When libxmlloader options are teh default values, disable the entity …

…loader as well. CVE-2014-2054 by MITRE
PHPOffice · Feb 21, 2014 · fdc4532 · fdc4532
1 parent 1dad681
commit fdc4532
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/Classes/PHPExcel/Settings.php b/Classes/PHPExcel/Settings.php
@@ -366,6 +366,7 @@ public static function setLibXmlLoaderOptions($options = null)
         if (is_null($options)) {
             $options = LIBXML_DTDLOAD | LIBXML_DTDATTR;
         }
+        @libxml_disable_entity_loader($options == (LIBXML_DTDLOAD | LIBXML_DTDATTR)); 
         self::$_libXmlLoaderOptions = $options;
     } // function setLibXmlLoaderOptions
 
@@ -378,8 +379,8 @@ public static function setLibXmlLoaderOptions($options = null)
     public static function getLibXmlLoaderOptions()
     {
         if (is_null(self::$_libXmlLoaderOptions)) {
-            self::$_libXmlLoaderOptions = LIBXML_DTDLOAD | LIBXML_DTDATTR;
+            self::setLibXmlLoaderOptions(LIBXML_DTDLOAD | LIBXML_DTDATTR);
         }
         return self::$_libXmlLoaderOptions;
     } // function getLibXmlLoaderOptions
-}
+}