In PHP, when you override a method, you are permitted to increase its visibility (for example, from protected to public).

I believe this is absolutely never desirable and always a mistake. (If we really wanted to expose some protected/private functionality from subclasses, it would be better in every situation I can imagine to define a new public method which is implemented by calling the existing protected/private method).

See D11049 for a concrete issue this causes: an incorrect piece of code appeared to be correct, and worked correctly because a protected method in the parent had become public in the subclass by accident.

We can write a unit/acceptance test to identify these issues, although we need to fix them first. Here are the issues I was able to identify with a test:

Some caveats:

• Some of these are in extensions or Phacility libraries (e.g., the Instances stuff).
• Not 100% sure this is accurate, although spot checking it looks correct.
• Some code may rely on these incorrect visibilities, so we can't necessarily just find/replace all of these and call it a day.
  • But, realistically, testing them exhaustively would be a huge amount of work.
  • We can probably do one "low risk" pass on the 95% of them that are very unlikely to cause problems, and then test a few in more detail.