Changeset 24470 for trunk/wp-includes/class-oembed.php

Timestamp:

06/21/2013 03:29:13 AM (13 years ago)

Author:

nacin

Message:

Better sanity checks in oEmbed XML handling. see [23158].

File:

• trunk/wp-includes/class-oembed.php (modified) (1 diff)

trunk/wp-includes/class-oembed.php

@@ -225 +225 @@
                         return false;
                 }
-
-                if ( ! class_exists( 'DOMDocument' ) )
-                        return false;
+                if ( ! function_exists( 'libxml_disable_entity_loader' ) )
+                        return false;
+
+                $loader = libxml_disable_entity_loader( true );
 
                 $errors = libxml_use_internal_errors( true );
-                $old_value = null;
-                if ( function_exists( 'libxml_disable_entity_loader' ) ) {
-                        $old_value = libxml_disable_entity_loader( true );
-                }
-
-                $dom = new DOMDocument;
-                $success = $dom->loadXML( $response_body );
-
-                if ( ! is_null( $old_value ) ) {
-                        libxml_disable_entity_loader( $old_value );
-                }
+                $data = simplexml_load_string( $response_body );
                 libxml_use_internal_errors( $errors );
 
-                if ( ! $success || isset( $dom->doctype ) ) {
-                        return false;
-                }
-
-                $data = simplexml_import_dom( $dom );
-                if ( ! is_object( $data ) )
-                        return false;
-
-                $return = new stdClass;
-                foreach ( $data as $key => $value )
-                        $return->$key = (string) $value;
+                $return = false;
+                if ( is_object( $data ) ) {
+                        $return = new stdClass;
+                        foreach ( $data as $key => $value ) {
+                                $return->$key = (string) $value;
+                        }
+                }
+
+                libxml_disable_entity_loader( $loader );
                 return $return;
         }