Disabled libxml external entity loading by default.

If you want to allow loading external entity references in XML, call PHPExcel_Settings::setLibXmlLoaderOptions(0).
PHPOffice · Feb 21, 2014 · 1dad681 · 1dad681
1 parent 220da74
commit 1dad681
Show file tree

Hide file tree

Showing 5 changed files with 285 additions and 254 deletions.
diff --git a/Classes/PHPExcel/Reader/Excel2003XML.php b/Classes/PHPExcel/Reader/Excel2003XML.php
@@ -137,7 +137,7 @@ public function listWorksheetNames($pFilename)
 
 		$worksheetNames = array();
 
-		$xml = simplexml_load_file($pFilename);
+		$xml = simplexml_load_file($pFilename, 'SimpleXMLElement', PHPExcel_Settings::getLibXmlLoaderOptions());
 		$namespaces = $xml->getNamespaces(true);
 
 		$xml_ss = $xml->children($namespaces['ss']);
@@ -165,7 +165,7 @@ public function listWorksheetInfo($pFilename)
 
 		$worksheetInfo = array();
 
-		$xml = simplexml_load_file($pFilename);
+		$xml = simplexml_load_file($pFilename, 'SimpleXMLElement', PHPExcel_Settings::getLibXmlLoaderOptions());
 		$namespaces = $xml->getNamespaces(true);
 
 		$worksheetID = 1;
@@ -330,7 +330,7 @@ public function loadIntoExisting($pFilename, PHPExcel $objPHPExcel)
 			throw new PHPExcel_Reader_Exception($pFilename . " is an Invalid Spreadsheet file.");
 		}
 
-		$xml = simplexml_load_file($pFilename);
+		$xml = simplexml_load_file($pFilename, 'SimpleXMLElement', PHPExcel_Settings::getLibXmlLoaderOptions());
 		$namespaces = $xml->getNamespaces(true);
 
 		$docProps = $objPHPExcel->getProperties();