@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Disable SimpleXML entity loader in Phabricator
Summary: See D8049. Same deal as that one, but this is in the Phabricator web stack.
Test Plan: Man oh man.
Reviewers: btrahan
Reviewed By: btrahan
CC: aran
Differential Revision: https://secure.phabricator.com/D8050
+5
+5
support/PhabricatorStartup.php
+5
support/PhabricatorStartup.php
···
280
280
private static function setupPHP() {
281
281
error_reporting(E_ALL | E_STRICT);
282
282
ini_set('memory_limit', -1);
283
+
284
+
// If we have libxml, disable the incredibly dangerous entity loader.
285
+
if (function_exists('libxml_disable_entity_loader')) {
286
+
libxml_disable_entity_loader(true);
287
+
}
283
288
}
284
289
285
290
/**