102603 added to function.class-alias

paul [dot] kotets [at] gmail [dot] com: I've got a nice code injection attack for your "replacement" function for class_alias: <?php if (!function_exists('class_alias')) { function class_alias($original, $alias) { eval('abstract class ' . $alias . ' extends ' . $original . ' {}'); } } $alias = 'some_class extends existingClass {function _print(){ print 1;}}; some_class::_print(); class my_class'; class_alias( 'existingClass', $alias ); // prints "1" - and thats safe!!! imagine what could be done if exploited. ?> ---- Server IP: 69.147.83.197 Probable Submitter: 58.167.252.166 ---- Manual Page -- http://www.php.net/manual/en/function.class-alias.php Edit -- https://master.php.net/note/edit/102603 Del: integrated -- https://master.php.net/note/delete/102603/integrated Del: useless -- https://master.php.net/note/delete/102603/useless Del: bad code -- https://master.php.net/note/delete/102603/bad+code Del: spam -- https://master.php.net/note/delete/102603/spam Del: non-english -- https://master.php.net/note/delete/102603/non-english Del: in docs -- https://master.php.net/note/delete/102603/in+docs Del: other reasons-- https://master.php.net/note/delete/102603 Reject -- https://master.php.net/note/reject/102603 Search -- https://master.php.net/manage/user-notes.php