From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 1 Dec 2010 13:33:49 +0000 (+0000)
Subject: Allowed indirect $this access (Scott)
X-Git-Tag: php-5.4.0alpha1~191^2~580
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a45631d9663a8a6af7b5a739e48966a604a7e961;p=php

Allowed indirect $this access (Scott)
---

diff --git a/Zend/tests/indirect_reference_this.phpt b/Zend/tests/indirect_reference_this.phpt
new file mode 100644
index 0000000000..c344bd03ff
--- /dev/null
+++ b/Zend/tests/indirect_reference_this.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Indirect referenced $this
+--FILE--
+<?php
+class X {
+  function f($x){var_dump($$x);}
+}
+$x = new X;
+$x->f("this");
+?>
+--EXPECTF--
+object(X)#%d (0) {
+}
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 9d61c004d6..30f8f6d5a1 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -5543,6 +5543,10 @@ void zend_do_indirect_references(znode *result, const znode *num_references, zno
 	}
 	zend_do_begin_variable_parse(TSRMLS_C);
 	fetch_simple_variable(result, variable, 1 TSRMLS_CC);
+	/* there is a chance someone is accessing $this */
+	if (CG(active_op_array)->scope && CG(active_op_array)->this_var == -1) {
+		CG(active_op_array)->this_var = lookup_cv(CG(active_op_array), estrndup("this", sizeof("this")-1), sizeof("this")-1);
+	}
 }
 /* }}} */