Changeset 29378 for trunk/src/wp-includes/ID3/getid3.lib.php

Timestamp:

08/05/2014 07:13:57 PM (10 years ago)

Author:

nacin

Message:

Disable external entities in ID3.

File:

• trunk/src/wp-includes/ID3/getid3.lib.php (modified) (1 diff)

trunk/src/wp-includes/ID3/getid3.lib.php

@@ -520 +520 @@
 
     public static function XML2array($XMLstring) {
-        if (function_exists('simplexml_load_string')) {
-            if (function_exists('get_object_vars')) {
-                $XMLobject = simplexml_load_string($XMLstring);
-                return self::SimpleXMLelement2array($XMLobject);
-            }
+        if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) {
+            $loader = libxml_disable_entity_loader( true );
+            $XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT );
+            $return = self::SimpleXMLelement2array( $XMLobject );
+            libxml_disable_entity_loader( $loader );
+            return $return;
         }
         return false;