Re: Re[2]: [Phplib-users] phplib-php4 object resumption differences

[Giancarlo <gia...@na...>]

Il 11:10, venerd=EC 27 settembre 2002, Maxim Derkachev ha scritto:
> Hello Marko,
>
> The problem described by Giancarlo does not apply to the PHP's
> serialize behavior, not Session4_Custom in particular. If you want to
> make serialize not to save all the class variables, you should define
> __sleep & __wakeup in serialized classes. This also apply to the
> classes saved by User4, since it also serializes objects using PHP
> serialize().

Ok. Now look at how the auth object is serialized.

Suppose you have an auth object created by the Example_auth class. the on=
ly=20
persistent slot is designed to be the $auth->auth array. Not even classna=
me.

You make persisten a session that has an auth class with classname=20
Example_auth and nobody=3Dfalse (no default_auth).

You then open a page that HAS default_auth. It resumes from persistance a=
=20
completely different auth object.=20
IF (and only if) here was not one persistent, it creates one, with classn=
ame=20
Example_auth and, most important, var $nobody=3Dtrue. It will obviously i=
nherit=20
the whole $auth->auth array, but these properties, that were meant to sta=
y=20
OUT of pertsistance, are not, and thus not respected.
So really a bug it is, for me

Gian