Harden the autoloader against unserialize -> LFI risks.

[paragonie-scott]

No description provided.

[defuse]

How about we just map class names to paths?

$map = array(
  'Crypto' => 'src/Crypto.php',
  'Core' => 'src/Core.php',
 ...
)

[paragonie-scott]

Yeah, that's probably more sensible. Does #116 cover this already? (If so, I will close. If not, I will fix.)

[defuse]

#116 doesn't do it yet, feel free to do it if you want.

[paragonie-scott]

Okay, I believe this is ready to go. :)

[defuse]

Thanks. Going to attempt rebasing this onto my other WIP branch :-)

[defuse]

Can't figure that out right now, I'll do it tomorrow. :-)

[defuse]

(If you happen to get to it first, I added some new files, and I intend to change it to do $classmap[$relative_class] for efficiency).

[paragonie-scott]

Dammit, I did not mean to push that commit.