Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Code Modernization: Only call `libxml_disable_entity_loader()` in PHP < 8. 

This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is disabled by default, so this function is no longer needed to protect against XXE attacks.

Props jrf.
Fixes #50898.
Built from https://develop.svn.wordpress.org/trunk@48789


git-svn-id: http://core.svn.wordpress.org/trunk@48551 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2020-08-12 15:25:03 +00:00
parent 3ccc91894b
commit 07ec574a54
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
wp-includes/class-wp-oembed.php
View File

@ -597,13 +597,23 @@ class WP_oEmbed {
return false;
}
$loader = libxml_disable_entity_loader( true );
if ( PHP_VERSION_ID < 80000 ) {
// This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading
// is disabled by default, so this function is no longer needed to protect against XXE attacks.
// phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.libxml_disable_entity_loaderDeprecated
$loader = libxml_disable_entity_loader( true );
}
$errors = libxml_use_internal_errors( true );
$return = $this->_parse_xml_body( $response_body );
libxml_use_internal_errors( $errors );
libxml_disable_entity_loader( $loader );
if ( PHP_VERSION_ID < 80000 && isset( $loader ) ) {
// phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.libxml_disable_entity_loaderDeprecated
libxml_disable_entity_loader( $loader );
}
return $return;
}

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.6-alpha-48788';
$wp_version = '5.6-alpha-48789';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.