vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2025-10-16 12:05:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Code Modernization: Only call libxml_disable_entity_loader() in PHP < 8.

Browse Source 
This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is disabled by default, so this function is no longer needed to protect against XXE attacks.

This change fixes an instance of `libxml_disable_entity_loader()` within the getID3 library that has not yet been included in a tagged release for the library.

Props jrf, hellofromtonya.
Fixes #50898.

git-svn-id: https://develop.svn.wordpress.org/trunk@49621 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jonathan Desrosiers 2020-11-17 00:58:33 +00:00
parent 4fcdd01f33
commit 828ee6c1ed
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/wp-includes/ID3/getid3.lib.php
View File

@ -720,12 +720,18 @@ class getid3_lib
*/
public static function XML2array($XMLstring) {
if (function_exists('simplexml_load_string') && function_exists('libxml_disable_entity_loader')) {
// http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
// https://core.trac.wordpress.org/changeset/29378
$loader = libxml_disable_entity_loader(true);
if (PHP_VERSION_ID < 80000) {
// http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
// https://core.trac.wordpress.org/changeset/29378
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is
// disabled by default, so this function is no longer needed to protect against XXE attacks.
$loader = libxml_disable_entity_loader(true);
}
$XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', LIBXML_NOENT);
$return = self::SimpleXMLelement2array($XMLobject);
libxml_disable_entity_loader($loader);
if (PHP_VERSION_ID < 80000 && isset($loader)) {
libxml_disable_entity_loader($loader);
}
return $return;
}
return false;