Disable serialization of SingletonFactory classes

If you don't disable the serialization of SingletonFactory classes, it's
 possible to create multiple instances simply be serializing the existin
g instance and and unserializing it again.

diff --git a/wcfsetup/install/files/lib/system/SingletonFactory.class.php b/wcfsetup/install/files/lib/system/SingletonFactory.class.php
index e182f7106e251c3b1e57416ede8c49e40de8e47f..39cccc72d2df6bec18f2e16241927c8466e988e6 100644 (file)
--- a/wcfsetup/install/files/lib/system/SingletonFactory.class.php
+++ b/wcfsetup/install/files/lib/system/SingletonFactory.class.php
@@ -36,6 +36,11 @@ abstract class SingletonFactory {
         */
        protected final function __clone() { }
        
+       /**
+        * Object serialization is disallowed.
+        */
+       protected final function __sleep() { }
+       
        /**
         * Returns an unique instance of current child class.
         *