approved these changes Jul 20, 2020
Dik Takken added 3 commits
August 3, 2020 20:33
Since libxml version 2.9.0 external entity loading is disabled by default. Bumping the version requirement means that XML processing in PHP is no longer vulnerable to XXE processing attacks by default.
This method was used to protect code against XXE processing attacks. Since PHP now requires libxml >= 2.9.0 external entity loading no longer needs to be disabled to prevent these attacks. It is disabled by default. Also, the method has an unwanted side effect that causes a lot of confusion: Parsing XML data from resources like files is no longer possible.
Merged
Merged
ADmad added a commit to cakephp/cakephp that referenced this pull request
Aug 8, 2020
With libxml >= 2.9.0, loading of external entities is disabled, even if libxml_disable_entity_loader(false) is called. Instead the flag LIBXML_NOENT needs to be used to enable it. See php/php-src#5867
Merged
ADmad added a commit to cakephp/cakephp that referenced this pull request
Aug 8, 2020
With libxml >= 2.9.0, loading of external entities is disabled, even if libxml_disable_entity_loader(false) is called. Instead the flag LIBXML_NOENT needs to be used to enable it. See php/php-src#5867
markstory pushed a commit to cakephp/utility that referenced this pull request
Aug 9, 2020
With libxml >= 2.9.0, loading of external entities is disabled, even if libxml_disable_entity_loader(false) is called. Instead the flag LIBXML_NOENT needs to be used to enable it. See php/php-src#5867
symfony-splitter pushed a commit to symfony/translation that referenced this pull request
Aug 10, 2020
This PR was merged into the 3.4 branch. Discussion ---------- Fix deprecated libxml_disable_entity_loader | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | / | License | MIT | Doc PR | / Fix deprecation `Function libxml_disable_entity_loader() is deprecated` triggered by php/php-src#5867 in PHP8 Commits ------- 1f19da3 Fix deprecated libxml_disable_entity_loader
symfony-splitter pushed a commit to symfony/config that referenced this pull request
Aug 10, 2020
This PR was merged into the 3.4 branch. Discussion ---------- Fix deprecated libxml_disable_entity_loader | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | / | License | MIT | Doc PR | / Fix deprecation `Function libxml_disable_entity_loader() is deprecated` triggered by php/php-src#5867 in PHP8 Commits ------- 1f19da3936 Fix deprecated libxml_disable_entity_loader
symfony-splitter pushed a commit to symfony/dependency-injection that referenced this pull request
Aug 10, 2020
This PR was merged into the 3.4 branch. Discussion ---------- Fix deprecated libxml_disable_entity_loader | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | / | License | MIT | Doc PR | / Fix deprecation `Function libxml_disable_entity_loader() is deprecated` triggered by php/php-src#5867 in PHP8 Commits ------- 1f19da3936 Fix deprecated libxml_disable_entity_loader
jrfnl added a commit to PHPCompatibility/PHPCompatibility that referenced this pull request
Aug 10, 2020
Merged
Merged
Mark-H added a commit to Mark-H/revolution that referenced this pull request
Sep 18, 2020
…e libxml entity loader [modxcms#15237] The libxml_disable_entity_loader function is deprecated in PHP8, and the entity loader is automatically enabled on v2.9.0+ of libxml which may have been used pre-PHP8 as well. PHP8 comes with at least v2.9.0+ of libxml bundled, so this conditional covers both scenarios. Ref: php/php-src#5867
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Sep 21, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I8a09d62a9920fd0bf4a388baa5544a02323bb541
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Sep 21, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I8a09d62a9920fd0bf4a388baa5544a02323bb541 (cherry picked from commit 64ea157 )
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Sep 21, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I8a09d62a9920fd0bf4a388baa5544a02323bb541 (cherry picked from commit 64ea157 )
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Sep 21, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I8a09d62a9920fd0bf4a388baa5544a02323bb541 (cherry picked from commit 64ea157 )
Merged
Closed
Closed
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Nov 15, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I7cabc5b8d44813d709a11db2f219ae16260542c7
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Nov 15, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I7cabc5b8d44813d709a11db2f219ae16260542c7
wmfgerrit pushed a commit to wikimedia/mediawiki that referenced this pull request
Nov 15, 2020
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I7cabc5b8d44813d709a11db2f219ae16260542c7
SerhiyMytrovtsiy added a commit to SerhiyMytrovtsiy/translation that referenced this pull request
Oct 19, 2022
This PR was merged into the 3.4 branch. Discussion ---------- Fix deprecated libxml_disable_entity_loader | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | / | License | MIT | Doc PR | / Fix deprecation `Function libxml_disable_entity_loader() is deprecated` triggered by php/php-src#5867 in PHP8 Commits ------- 1f19da3936 Fix deprecated libxml_disable_entity_loader
krohnden pushed a commit to ild-thl/mediawiki that referenced this pull request
Nov 23, 2022
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I8a09d62a9920fd0bf4a388baa5544a02323bb541 (cherry picked from commit 64ea157 )
krohnden pushed a commit to ild-thl/mediawiki that referenced this pull request
Nov 23, 2022
As per https://www.php.net/manual/en/function.libxml-disable-entity-loader.php this is technically unnecessary. >However, as of libxml 2.9.0 entity substitution is disabled by default, >so there is no need to disable the loading of external entities. See also php/php-src#5867 >Since the release of libxml 2.9.0 in 2012 external entity loading is >disabled in libxml by default. This means that using >libxml_disable_entity_loader() is no longer needed. Hopefully helps prevent false positive reports from security scanning tools. Change-Id: I7cabc5b8d44813d709a11db2f219ae16260542c7
ADmad added a commit to cakephp/utility that referenced this pull request
Mar 19, 2026
With libxml >= 2.9.0, loading of external entities is disabled, even if libxml_disable_entity_loader(false) is called. Instead the flag LIBXML_NOENT needs to be used to enable it. See php/php-src#5867
adrian-enspired pushed a commit to adrian-enspired/php-src that referenced this pull request
Aug 4, 2026
This method was used to protect code against XXE processing attacks. Since PHP now requires libxml >= 2.9.0 external entity loading no longer needs to be disabled to prevent these attacks. It is disabled by default. Also, the method has an unwanted side effect that causes a lot of confusion: Parsing XML data from resources like files is no longer possible. Closes phpGH-5867.