L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-45417 mod_imscp: Prevent entity injections from package content

Browse Source
This commit is contained in:
Frederic Massart
2014-07-07 13:02:54 +01:00
committed by Dan Poltawski
parent 78ed99ec7e
commit 595ef4772d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/imscp/locallib.php
+6
View File
@@ -104,9 +104,11 @@ function imscp_parse_structure($imscp, $context) {
*/
function imscp_parse_manifestfile($manifestfilecontents, $imscp, $context) {
$doc = new DOMDocument();
$oldentities = libxml_disable_entity_loader(true);
if (!$doc->loadXML($manifestfilecontents, LIBXML_NONET)) {
return null;
}
libxml_disable_entity_loader($oldentities);
// we put this fake URL as base in order to detect path changes caused by xml:base attributes
$doc->documentURI = 'http://grrr/';
@@ -204,10 +206,14 @@ function imscp_recursive_href($manifestfilename, $imscp, $context) {
if (!$manifestfile = $fs->get_file($context->id, 'mod_imscp', 'content', $imscp->revision, $dirname, $filename)) {
return null;
}
$doc = new DOMDocument();
$oldentities = libxml_disable_entity_loader(true);
if (!$doc->loadXML($manifestfile->get_content(), LIBXML_NONET)) {
return null;
}
libxml_disable_entity_loader($oldentities);
$xmlresources = $doc->getElementsByTagName('resource');
foreach ($xmlresources as $res) {
if (!$href = $res->attributes->getNamedItem('href')) {