[fusion-commits] r2853 - in branches/fusion-mg24: . common/php
svn_fusion at osgeo.org
svn_fusion at osgeo.org
Tue Jun 24 20:57:54 PDT 2014
Author: jng
Date: 2014-06-24 20:57:54 -0700 (Tue, 24 Jun 2014)
New Revision: 2853
Modified:
branches/fusion-mg24/
branches/fusion-mg24/common/php/Xml2JSON.php
Log:
Merged revision(s) 2850 from trunk:
#617: XXE security fix
........
Property changes on: branches/fusion-mg24
___________________________________________________________________
Modified: svn:mergeinfo
- /sandbox/jxlib-3.0:1957-2248
/trunk:2563,2565,2567,2569,2576,2578-2583,2585,2608-2614
+ /sandbox/jxlib-3.0:1957-2248
/trunk:2563,2565,2567,2569,2576,2578-2583,2585,2608-2614,2850
Modified: branches/fusion-mg24/common/php/Xml2JSON.php
===================================================================
--- branches/fusion-mg24/common/php/Xml2JSON.php 2014-06-25 03:56:48 UTC (rev 2852)
+++ branches/fusion-mg24/common/php/Xml2JSON.php 2014-06-25 03:57:54 UTC (rev 2853)
@@ -28,6 +28,10 @@
*/
include(dirname(__FILE__).'/Utilities.php');
+//Requests to this script can be made from anywhere, so disable XML entity loading to
+//guard against malicious XML
+libxml_disable_entity_loader(true);
+
if (isset($_FILES['xml'])) {
$xml = file_get_contents($_FILES['xml']['tmp_name']);
} elseif (isset($_SERVER['HTTP_HOST'])) {
More information about the fusion-commits
mailing list