moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-04 16:36:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-34284 library: Import ZF2012-01 security patch for Zend

Browse source
This commit is contained in:
Frederic Massart 2013-02-11 15:20:11 +08:00 • committed by Damyon Wiese
parent c2cef5809e
commit 55b330e6d8
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/zend/Zend/XmlRpc/Request.php
View file

@ -303,12 +303,15 @@ class Zend_XmlRpc_Request
return false; return false;
} }
// @see ZF-12293 - disable external entities for security purposes
$loadEntities = libxml_disable_entity_loader(true);
try { try {
$xml = new SimpleXMLElement($request); $xml = new SimpleXMLElement($request);
} catch (Exception $e) { } catch (Exception $e) {
// Not valid XML // Not valid XML
$this->_fault = new Zend_XmlRpc_Fault(631); $this->_fault = new Zend_XmlRpc_Fault(631);
$this->_fault->setEncoding($this->getEncoding()); $this->_fault->setEncoding($this->getEncoding());
libxml_disable_entity_loader($loadEntities);
return false; return false;
} }
@ -317,6 +320,7 @@ class Zend_XmlRpc_Request
// Missing method name // Missing method name
$this->_fault = new Zend_XmlRpc_Fault(632); $this->_fault = new Zend_XmlRpc_Fault(632);
$this->_fault->setEncoding($this->getEncoding()); $this->_fault->setEncoding($this->getEncoding());
libxml_disable_entity_loader($loadEntities);
return false; return false;
} }
@ -330,6 +334,7 @@ class Zend_XmlRpc_Request
if (!isset($param->value)) { if (!isset($param->value)) {
$this->_fault = new Zend_XmlRpc_Fault(633); $this->_fault = new Zend_XmlRpc_Fault(633);
$this->_fault->setEncoding($this->getEncoding()); $this->_fault->setEncoding($this->getEncoding());
libxml_disable_entity_loader($loadEntities);
return false; return false;
} }
@ -340,6 +345,7 @@ class Zend_XmlRpc_Request
} catch (Exception $e) { } catch (Exception $e) {
$this->_fault = new Zend_XmlRpc_Fault(636); $this->_fault = new Zend_XmlRpc_Fault(636);
$this->_fault->setEncoding($this->getEncoding()); $this->_fault->setEncoding($this->getEncoding());
libxml_disable_entity_loader($loadEntities);
return false; return false;
} }
} }
@ -348,6 +354,7 @@ class Zend_XmlRpc_Request
$this->_params = $argv; $this->_params = $argv;
} }
libxml_disable_entity_loader($loadEntities);
$this->_xml = $request; $this->_xml = $request;
return true; return true;

2
lib/zend/readme_moodle.txt
View file

@ -9,4 +9,4 @@ Changes:
* small fix to error reporting in reflection (MDL-21460, ZF-8980) * small fix to error reporting in reflection (MDL-21460, ZF-8980)
* SOAP and XMLRPC servers overwrite the fault() functions * SOAP and XMLRPC servers overwrite the fault() functions
* synced and renamed file to version in ZF 1.10.6 (MDL-30603, ZF-11080) * synced and renamed file to version in ZF 1.10.6 (MDL-30603, ZF-11080)
* import security patch (MDL-34284, ZF2012-01, ZF-12293)