thekid/rfc — Issue #82: RFC 0082: No classloader misuse in scriptlet API
Author: thekid
Created: 2011-10-09 14:56:39+00:00
State: open

Scope of Change
====
AbstractXMLScriptlet will no longer receive a ClassLoader instance
in their constructor call. Instead the "base" package name under which
classes for the website reside will be passed as string.

Rationale
====
A classloader object is created with the package name that indicates
where to load the scriptlet's state classes and context from. A
classloader constructed with

```php

```

will load classes from that package only. However, it will fail to
do so when those classes would be in an archive, as a classloader
always only loads classes from its own repository.

Functionality
====
The AbstractXMLScriptlet will be passed the base package name as string
and use XPClass::forName() to load required classes.

Security considerations
====
Narrow down class availability to classes contained in a package is
not a security feature, so n/a.

Speed impact
====
n/a

Dependencies
====
n/a

Related documents
====
- http://xp-framework.net/rfc/contrib/rfc0082.diff
Patch implementing this RFC

Comments
====
- kiesel, Sun Oct 15 15:15:47 CEST 2006
This change could be done in a BC-break free manner. I chose to supply a
patch *with* BC break, because otherwise we'd end up with all classes
mixing between new and old style.
Only new style (passing a string) should be supported in the end, and
changing existing classes is quite easy in this case.