PHP 8.0: only call libxml_disable_entity_loader() in PHP < 8

[jrf]

As per the PHP 8.0 changelog:

libxml_disable_entity_loader() has been deprecated. As libxml 2.9.0 is now
required, external entity loading is guaranteed to be disabled by default,
and this function is no longer needed to protect against XXE attacks.

Source: ​https://github.com/php/php-src/blob/71bfa5344ab207072f4cd25745d7023096338385/UPGRADING#L808-L811

Calling the function conditionally will prevent deprecation warnings.

The function is also used in GetID3 - a PR to the same effect as this PR has been pulled & merged and is expected to be included in the next GetID3 release.

Ref: ​https://github.com/JamesHeinrich/getID3/pull/260

As per the PHP 8.0 changelog:

libxml_disable_entity_loader() has been deprecated. As libxml 2.9.0 is now
required, external entity loading is guaranteed to be disabled by default,
and this function is no longer needed to protect against XXE attacks.

Source: ​https://github.com/php/php-src/blob/71bfa5344ab207072f4cd25745d7023096338385/UPGRADING#L808-L811

Calling the function conditionally will prevent deprecation warnings.

Trac ticket: https://core.trac.wordpress.org/ticket/50898

[SergeyBiryukov]

In 48789:

Code Modernization: Only call libxml_disable_entity_loader() in PHP < 8.

This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is disabled by default, so this function is no longer needed to protect against XXE attacks.

Props jrf.
Fixes #50898.

Patch has been committed. Closing.

[desrosj]

Adding needs-dev-note to call out in the PHP 8 dev note.

[desrosj]

It looks like the needed getID3 changes have yet to make their way into a tagged release and still need to be ported over to WordPress.

50898-getid3.diff​ makes the related change for 5.6, and will be included in the next versioned update when available.

[desrosj]

Sorry for the noise! 50898-getid3.2.diff​ fixes an issue applying the diff I did not catch initially.

[hellofromTonya]

@desrosj Reviewing the patch 50898-getid3.2.diff, it looks good. It matches the combination of ​https://github.com/JamesHeinrich/getID3/pull/260 and ​https://github.com/JamesHeinrich/getID3/pull/261. Ship it!

[desrosj]

In 49621:

Code Modernization: Only call libxml_disable_entity_loader() in PHP < 8.

This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is disabled by default, so this function is no longer needed to protect against XXE attacks.

This change fixes an instance of libxml_disable_entity_loader() within the getID3 library that has not yet been included in a tagged release for the library.

Props jrf, hellofromtonya.
Fixes #50898.

[daisyo]

Dev note published: ​https://make.wordpress.org/core/2020/11/23/wordpress-and-php-8-0/