$methodName($className, $args); } /* oops. we are in the process space (restricted). */ else { /* it must be instatiated */ if (is_null(self::$_securedFactory)) self::$_securedFactory = new ProcessFactory(); $className = array_shift($args); /** * If the class is not allowed, we must check who is trying * to instantiate it. If it's a module guy, let's allow him. * Throw up the exception otherwise. */ try { $obj = &self::$_securedFactory->$methodName($className, $args); } /** * We are erroneously catching any exceptions. We should catch only the 'class not allowed' * types of exceptions. To do so, a custom exception class must be defined. */ catch(Exception $e) { /** * Here we are using depth 2 in isSafeDir method, because we are on a private * method. Thus, we need to know if the "caller's caller's" function is on a * safe dir, instead of the direct caller's method. */ if (Security::isSafeDir(2)) $obj = &self::$_unsecuredFactory->$methodName($className, $args); /* naaasty one. take this! */ else throw($e); } // finally return $obj; } } } ?>