contao/core — pull request #6730 by discordier (2014-02-11 22:18:32+00:00)
Title: Harden the core classes agains unserialize() object injections.

See #6695.

We implement a `__wakeup()` method in all classes having a `__destruct()`
method that unsets all object properties and throws an exception.
In addition, some of the `__destruct()` methods also have been hardened.

This is to be considered a replacement or at least a complement to #6724 as we do not have any BC break.

Note that this currently ONLY fixes the Contao Core classes and NOT swiftmailer or simplepie.
I have not yet investigated if and how those can be fixed.

These files might have to be hardened also:
system/modules/core/vendor/swiftmailer/classes/Swift/Mime/SimpleMimeEntity.php
system/modules/core/vendor/swiftmailer/classes/Swift/Transport/AbstractSmtpTransport.php
system/modules/core/vendor/swiftmailer/classes/Swift/ByteStream/TemporaryFileByteStream.php
system/modules/core/vendor/swiftmailer/classes/Swift/KeyCache/DiskKeyCache.php
system/modules/core/vendor/simplepie/SimplePie/Item.php
system/modules/core/vendor/simplepie/SimplePie.php
system/modules/core/vendor/simplepie/SimplePie.php
system/modules/core/vendor/simplepie/SimplePie.php