Re: Warning: Call-time pass-by-reference in XML/Parser.php

"Tobias H.Michaelsen" wrote: > > On Fri, 14 Sep 2001 01:32:30 +0200, cox@idecnet.com (Tomas V.V.Cox) wrote: > > There is a security problem with this parsing mode. Until more and more > > people continues using it, it's time to change the API. Basically the > > change involves that the function name instead of being simply $elem it > > will be replaced with "xmltag_$elem" (prefixing the "xmltag_" string). > > Also we need to change the deprecated call_user_method() with > > call_user_func() (making the class incompatible with php < 4.0.6 I > > guess). > > I can't see that call_user_method() should be deprecated (in the manual)? And > call_user_func() should be supported in all 4.x releases, also according to the manual. > If you try to use call_user_method() with php 4.0.7 this message will be raisen: Notice: The call_user_method() function is deprecated, use the call_user_func variety with the array(&$obj, "method") syntax instead in ... Without having the chance to shut it up. Therefore, we won't want to ship this file (or any other like PEAR.php) with the php 4.0.7 incoming distribution with that problem. I'll provide a php version detection mechanism to use call_user_method() with php < 4.0.7 and call_user_func() in the other cases. > It was only the call-time pass-by-reference part (&$attribs) that was giving the warning. > So I suggest that the '&' is removed, and then the user must specify it in the > function declaration, if he/she feels that it is needed. > > > I know that we hate to break the API or make the class only usable with > > the last avaible php version, but is there any other solution? If not > > I'll do the changes in the next days. > > Why not just do it as quick as possible, before more people start using the current api? Sorry I'm overload mode now, but I'll try to fix it now (yeah now or never :-) > I have attached a suggestion that uses call_user_method() if a method exists or try to use > call_user_func() otherwise. > Function names are: 'xmltag'.$elem.'Start' and > 'xmltag'.$elem.'End'. > Thanks, Tomas V.V.Cox