note 102603 deleted from function.class-alias by danbrown
| From: | danbrown@php.net | Date: | Thu, 24 Feb 2011 15:07:18 +0000 |
| Subject: | note 102603 deleted from function.class-alias by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-177293@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
paul [dot] kotets [at] gmail [dot] com:
I've got a nice code injection attack for your "replacement" function for
class_alias:
<?php
if (!function_exists('class_alias')) {
function class_alias($original, $alias) {
eval('abstract class ' . $alias . ' extends ' . $original . '
{}');
}
}
$alias = 'some_class extends existingClass {function _print(){ print 1;}};
some_class::_print(); class my_class';
class_alias( 'existingClass', $alias );
// prints "1" - and thats safe!!! imagine what could be done if exploited.
?>