zendframework/zf2 — pull request #1985 by weierophinney (2012-07-25 13:26:39+00:00)
Title: Feature/controller loader security

This PR addresses a potential security issue in how controllers are loaded. It does so using the following approach:

- Controllers now have their own plugin manager, Zend\Mvc\Controller\ControllerManager. It still accepts the same configuration as for beta5. It validates instances to ensure we have a Dispatchable, raising an InvalidControllerException if not.
- The ControllerManager peers against the main ServiceManager, but instructs not to pull controller instances from the peering manager; however, dependencies _can_ be retrieved from it.
- The ControllerLoader service factory does not add DI as an AbstractFactory to the ControllerManager. This prevents the ability to load arbitrary classes. This is the only BC break at this time; developers who wish to use DI to grab controllers should drop in their own ControllerManager or ControllerLoaderFactory.