From 9b60a086cfdc35c53f38ad678b9bef1dd656348c Mon Sep 17 00:00:00 2001
From: Frederic Massart <fred@moodle.com>
Date: Fri, 13 Jun 2014 15:40:15 +0800
Subject: [PATCH] MDL-45417 mod_imscp: Prevent entity injections from package
 content

---
 mod/imscp/locallib.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mod/imscp/locallib.php b/mod/imscp/locallib.php
index d51ecf7a690..edf55d1dede 100644
--- a/mod/imscp/locallib.php
+++ b/mod/imscp/locallib.php
@@ -105,9 +105,11 @@ function imscp_parse_structure($imscp, $context) {
  */
 function imscp_parse_manifestfile($manifestfilecontents) {
     $doc = new DOMDocument();
+    $oldentities = libxml_disable_entity_loader(true);
     if (!$doc->loadXML($manifestfilecontents, LIBXML_NONET)) {
         return null;
     }
+    libxml_disable_entity_loader($oldentities);
 
     // we put this fake URL as base in order to detect path changes caused by xml:base attributes
     $doc->documentURI = 'http://grrr/';