wolfcms/wolfcms — Issue #399: Object property visibility nullified
Author: Forage
Created: 2012-02-01 18:13:38+00:00
State: open

Hi,

I was extending Wolf CMS and I found that the object's property visibility is nullified, in at least some helpers, because of to the way supplied initialization parameter arrays are applied.

Take the Email helper e.g. (code simplified):

```php
function initialize($configs = array()) {
foreach ($configs as $key => $val) {
if (isset($this->$key)) {
$this->$key = $val;
}
}
}
```

Each property supplied in the array will be set in the object, public as well as private.
The same is being done for the Pagination helper, but that one doesn't really count in its current state because its properties are public.

Reason I'm not just providing a pull request with a fix for this class is because I'd like to give you a heads-up and come to an agreement on how to address the issue for new functionality.

I'd propose the following:

```php
function initialize($configs = array()) {
foreach ($configs as $key => $val) {
if (isset($this->$key)) {
$propery = new ReflectionProperty($this, $key);

if ($propery->isPublic()) {
$this->$key = $val;
}
}
}
}
```

You might feel that this will create additional complexity. A different way to go about it is to introduce one or more abstract classes with a general initialize function or introduce a global function to test property visibility and/or a global function to supply you only with the public properties of an object (get_object_vars unfortunately is scope dependant).

Example of the latter:

```php
function my_get_object_vars($obj) {
$ref = new ReflectionObject($obj);
$pros = $ref->getProperties(ReflectionProperty::IS_PUBLIC);
$result = array();
foreach ($pros as $pro) {
false && $pro = new ReflectionProperty();
$result[$pro->getName()] = $pro->getValue($obj);
}

return $result;
}
```

One for the security enhancement TODO for Wolf CMS 1.0? ;-)