Differences

This shows you the differences between two versions of the page.

--- rfc:secure_unserialize [2014/11/17 00:55] – stas
+++ rfc:secure_unserialize [2014/11/23 06:17] – stas
@@ Line 61: / Line 61: @@
 </doodle>
+===== API change =====
+After some thought and discussion, I have decided to slightly change the API:
+<code php>
+// this will unserialize everything as before
+$data = unserialize($foo);
+// this will convert all objects into __PHP_Incomplete_Class object
+$data = unserialize($foo, ["allowed_classes" => false]);
+// this will convert all objects except ones of MyClass and MyClass2 into __PHP_Incomplete_Class object
+$data = unserialize($foo, ["allowed_classes" => ["MyClass", "MyClass2"]);
+//accept all classes as in default
+$data = unserialize($foo, ["allowed_classes" => true]);
+</code>
+This will allow to extend the options array in the future if we ever want to add more parameters. No objections were voiced on the list regarding this API change.
 ===== References =====