protected function can still be called outside the class

[vher2]

What steps will reproduce the problem?

Declare a class then extends BaseObject

class Sample extends \yii\base\BaseObject {
    private $_mode = 'mode';
  
    protected function getMode()
    {
        return $this->_mode;
    }
}

Now create new instance

$sample = new Sample();
echo $sample->mode;

// output:
// mode

Though you can't call the getMode() method directly but still I think this is an issue.

I think this is because how the __get($name) magic function works. When it checks if a method exists or not, it will return true because it has access to that method.

Additional info

Q	A
Yii version	2.0.15.1
PHP version	5.6

[dmirogin]

I think it is BC. Some apps can use this by accident, for example.

[samdark]

Well, that is really a bug. If someone uses such behavior it's totally incorrect.