Changeset 29391 for branches/3.8

Timestamp:

08/06/2014 05:57:14 AM (12 years ago)

Author:

nacin

Message:

Disable external entities in ID3.

Merges [29378] to the 3.8 branch.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/ID3/getid3.lib.php (modified) (1 diff)

branches/3.8/src/wp-includes/ID3/getid3.lib.php

@@ -520 +520 @@
 
         public static function XML2array($XMLstring) {
-                if (function_exists('simplexml_load_string')) {
-                        if (function_exists('get_object_vars')) {
-                                $XMLobject = simplexml_load_string($XMLstring);
-                                return self::SimpleXMLelement2array($XMLobject);
-                        }
+                if ( function_exists( 'simplexml_load_string' ) && function_exists( 'libxml_disable_entity_loader' ) ) {
+                        $loader = libxml_disable_entity_loader( true );
+                        $XMLobject = simplexml_load_string( $XMLstring, 'SimpleXMLElement', LIBXML_NOENT );
+                        $return = self::SimpleXMLelement2array( $XMLobject );
+                        libxml_disable_entity_loader( $loader );
+                        return $return;
                 }
                 return false;