why does get_object_vars return protected properties?

Question

I have used get_object_vars for a while now.. It always only returns public properties of an object, but suddenly it also returns protected vars?!? How can that be? It has never done that before

code

print_r($row);
print_r(get_object_vars($row));

returns

Data_model_Accounting Object
(
    [get_external:protected] => 1
    [put_external:protected] => 1
    [delete_external:protected] => 1
    [post_class:protected] => 1
    [external_field_const:protected] => Array
        (
            [type] => Array
                (
                    [0] => LEDGER
                    [1] => DEBTOR_LEDGER
                    [2] => CREDITOR_LEDGER
                    [3] => DEBTOR_INVOICE
                    [4] => CREDITOR_INVOICE
                )

        )

    [external_field_condition_unset:protected] => Array
        (
            [invoice_id_] => Array
                (
                    [type] => Array
                        (
                            [mode] => not_in
                            [values] => Array
                                (
                                    [0] => DEBTOR_INVOICE
                                    [1] => CREDITOR_INVOICE
                                )

                        )

                )

            [invoice_time_due] => Array
                (
                    [type] => Array
                        (
                            [mode] => not_in
                            [values] => Array
                                (
                                    [0] => DEBTOR_INVOICE
                                    [1] => CREDITOR_INVOICE
                                )

                        )

                )

        )

    [table:protected] => 
    [predata:protected] => Array
        (
        )

    [data:protected] => Array
        (
        )

    [external:protected] => 1
    [put_error:protected] => 
    [action_mode:protected] => 
    [Shell:protected] => 
    [access_admin_primary:protected] => 1
    [get_admin_external:protected] => 
    [put_admin_external:protected] => 
    [delete_admin_external:protected] => 
    [id] => 19
    [time] => 1362787200
    [type] => DEBTOR_LEDGER
    [account_id_] => 16000
    [account_name] => Debitor
    [accountoff_id_] => 16000
    [accountoff_name] => Debitor
    [vatcode_name] => 
    [subaccount_id_] => 10
    [subaccount_type] => DEBTOR
    [subaccount_name] => hehe
    [subaccountoff_id_] => 101
    [subaccountoff_type] => DEBTOR
    [subaccountoff_name] => oskel
    [dimension_name] => 
    [dimensionoff_name] => 
    [currency_name] => 
    [invoice_id_] => 
    [invoice_time_due] => 0
    [amount] => -165
    [currency_amount] => -165
    [currency_rate] => 1
)
Array
(
    [table] => 
    [predata] => Array
        (
        )

    [data] => Array
        (
        )

    [external] => 1
    [put_error] => 
    [action_mode] => 
    [Shell] => 
    [access_admin_primary] => 1
    [get_admin_external] => 
    [put_admin_external] => 
    [delete_admin_external] => 
    [id] => 19
    [time] => 1362787200
    [type] => DEBTOR_LEDGER
    [account_id_] => 16000
    [account_name] => Debitor
    [accountoff_id_] => 16000
    [accountoff_name] => Debitor
    [vatcode_name] => 
    [subaccount_id_] => 10
    [subaccount_type] => DEBTOR
    [subaccount_name] => hehe
    [subaccountoff_id_] => 101
    [subaccountoff_type] => DEBTOR
    [subaccountoff_name] => oskel
    [dimension_name] => 
    [dimensionoff_name] => 
    [currency_name] => 
    [invoice_id_] => 
    [invoice_time_due] => 0
    [amount] => -165
    [currency_amount] => -165
    [currency_rate] => 1
)

Answer 1

Nope, this is not new behaviour, nor behaviour that was beamed into your computer overnight.

From the documentation:

Returns an associative array of defined object accessible non-static properties for the specified object in scope.

No mention of access levels.

However, there is an undocumented facet that comes down to visibility and scope, reported by a user who left the following comment on the same documentation page:

Be aware of the fact that this is scope-sensitive. If you're calling this from an objects own method, then private and protected vars will be outputted as well. Call it from outside the object and the result will most likely be what you want to archive.

The documentation is your friend. Use it.