Merge pull request zendframework/zendframework#1985 from weierophinne…

…y/feature/controller-loader-security

Feature/controller loader security

src/AbstractPluginManager.php

@@ -34,6 +34,13 @@ abstract class AbstractPluginManager extends ServiceManager implements ServiceLo
      */
     protected $allowOverride   = true;
 
+    /**
+     * Whether or not to auto-add a class as an invokable class if it exists
+     * 
+     * @var bool
+     */
+    protected $autoAddInvokableClass = true;
+
     /**
      * @var mixed Options to use when creating an instance
      */
@@ -93,7 +100,7 @@ abstract public function validatePlugin($plugin);
     public function get($name, $options = array(), $usePeeringServiceManagers = true)
     {
         // Allow specifying a class name directly; registers as an invokable class
-        if (!$this->has($name) && class_exists($name)) {
+        if (!$this->has($name) && $this->autoAddInvokableClass && class_exists($name)) {
             $this->setInvokableClass($name, $name);
         }
 

src/ServiceManager.php

@@ -434,6 +434,7 @@ public function create($name)
             $cName = $this->canonicalizeName($rName);
         }
 
+
         if (isset($this->factories[$cName])) {
             $instance = $this->createFromFactory($cName, $rName);
         }