[Pkg-owncloud-commits] [owncloud] 37/134: Disable XML entities when parsing XML

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository owncloud.

commit 4966d632ae6e2c780e327bed0d94145b5161d554
Author: Vincent Petry <pvince81 at owncloud.com>
Date:   Mon Mar 10 17:49:47 2014 +0100

    Disable XML entities when parsing XML
---
 lib/private/ocsclient.php | 16 ++++++++++++----
 lib/private/updater.php   |  2 ++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/lib/private/ocsclient.php b/lib/private/ocsclient.php
index e35556d..d4a3e59 100644
--- a/lib/private/ocsclient.php
+++ b/lib/private/ocsclient.php
@@ -71,7 +71,9 @@ class OC_OCSClient{
 		if($xml==false) {
 			return null;
 		}
-		$data=simplexml_load_string($xml);
+		$loadEntities = libxml_disable_entity_loader(true);
+		$data =	simplexml_load_string($xml);
+		libxml_disable_entity_loader($loadEntities);
 
 		$tmp=$data->data;
 		$cats=array();
@@ -114,7 +116,9 @@ class OC_OCSClient{
 		if($xml==false) {
 			return null;
 		}
-		$data=simplexml_load_string($xml);
+		$loadEntities = libxml_disable_entity_loader(true);
+		$data = simplexml_load_string($xml);
+		libxml_disable_entity_loader($loadEntities);
 
 		$tmp=$data->data->content;
 		for($i = 0; $i < count($tmp); $i++) {
@@ -156,7 +160,9 @@ class OC_OCSClient{
 			OC_Log::write('core', 'Unable to parse OCS content', OC_Log::FATAL);
 			return null;
 		}
-		$data=simplexml_load_string($xml);
+		$loadEntities = libxml_disable_entity_loader(true);
+		$data = simplexml_load_string($xml);
+		libxml_disable_entity_loader($loadEntities);
 
 		$tmp=$data->data->content;
 		$app=array();
@@ -196,7 +202,9 @@ class OC_OCSClient{
 			OC_Log::write('core', 'Unable to parse OCS content', OC_Log::FATAL);
 			return null;
 		}
-		$data=simplexml_load_string($xml);
+		$loadEntities = libxml_disable_entity_loader(true);
+		$data = simplexml_load_string($xml);
+		libxml_disable_entity_loader($loadEntities);
 
 		$tmp=$data->data->content;
 		$app=array();
diff --git a/lib/private/updater.php b/lib/private/updater.php
index 643d2ea..c7dc478 100644
--- a/lib/private/updater.php
+++ b/lib/private/updater.php
@@ -76,7 +76,9 @@ class Updater extends BasicEmitter {
 		if ($xml == false) {
 			return array();
 		}
+		$loadEntities = libxml_disable_entity_loader(true);
 		$data = @simplexml_load_string($xml);
+		libxml_disable_entity_loader($loadEntities);
 
 		$tmp = array();
 		$tmp['version'] = $data->version;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git