From 51311b0e2549a1f9449bba32b9e0dca29f99b347 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Tue, 11 Aug 2020 04:07:35 +0200 Subject: [PATCH] PHP 8.0: only call libxml_disable_entity_loader() in PHP < 8 As per the PHP 8.0 changelog: > `libxml_disable_entity_loader()` has been deprecated. As libxml 2.9.0 is now > required, external entity loading is guaranteed to be disabled by default, > and this function is no longer needed to protect against XXE attacks. Source: https://github.com/php/php-src/blob/71bfa5344ab207072f4cd25745d7023096338385/UPGRADING#L808-L811 Calling the function conditionally will prevent deprecation warnings. --- src/wp-includes/class-wp-oembed.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/wp-includes/class-wp-oembed.php b/src/wp-includes/class-wp-oembed.php index 1c10f44489..ac139e4f62 100644 --- a/src/wp-includes/class-wp-oembed.php +++ b/src/wp-includes/class-wp-oembed.php @@ -597,13 +597,21 @@ class WP_oEmbed { return false; } - $loader = libxml_disable_entity_loader( true ); + if ( PHP_VERSION_ID < 80000 ) { + // This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is + // disabled by default, so this function is no longer needed to protect against XXE attacks. + // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.libxml_disable_entity_loaderDeprecated + $loader = libxml_disable_entity_loader( true ); + } $errors = libxml_use_internal_errors( true ); $return = $this->_parse_xml_body( $response_body ); libxml_use_internal_errors( $errors ); - libxml_disable_entity_loader( $loader ); + if ( PHP_VERSION_ID < 80000 && isset( $loader ) ) { + // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.libxml_disable_entity_loaderDeprecated + libxml_disable_entity_loader( $loader ); + } return $return; } -- 2.28.0.windows.1