L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-45463 mod_lti: Prevent XML entity injections from provider

Browse Source
This commit is contained in:
Frederic Massart
2014-07-07 13:00:39 +01:00
committed by Dan Poltawski
parent 61961447c2
commit 2d121036cc
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/lti/service.php
+8 -1
View File
@@ -54,7 +54,14 @@ if ($sharedsecret === false) {
throw new Exception('Message signature not valid');
}
$xml = new SimpleXMLElement($rawbody);
// TODO MDL-46023 Replace this code with a call to the new library.
$origentity = libxml_disable_entity_loader(true);
$xml = simplexml_load_string($rawbody);
if (!$xml) {
libxml_disable_entity_loader($origentity);
throw new Exception('Invalid XML content');
}
libxml_disable_entity_loader($origentity);
$body = $xml->imsx_POXBody;
foreach ($body->children() as $child) {