Project

General

Profile

Actions

Bug #20029

closed

t3lib_div::makeInstanceClassName() allows to bypass checks for t3lib_Singleton

Added by Ingo Renner almost 16 years ago. Updated over 14 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Category:
-
Target version:
-
Start date:
2009-02-16
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
4.3
PHP Version:
5.1
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

When marking a class as singleton by implementing t3lib_Singleton one can assure that at any time there's only one instance of that class when consistently using t3lib_div::makeInstance(). However, one can circumvent this and still create multiple instances of the class by using t3lib_div::makeInstanceClassName() together with the new operator.

The same problem arises when implementing t3lib_Singleton and requiring arguments to be passed to the constructor of that class. This class can only be instanciated by using t3lib_div::makeInstanceClassName() and the new operator, and thus again bypassing the check for the singleton.

This can have multiple implications with performance and also behavior.

Solution: * make t3lib_div::makeInstance() aware of constructor arguments in the first step.
  • make the functionality of t3lib_div::makeInstanceClassName() available as a protected internal function. This functionality is still needed to recursively resolve xclassed class names.
  • mark t3lib_div::makeInstanceClassName() as deprecated with a hint for t3lib_div::makeInstance()
  • replace all occurances of t3lib_div::makeInstanceClassName() in the core with t3lib_div::makeInstance() calls. (separate issue)
  • later, with TYPO3 4.5, remove t3lib_div::makeInstanceClassName() eventually enforcing the check for singletons

The last hunk in the patch acts as an example of how the code is cleaned up and still works. This is not part of the actual patch and is not intended for the commit.

We can of course not prevent someone from directly using the new operator with the class name, but this is out of scope for this issue as it's considered unclean anyways as xclasses aren't taken into account this way.

(issue imported from #M10454)


Files

makeInstanceWithArgs.diff (2.2 KB) makeInstanceWithArgs.diff Administrator Admin, 2009-02-16 22:58
makeInstanceWithArgs_v2.diff (2.45 KB) makeInstanceWithArgs_v2.diff Administrator Admin, 2009-02-19 13:31
makeInstanceWithArgs_v3.diff (1.5 KB) makeInstanceWithArgs_v3.diff Administrator Admin, 2009-02-19 13:47

Related issues 1 (0 open1 closed)

Related to TYPO3 Core - Bug #20057: Mark t3lib_div::makeInstanceClassName() as deprecatedClosedIngo Renner2009-02-19

Actions
Actions #1

Updated by Ingo Renner almost 16 years ago

v2 handles an error that is raised when trying to use $reflectionObject->newInstanceArgs($constructorArguments); on a class that does not have a constructor. That case should be rare though. For performance reasons we ignore it for now and keep the patch here just in case.

Actions #2

Updated by Ingo Renner almost 16 years ago

added final, committed patch

Actions #3

Updated by Ingo Renner almost 16 years ago

committed to trunk (4.3)

Actions

Also available in: Atom PDF