Changeset 29391

Timestamp:

08/06/2014 05:57:14 AM (11 years ago)

Author:

nacin

Message:

Disable external entities in ID3.

Merges [29378] to the 3.8 branch.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/ID3/getid3.lib.php (modified) (1 diff)

branches/3.8/src/wp-includes/ID3/getid3.lib.php

@@ -520 +520 @@
 
     public static function XML2array($XMLstring) {
-        if (function_exists('simplexml_load_string')) {
-            if (function_exists('get_object_vars')) {
-                $XMLobject = simplexml_load_string($XMLstring);
-                return self::SimpleXMLelement2array($XMLobject);
-            }
+        if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) {
+            $loader = libxml_disable_entity_loader( true );
+            $XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT );
+            $return = self::SimpleXMLelement2array( $XMLobject );
+            libxml_disable_entity_loader( $loader );
+            return $return;
         }
         return false;